Privacy in Health-care

Privacy in Health care: Differential Privacy Techniques in Health-care data

Healthcare data is usually of the following type

- Categorical data (codes, drugs, tests, geographical information)

- Numerical data (age, duration of stay in hospital, time since last visit)

Analysts of healthcare domain are accustomed to analyze data in a particular format. They perform various types of analysis by applying techniques like transforms on formatted data. Hence it becomes necessary to provide the data they need in same format.

Addition of Laplace noise to numeric data can distort the values significantly. Differential privacy works under the assumption that individuals are independent of each other. If this assumption is violated then inferences can be made.0

Issues

- Many healthcare datasets are highly correlated or have natural constraints.

- Independent distortions of data may not make sense.

- If two drugs are said to have an effect on a patient and distorted data does not show that effect then dataset is loses trustworthiness.

It is really important to prove that DP in such datasets adds value and provides valid results.

Privacy Budgeting

There are various scenarios in which it is necessary to provide individual information for analysis. In this case it based on the priority of privacy system may have to restrict release of some amount information. This brings us to the concept of privacy budget.

In other domains privacy budget is depicted in terms of epsilon but analysts of healthcare domain may not be comfortable in working with core privacy concepts. So it is necessary to related epsilon to some common notation of privacy to allow easier communication.

Based on certain input query we get a value for a particular patient depicting his/her eligibility for participation in the analysis. Providing unrestricted access to database may reveal extra information. If the individual participates in the analysis then we may add noise to it.

When a query is expected to have large counts than high budget must be provided to ensure that the query can be executed.

Conclusion: Healthcare community still needs to disclose a lot of information hence there is high scope for research data privacy in the healthcare domain.

References:

Fida K. Dankar and Khaled El Emam, Practicing Differential Privacy in Health Care: A Review, Transactions of Data Privacy, http://dl.acm.org/citation.cfm?id=2612156.2612159

Privacy in Real Time Data Release

Consider a scenario where an entity is sharing data at real time to a monitoring for raising an alarm in case something goes wrong. So it makes it necessary to share the data at real-time. However, if the data contains some personally identifiable information which needs to be protected then data owner may be reluctant to share the data even for monitoring.

The dilemma:

Data owning entity is ready to share the data to the monitoring service if it need not share its PII (personally identifiable information)

Technically speaking the goal of the monitoring system is to track patterns and identify exceptional conditions and raise alarm it does not need any personally identifiable information for its task.

Opportunity:

So we as privacy providers need to identify mechanism where data owning entity can share information without PII and monitoring system should be able to perform monitoring with same accuracy.

Solution:

FAST technique: Filtering and adaptive sampling of differentially privacy time series monitoring

FAST is a novel technique for sharing statistical data in real time. FAST uses differential privacy to project user specific data or personally identifiable information and also to ensure that over statistical results are accurate. It adds Laplace noise by sampling the time series into intervals of different size to ensure accuracy of the outcome. The size of sample is varied to by using adaptive sampling technique. Following is the block diagram of the system.

Data stream is fed into the system and it a sample of some default size and adds noise to the sample. Then this perturbed stream is released as output. This stream also goes to the filtering module which predicts the outcome of next stream and identifies the accuracy of the prediction by calculating errors.

The errors are calculated by using a PID controller (Proportional, Integral, derivative). PID controller calculated three errors proportional error, integral error and derivative error. Proportional error is used to keep controller in proportion to current error. Integral error is used to eliminate offset. Derivative error is used to prevent large errors.

Then correction is performed on the size of sample by correction module. Then adaptive sampler modifies the size of sample and takes next sample. This forms a feedback loop to the sampler which is unique contribution of the FAST technique.

Conclusion: There is tremendous opportunity to apply privacy techniques to data that is to be released in real time in various domains.

References:

Liyue Fan and Li Xiong, An Adaptive Approach to Real-Time Aggregate Monitoring With Differential Privacy, IEEE Transactions on Knowledge and Data Engineering, http://ieeexplore.ieee.org/xpl/login.jsp?tp=&arnumber=6542629

Differential Privacy Background Concepts

Consider a situation where several participants participate in a survey and provide details about themselves for analysis. However, the surveying organization is supposed to protect them by ensuring that their privacy is protected. There can be various ways to achieve that but the only mathematically proven method to do so is differential privacy.

Differential privacy is a mechanism that ensures that the participation of an individual does not make a significant impact on the outcome of the analysis. This means it protects the participation of the individual. So, analysts cannot ascertain whether an individual participated in the survey or not. This is rigor is ensured by the definition of differential privacy.

Definition

“A function f is said to be ε-DP if for all databases D1, D2 which differ by only one tuple and subsets y of Y we have

for ε>0”

  

Hence we can say that the ratio of probabilities will be less than ε.

The value of ε (the privacy parameter) is ideally close to 0 which implies that the ratio of probabilities is very near to 1. This logically means that both probabilities are equal but with some level of confidence.

There are various techniques to achieve differential privacy and they are broadly classified into the following four:

• Perturbation based techniques
• Granularity reduction methods
• Synthetic data generation
• Combination of above
  

 

Perturbation-based privacy protects by adding random noise to the data like Laplace noise and Gaussian noise.

Granularity-based privacy protects PII by decreasing the granularity of the data. Techniques like releasing only histogram, dimensionality reduction, sliding window moving average and micro-aggregation fall into this category.
Synthetic data techniques generate synthetic data by using a distribution function derived from data.

The above techniques have different advantages and drawbacks, so they are suitable for a different types of analysis tasks. So, to achieve multiple advantages many times different techniques are combined leading to a small/large framework for providing privacy.

Concluding Remarks: Due to the rigorous definition of differential privacy, it can be used in various scenarios to guarantee privacy mathematically with some statistical level of confidence.

References

1. Cynthia Dwork, Differential Privacy, Springer Berlin Heidelberg, http://dx.doi.org/10.1007/11787006_1
2. David Leoni, Non-interactive Differential Privacy: A Survey, Proceedings of the First International Workshop on Open Data, http://doi.acm.org/10.1145/2422604.2422611
3. A F Karr et al, A Framework for Evaluating the Utility of Data Altered to Protect Confidentiality, The American Statistician, http://dx.doi.org/10.1198/000313006X124640

Data Privacy Blog: Vision and Mission

DataPrivacyBlog is a blog on Data Privacy with the following vision:

“To study and review research work done in the field of:

• data privacy
• differential privacy
• privacy-preserving data analysis
• endpoint privacy     ”

Target audience:

• Researchers in the field of data privacy
• Data privacy providers
• Anyone interested in understanding happenings in the field of data privacy

The plan is to share my review comments on various research papers and sharing on the blog open for discussion.

URL: dataprivacyblog.blogspot.in

Author Information:

Dr. Snehkumar Shahani, recipient of Prime Minister's Ph.D. Fellowship pursued his Ph.D. research in Privacy Preserving Data Aggregation in an Untrusted Distributed Environment at the Department of Technology, Savitribai Phule Pune University. Ph.D. work is based on Differential Privacy with a focus on recommending the right amount of privacy in a trade-off between utility and privacy. Currently working as Data Science Engineering Lead at Persistent Systems, in the ML Practice in the BFSI domain for a leading international insurance company based in the US.
LinkedIn: in.linkedin.com/in/snehshahani