data anonymization survey results

www.privacyanalytics.ca | 613.369.4313

[email protected]

251 Laurier Avenue, Suite 200

Ottawa, Ontario, Canada K1P 5J6

Data Anonymization Survey Results

Market Trends in Anonymization

© 2014 Privacy Analytics, Inc.

Presenter

Luk Arbuckle, Director of [email protected]


In September of this year, we finalized a survey of 100 legal, privacy, and business analyst

professionals in the healthcare industry in the United States and Canada.


A group of companies are incorporating organizational, management, and technology best practices to anonymize data:

Ad hoc re-identification risk assessment

Systematic approaches to risk assessment

Siloed approaches to anonymization

Centralized management of privacy and anonymization practices

Limited analytic utility and value

Faster time to insight and money

Followers Leaders

Better insights and the secure leveraging of data assets


34% of respondents apply anonymization best practices

90% intend to increase the amount of anonymized data

© 2014 Privacy Analytics, Inc.6

The State of Sharing Data for

Secondary Purposes


62%

59%

49%

41%

41%

36%

21%

11%

11%

15%

18%

20%

22%

17%

14%

20%

27%

26%

33%

39%

37%

47%

65%

69%

Academic research

Improve healthcare outcomes

Benchmarking

Improve patient safety

Identify cost savings/efficiencies

Test and measurement

Resell anonymized data to third-parties

Detect fraud

Figure 1. Use of Anonymized Data

Q. What do you use anonymized data for today and what do you plan

to use it for in the next 12 months?

Currently use it for Plan to use it for No plan Base: All (n=100)

A shift to cost savings, fraud detection, and patient safety


58%

46%

42%

41%

39%

38%

36%

34%

19%

11%

15%

10%

13%

9%

14%

6%

3%

5%

12%

3%

5%

4%

4%

9%

20%

39%

31%

46%

42%

49%

47%

51%

Electronic Health Records

Medical claims

Self-reported health data

Satisfaction surveys

Health surveys

Insurance claims

Enrollment data

Clinical trial data

Currently do it Plan to <12 mos Plan to >12 mos No Plan

Figure 2: Data Sources for Anonymization

Q. Which of the following data sources do you typically anonymize for secondary use?

Base: All (n=100)

EHR‘s are the main source for anonymized data


36%

34%

27%

26%

24%

Cost is considered too high

Organizational structure, corporate culture or internal processesare not conducive: Little collaboration

Lack of IT integration with current masking and anonymizationinvestments

Too complex: Lack of appropriate user skills

Not aware of any barriers

Figure 3: Barriers to Implementing a Statistical De-identification Approach

Q. Of the barriers to implementing a statistical de-identification approach to data for secondary use, which three are the biggest barriers

your organization face? (% rating the item as among the top 3 barriers)

Base: All (n=100)

Cost and organizational structure are limiting factors


Who Are the Leading

Practitioners?


Survey Questions:Q. Which statement best describes your organization's approach to managing data for secondary use? Please select one. Q. How would you describe your organization's process for coordinating and managing compliance for secondary use across your organization? Select one response.

Compliance Management Process

Dat

a/P

riva

cy

Man

agem

ent

Ap

pro

ach

Leaders: use a combination of policy and technology to minimize risk and institute a central function/process to enforce compliance

66%All others: trail the leaders in the use of policy and technology to manage risk or instituting centralized compliance management or both

34%

66%

Integrated compliance policies with anonymization

34%


59%

41%

15%

20%

A centralized function that ensures compliance across anorganization using risk-based methods that govern secondary

data use

A defined data release process requiring ethics board reviewapproval (i.e. IRB, ERB)

Leaders

All Others

Centralized data management and governance practice

Figure 4: Process for Coordinating and Managing Compliance

Q. How would you describe your organization's process for coordinating and

managing compliance for secondary use across your organization?

Base: Leaders (n=34), All Others (n=66)

3.9xDifference

2xDifference


Cross-functional coordination of best practices

Figure 5: Collaboration

Q. How well does privacy/compliance function collaborate with data analysts/research groups on establishing best

practices associated with managing data for secondary use?

15%

18%

32%

42%

53%

39%

Leaders

Others

Not well

Neutral

Well

Base: All (n=100), Leaders (n=34), Others (n=66)

1.4xDifference


63%

51%

81%

85%

53%

28%

13%

11%

17%

23%

7%

12%

13%

17%

17%

26%

13%

11%

17%

32%

Leaders

Others

Leaders

Others

Leaders

Others

Currently Use Plan to use in <12 months Plan to use >12 months No plan to use it

Advanced data anonymization, and some ad hoc methods

1.9xDifference

Data Masking

In-house tools and manual ad hoc methods

Automated Statistical De-id

2%

3%


88%

85%

82%

82%

64%

75%

69%

69%

68%

51%

Anonymization of structured data

Measuring the quality of anonymized data foranalysis

Automated anonymization

Statistical de-identification

Big data scalability (i.e. Hadoop)

Leaders Others Base: All (n=100), Leaders (n=34), Others (n=66)

Prioritized anonymization to share high quality data at scale

Figure 6: Important Capabilities

Q. How important are the following capabilities to your approach to anonymizing data for secondary use?

(% rating the capability important - 4/5 ratings)


What are the business

outcomes of best practices?


Readily measure the risk of re-identification

Figure 7: Ability to Measure Risk

Q. How well can your organization determine and measure re-identification risk of anonymized data?

26%

42%

24%

32%

50%

26%

Leaders

Others

1.9xDifference

Not Well

Neutral

Well



Providing anonymized data in a timely manner

Figure 8: Timeliness of Anonymized Data Delivery

Q. How satisfied are you in providing anonymized data in a timely manner?

19%

30%

22%

32%

59%

38%

Leaders

Others


Not Satisfied

Neutral

Satisfied

1.6xDifference


13%

23%

22%

33%

66%

44%

Leaders

Others

Analytic quality of anonymized data

19

Figure 9: Satisfaction Analytic Granularity and Insight

Q. How satisfied are you about the analytic granularity and level of insight you receive from your

anonymized data?


Not Satisfied

Neutral

Satisfied

1.5xDifference


Val

ue

Maturity

From Ad Hoc to the Corporate Application of Anonymization Practices

Anonymization of different data sets

Recognition of privacy concerns and growth of data

Anonymization is a critical business practice

From Siloed Controls and Processes to Systematic Corporate Practices

Centralized management of data and governance

Establish corporate anonymization standards

Use of sophisticated anonymization techniques

From Protecting to Sharing Anonymized Data

Anonymization becomes a standard business practice

Organizations gain business benefit from anonomyized data

Key takeaways … best practicesRecognition Standardize Applied Business Practice


Burning questions?


12%

11%

10%

8%

7%

7%

6%

6%

6%

5%

3%

2%

1%

17%

Government

Academic or research institution

Government agency

Healthcare Informatics

Medical center

Pharmaceutical

Hospital

Insurance (Payer)

Health Information Exchange

Association (i.e. non-profit…

Consulting

Medical devices

Insurance (Provider)

Other

Survey participants

Figure: Country

Figure: Industry Figure: Employee Size

26%

17%

7%

19%

31%

< 100

100-499

500-999

1000-4999

5000+

US, 69%

Canada, 31%

Figure: Job Level

Senior executives

,19%

Director or Manager,

64%

Non-managerial staff, 17%

Figure: Job Function

(multiple choices)

29%

81%

70%

54%

Legal

Privacy/Compliance

Data/Business Analysis

IT supporting research and dataanalysis

Figure: Status of Releasing Health Data for

Secondary Use

Currently release

data , 91%

Plan to in the next

12 months,

9%


Survey Methodology

23

• Our first market trends survey to examine the state of the market in using technology to leverage health data for secondary purposes

• 100 legal, privacy/compliance and data/business analyst professionals in the US and Canada participated in the web survey

• All organizations that participated in the survey either currently release health data for secondary use or plan to do so in the next 12 months

• Survey was administered by RONIN Corporation

data anonymization survey results

Data & Analytics

privacy analytics

secondary use

use of policy

following data sources

state of sharing data

secondary purposes

compliance process

technology best practices