Best Practices in Evolving Privacy Frameworks for Patient Age Data: Census Data Study.
HIPAA
Health Insurance Portability and Accountability Act
census
date of birth
deidentification
k-anonymity
patient privacy
policy
reidentification risk
Journal
JMIR formative research
ISSN: 2561-326X
Titre abrégé: JMIR Form Res
Pays: Canada
ID NLM: 101726394
Informations de publication
Date de publication:
25 Mar 2024
25 Mar 2024
Historique:
received:
13
03
2023
accepted:
27
11
2023
revised:
17
10
2023
medline:
25
3
2024
pubmed:
25
3
2024
entrez:
25
3
2024
Statut:
epublish
Résumé
Over the previous 4 decennial censuses, the population of the United States has grown older, with the proportion of individuals aged at least 90 years old in the 2010 census being more than 2 and a half times what it was in the 1980 census. This suggests that the threshold for constraining age introduced in the Safe Harbor method of the HIPAA (Health Insurance Portability and Accountability Act) in 1996 may be increased without exceeding the original levels of risk. This is desirable to maintain or even increase the utility of affected data sets without compromising privacy. In light of the upcoming release of 2020 census data, this study presents a straightforward recipe for updating age-constrained thresholds in the context of new census data and derives recommendations for new thresholds from the 2010 census. Using census data dating back to 1980, we used group size considerations to analyze the risk associated with various maximum age thresholds over time. We inferred the level of risk of the age cutoff of 90 years at the time of HIPAA's inception in 1996 and used this as a baseline from which to recommend updated cutoffs. The maximum age threshold may be increased by at least 2 years without exceeding the levels of risk conferred in HIPAA's original recommendations. Moreover, in the presence of additional information that restricts the population in question to a known subgroup with increased longevity (for example, restricting to female patients), the threshold may be increased further. Increasing the maximum age threshold would enable the data user to gain more utility from the data without introducing risk beyond what was originally envisioned with the enactment of HIPAA. Going forward, a recurring update of such thresholds is advised, in line with the considerations detailed in the paper.
Sections du résumé
BACKGROUND
BACKGROUND
Over the previous 4 decennial censuses, the population of the United States has grown older, with the proportion of individuals aged at least 90 years old in the 2010 census being more than 2 and a half times what it was in the 1980 census. This suggests that the threshold for constraining age introduced in the Safe Harbor method of the HIPAA (Health Insurance Portability and Accountability Act) in 1996 may be increased without exceeding the original levels of risk. This is desirable to maintain or even increase the utility of affected data sets without compromising privacy.
OBJECTIVE
OBJECTIVE
In light of the upcoming release of 2020 census data, this study presents a straightforward recipe for updating age-constrained thresholds in the context of new census data and derives recommendations for new thresholds from the 2010 census.
METHODS
METHODS
Using census data dating back to 1980, we used group size considerations to analyze the risk associated with various maximum age thresholds over time. We inferred the level of risk of the age cutoff of 90 years at the time of HIPAA's inception in 1996 and used this as a baseline from which to recommend updated cutoffs.
RESULTS
RESULTS
The maximum age threshold may be increased by at least 2 years without exceeding the levels of risk conferred in HIPAA's original recommendations. Moreover, in the presence of additional information that restricts the population in question to a known subgroup with increased longevity (for example, restricting to female patients), the threshold may be increased further.
CONCLUSIONS
CONCLUSIONS
Increasing the maximum age threshold would enable the data user to gain more utility from the data without introducing risk beyond what was originally envisioned with the enactment of HIPAA. Going forward, a recurring update of such thresholds is advised, in line with the considerations detailed in the paper.
Identifiants
pubmed: 38526530
pii: v8i1e47248
doi: 10.2196/47248
doi:
Types de publication
Journal Article
Langues
eng
Pagination
e47248Informations de copyright
©Colin Moffatt, Jonah Leshin. Originally published in JMIR Formative Research (https://formative.jmir.org), 25.03.2024.