Research using electronic health records: not all de-identified datasets are created equal

We read the article ‘Research using electronic health records: balancing confidentiality and public good’ by Wallis et al. with great interest. The authors note general practices need to trust de-identification processes when releasing patient records.¹ Patients have also expressed concerns about de-identification practices.² ‘De-identification’ encompasses a wide range of practices, and there are no universally accepted standards.^2,3

We propose here a three-step scheme for judging de-identified health records: (1) the de-identification standards used; (2) the performance of the de-identification system; and (3) additional security measures taken to prevent re-identification. Such a scheme may be useful to ethics committees, researchers planning a project and health providers deciding whether to participate.

The United States’ Health Insurance Portability and Accountability Act 1996 (HIPAA) provides arguably the most user-friendly definition of ‘de-identified’. Under HIPAA’s Safe Harbor provision, 18 specific categories of protected health information (PHI) about patients and family members need to be removed from the records.⁴ The New Zealand Health Information Privacy Code requirement that the information is ‘in a form in which the individual is not identified’ is less specific, but arguably provides researchers greater flexibility.^3,5 However, the European Union’s General Data Protection Regulation (GDPR) is arguably even more stringent than the HIPAA, and has extra-territorial reach. It requires that individuals are ‘not identifiable’ rather than simply ‘not identified’ (eg through cross-matching with other datasets or publically available information).^6,8

De-identification is a two-step process where PHIs are identified and replaced by appropriate surrogates. Recently, there have been significant advances in automating de-identification of health records using machine learning. Several systems have achieved the ‘gold standard’ of 95% accuracy in identifying HIPAA Safe Harbor PHIs.⁹ However, there are still challenges and concerns in automating the surrogate generation and replacement process. There are also concerns about the usability of records de-identified to this extent, and whether analysis of de-identified records will produce the same results as records that have not been de-identified.

These include encryption, random noise generation and compartmentalisation of the datasets. Such measures protect de-identified data from being re-identified through cross-matching with other datasets.^7,8 A multi-layered protection model based on well-accepted patient safety practices may be useful.¹⁰

In conclusion, ‘de-identification’ may more accurately be described as ‘difficulty in identifying’ and lies on a spectrum from ‘very easy’ to ‘near impossible’. Being specific about where one’s dataset lies allows researchers and health providers to make informed choices.

The authors declare no competing interest.