2.1. Linking Records for Research and Improving Public Health

Data in registries regarding the health of individuals come in many forms. Most of these data were originally gathered for the delivery of clinical services or payment for those services, and under promises or legal guarantees of confidentiality, privacy, and security. The sources of data may include individual doctors' records, billing information, vital statistics on births and deaths, health surveys, and data associated with biospecimens, among other sources.

The broad goal of registries is to amass data from potentially diverse sources to allow researchers to explore and evaluate alternative health outcomes in a systematic fashion. This goal is usually accomplished by gathering data from multiple sources and linking the data across sources, either with explicit identifiers designed for linking, or in a probabilistic fashion via the characteristics of the individuals to whom the data correspond. From the research perspective, the more data included the better, both in terms of the number of cases and the details and the extent of the health information. The richer the database, the more likely it is that data analysts will be able to discover relationships that might affect or improve health care. On the other hand, many discussions about privacy protection focus on limiting the level of detail available in data to which others have access.

There is an ethical obligation to protect patient interests when collecting, sharing, and studying person-specific biomedical information.¹ Many people fear that information derived from their medical or biological records will be used against them in employment decisions, result in limitations to their access to health or life insurance, or cause social stigma.^{2, 3} These fears are not unfounded, and there have been various cases in which it was found that an individual's genetic characteristics or clinical manifestations were used in a manner inconsistent with an individual's expectations of privacy and fair use.⁴ If individuals are afraid that their health-related information may be associated with them or used against them, they may be less likely to seek treatment in a clinical context or participate in research studies.⁵

A tension exists between the broad goals of registries and regulations protecting individually identifiable information. Approaches and formal methodologies that help mediate this tension are the principal technical focus of this chapter. To understand the extent to which these tools can assist data linkages involving registry data, one needs to understand the risks of identification in different types of data.

There is a large body of Federal law relating to privacy. A recent comprehensive review of privacy law and its effects on biomedical research identified no fewer than 15 separate Federal laws pertaining to health information privacy.⁶ There are also special Federal laws governing health information related to substance abuse.⁷ A full review of all laws related to privacy, confidentiality, and security of health information would also consider separate State privacy protections as well as State laws pertaining to the confidentiality of data. Nevertheless, the legal aspects of this chapter focus only on the Federal regulations commonly referred to as the HIPAA Privacy Rule.

2.2. What Do Privacy, Confidentiality, and Disclosure Mean?

Privacy is a term whose definition varies with context.⁸ In the HIPAA Privacy Rule, the term refers to protected health information (PHI)— individually identifiable health information transmitted or maintained by a covered entity or business associate—that is to be used or disclosed only as expressly permitted or required by the Rule, and that is safeguarded against inappropriate uses and disclosures. The Privacy Rule addresses to whom the custodian of PHI, a covered entity or its business associate, may transmit the information and under what conditions. The Rule also establishes three levels of identifiability of health information: (1) fully identifiable data; (2) data that lack certain direct identifiers, otherwise known as a limited data set; and (3) de-identified data. Registries commonly acquire identifiable data and may create the last two categories of data in accordance with the Privacy Rule. Along this spectrum of data identifiability, the HIPAA Privacy Rule applies different legal standards and protections,⁵ extending the most stringent protections to data containing direct identifiers and none for de-identified information, which is not considered PHI. Not all registries contain PHI; Chapter 7 provides more information on how PHI is defined under HIPAA.

Confidentiality broadly refers to a quality or condition of protection accorded to statistical information as an obligation not to permit the transfer of that information to an unauthorized party.5 Confidentiality can be afforded to both individuals and health care organizations. A different notion of confidentiality, arising from the special relationship between a clinician and patient, refers to the ethical, legal, and professional obligation of those who receive information in the context of a clinical relationship to respect the privacy interests of their patients. Most often the term is used in the former sense and not in the latter, but these two meanings inevitably overlap in a discussion of health information as data. The methods for disclosure limitation described here have been developed largely in the context of confidentiality protection, as defined by laws, regulations, and especially by the practices of statistical agencies.

Disclosure for purposes of this discussion has two different meanings: one is technical and the other is regulatory and contained in the HIPAA Privacy Rule.

In the field of statistics, disclosure relates to the attribution of information to the source of the data, regardless of whether the data source is an individual or an organization. Three types of disclosure of data possess the capacity to make the identity of particular individuals known: identity disclosure, attribute disclosure, and inferential disclosure.

Identity disclosure occurs when the data source becomes known from the data release itself.^{9, 10}

Attribute disclosure occurs when the released data make it possible to infer the characteristics of an individual data source more accurately than would have otherwise been possible.^{8, 9} The usual way to achieve attribute disclosure is through identity disclosure. First, one identifies an individual through some combination of variables and then learns about the values of additional variables included in the released data. Attribute disclosure may occur, however, without identity disclosure, such as when all people from a population subgroup share a characteristic and this quantity becomes known for any individual in the subgroup.

Inferential disclosure relates to the probability of identifying a particular attribute of a data source. Because almost any data release can be expected to increase the likelihood of an attribute being associated with a data source, the only way to guarantee protection is to release no data at all. It is for this reason that researchers use certain methods not to prevent disclosure, but to limit or control the nature of the disclosure. These methods are known as disclosure limitation methods or statistical disclosure control.¹¹

Disclosure under the HIPAA Privacy Rule means the release, transfer, provision of, access to, or divulging in any other manner, of information outside of the entity holding the information.¹²

2.3. Linking Records and Probabilistic Matching

Computer-assisted record linkage goes back to the 1950s, and was put on a firm statistical foundation by Fellegi and Sunter.¹³ Most common techniques for record linkage either rely on the existence of unique identifiers or use a structure similar to the one Fellegi and Sunter described with the incorporation of formal statistical modeling and methods, as well as new and efficient computational tools.^{14, 15} The simplest way to match records from separate databases is to use a so-called “deterministic” method of linking databases in which unique identifiers exist for each record. In the United States, when these identifiers exist they might be names or Social Security numbers; however, these particular identifiers may not in fact be unique.¹⁶ As a result, some form of probabilistic approach is typically used to match the records. Thus, there is little actual difference between methods using deterministic versus probabilistic linkage, except for the explicit representation of uncertainty in the matching process in the latter.

The now-standard approach to record linkage is built on five key components for identifying matching pairs of records across two databases:¹³

1. Represent every pair of records using a vector of features (variables) that describe similarity between individual record fields. Features can be Boolean, discrete, or continuous.
2. Place feature vectors for record pairs into three classes: matches (M), non-matches (U), and possible matches (P). These correspond to “equivalent,” “nonequivalent,” and “possibly equivalent” (e.g., requiring human review) record pairs, respectively.
3. Perform record-pair classification by calculating the ratio (P (γ | M)) / (P (γ | U)) for each candidate record pair, where γ is a feature vector for the pair and P (γ | M) and P (γ | U) are the probabilities of observing that feature vector for a matched and non-matched pair, respectively. Two thresholds based on desired error levels—Tμ and Tλ—optimally separate the ratio values for equivalent, possibly equivalent, and nonequivalent record pairs.
4. When no training data in the form of duplicate and nonduplicate record pairs are available, matching can be unsupervised; that is, conditional probabilities for feature values are estimated using observed frequencies in the records to be linked.
5. Most record pairs are clearly nonmatches, so one need not consider them for matching. This situation is managed by “blocking,” or partitioning the databases based on geography or some other variable in both databases, so that only records in comparable blocks are compared. Such a strategy significantly improves efficiency

The first four components lay the groundwork for accurate record-pair matching using statistical or machine-learning prediction models such as logistic regression. The fewer identifiers used in steps 1 and 2, the poorer the match is likely to be. Accuracy is well known to be high when there is a 1–1 match between records in the two databases, and deteriorates as the overlap between the files decreases and the measurement error in the feature values consequently increases.

The fifth component provides for efficient processing of large databases, but to the extent that blocking is approximate and possibly inaccurate, its use decreases the accuracy of record-pair matching. The less accurate the matching, the more error (i.e., records not matched or matched inappropriately) there will be in the merged registry files. This error will impede the quality of analyses and findings from the resulting data.^17-19

This standard approach has problems when (1) there are lists or files with little overlap, (2) there are undetected duplications within files, and (3) one needs to link three or more lists. In the latter case, one essentially matches all lists in pairs, and then resolves discrepancies. Unfortunately, there is no single agreed-upon way to do this, but some principled approaches have recently been suggested.²⁰ Record linkage methodology has been widely used by statistical agencies, especially the U.S. Census Bureau. The methodology has been combined with disclosure limitation techniques such as the addition of “noise” to variables in order to produce public use files that the agencies believe cannot be linked back to the original databases used for the record linkage. Another technique involves protecting individual databases by stripping out identifiers and then attempting record linkage. This procedure has two disadvantages: first, the quality of matches is likely to decrease markedly; and second, the resulting merged records will still need to be protected by some form of disclosure limitation. Therefore, as long as there are no legal restrictions against the use of identifiers for record linkage purposes, it is preferable to use detailed identifiers to the extent possible and to remove them following the matching procedure.

Currently there are no special features of registry data known to enhance or inhibit matching. Registry data may be easier targets for re-identification because the specifics of diseases or conditions usually help to define the registries. In the United States, efforts are often made to match records using Social Security numbers. There are large numbers of entry errors for these numbers in many databases, and there are problems associated with multiple people using one number and some people using multiple numbers.¹⁶ Lyons and colleagues describe a very large-scale matching exercise in the United Kingdom linking multiple health care and social services data sets using National Health Service numbers and various alternative sets of matching variables in the spirit of the record linkage methods described above. They report achieving accurate matching at rates of only about 95 percent.²¹

2.4. Procedural Issues in Linking Data Sets

It is important to understand that neither data nor link can be unambiguously defined. For instance, a data set may be altered by the application of tools for statistical disclosure limitation, in which case it is no longer the same data set. Linkage need not mean, as it is customarily construed, “bringing the two (or more) data sets together on a single computer.” Many analyses of interest can be performed using technologies that do not require literal integration of the data sets.

Even the relationship between data sets can vary. Two data sets can hold the same attributes for different individuals (horizontal partitioning); for example, one data set may contain information for individuals born before a certain date, while a second data set contains the same information for individuals born after that date. Or, two data sets may contain different attributes for the same individuals (vertical partitioning); for example, one data set may contain clinician-reported information for a set of individuals, while a second data set contains laboratory data for the same individuals. Finally, some data sets may contain a complex combination of different attributes for different individuals.

The process of linking horizontally partitioned data sets engenders little incremental risk of re-identification. There is, in almost all cases, no more information about a record on the combined data set than was present in the individual data set containing it. Moreover, any analysis requiring only data summaries (i.e., in technical terms, sufficient statistics) that are additive across the data sets can be performed using tools based on the computer science concept of secure summation.²² Examples of analyses for which this approach works include creation of contingency tables, linear regression, and some forms of maximum likelihood estimation.

Only in a few cases have comparable techniques for vertically partitioned data been well enough understood to be employed in practice.²³ Instead, it is usually necessary to actually link individual subjects' records that are contained in two or more data sets. This process is inherently and unavoidably risky because the combined data set contains more information about each subject than either of the components.

Suppose that each of the two data sets to be linked contains the same unique identifiers (for individuals, an example is Social Security numbers) in all of the records. In this case, techniques based on cryptography (e.g., homomorphic encryption²⁴ and hash functions) enable secure determination of individuals common to both data sets and assignment of unique but uninformative identifiers to the shared records. The combined data set can then be purged of individual identifiers and altered to further limit re-identification. These alterations will of necessity reduce the accuracy of standard statistical analyses compared with an unaltered data set.

Such linkage techniques are computationally very complex, and may need to involve trusted third parties without access to information in either data set other than the common identifier.²⁵ Therefore, in many cases the database custodian may prefer to remove identifiers and carry out statistical disclosure limitation prior to linkage. It is important to understand that this latter approach compromises, perhaps irrevocably, the linkage process, and may introduce substantial errors into the linked data set that later— perhaps dramatically—alter the results of statistical analyses.

Many techniques for record linkage depend at some level on the presence of combinations of attributes in both databases that are unique to individuals but do not lead to re-identification—a combination that may be difficult to find. For instance, the combination of date of birth, gender, and ZIP Code of residence might be present in both databases. It is estimated that this combination of attributes uniquely characterizes a significant portion of the U.S. population—somewhere between 65 and 87 percent, or even higher for certain subpopulations—so that re-identification would only require access to a suitable external database.^{26, 27} Other techniques such as the Fellegi-Sunter record linkage methods described above are more probabilistic in nature. They can be effective, but they also introduce data quality effects that cannot readily be characterized, and the intrinsic error associated with the matching will need to be accounted for in some fashion when the linked data set is analyzed. Simulations and sensitivity analyses may help clarify the extent of the issues here, but will rarely be sufficient.

No matter how linkage is performed, a number of other issues should be addressed. For instance, comparable attributes should be expressed in the same units of measure in both data sets (e.g., English or metric values for weight). Also, conflicting values of attributes for each individual common to both databases need reconciliation.

Another issue involves the management of patient records that appear in only one database; the most common decision is to drop them. Data quality provides another example; it is one of the least understood statistical problems and has multiple manifestations.²⁸ Even assuming some limited capability to characterize data quality, the relationship between the quality of the linked data set and the quality of each component should be considered. The linkage itself can produce quality degradation. For example, there is reason to believe that the quality of a linked data set is strictly less than that of either component, and not, as might be supposed, somewhere between the two.

Finally, it is important to understand that there exist endemic risks to data linkage. Anyone with access to one of the original data sets and the linked data set may learn, even if imperfectly, the values of attributes in the other. It may not be possible to determine what knowledge the linkage will create without actually executing the linkage. For these reasons, strong consideration should be given to forms of data protection such as licensing and restricted access in research data centers, where both analyses and results can be controlled.

3.1. Risks of Identification

The HIPAA Privacy Rule describes two methods for de-identifying health information.²⁹ One method requires a formal determination by a qualified expert (e.g., a qualified statistician) that the risk is very small that an individual could be identified. The other method requires the removal of 18 specified identifiers of the individual and of the individual's relatives, household members, and employers, as well as no actual knowledge that the remaining information could be used alone or in combination with other information to identify the individual. (See Chapter 7 for more information.) For more information about methods of de-identification under the HIPAA Privacy Rule, see the recent HHS guidance published on this topic.³⁰

The data removal process alone may not be sufficient to remove risks of re-identification.

Residual data especially vulnerable to disclosure threats include (1) geographic detail, (2) longitudinal information, and (3) extreme values (e.g., income). In addition, variables that are available in other accessible databases pose special risks.

Statistical organizations such as the National Center for Health Statistics have traditionally focused on the issue of identity disclosure and thus refused to report information in which individuals or institutions can be identified. Concerns about identity disclosure arise, for example, when a data source is unique in the population for the characteristics under study, and is directly identifiable in the database to be released. But such uniqueness and subsequent identity disclosure may not reveal any information other than the association of the source with the data collected in the study. In this sense, identity disclosure may only be a technical violation of a promise of confidentiality. Thus, uniqueness only raises the issue of possible confidentiality problems resulting from identification. A separate issue is whether the release of information is one that is permitted by the HIPAA Privacy Rule or is authorized by the data source.

The foregoing discussion implicitly introduces the notion of “harm,” which is not the same as a breach of confidentiality. For example, it is possible for a pledge of confidentiality to be technically violated, but produce no harm to the data source because the information is “generally known” to the public. In this case, some would argue that additional data protection is not required. Conversely, information on individuals or organizations in a release of sample statistical data may well increase the information about characteristics of individuals or organizations not in the sample. This information may produce an inferential disclosure for such individuals or organizations and cause them harm, even though there was no confidentiality obligation. Skinner³¹ suggests the separation of assessment of disclosure potential from harm.

Figure 16–1 depicts the overlapping relationships among confidentiality, disclosure, and harm.

Figure 16–1

Relationships among confidentiality, disclosure, and harm.

Some people believe that the way to ensure confidentiality and prevent identity disclosure is to arrange for individuals to participate in a study anonymously. In many circumstances, such a belief is misguided, because there is a key distinction between collecting information anonymously and ensuring that personal identifiers are not inappropriately made available. Moreover, clinical health care data are simply not collected anonymously. Not only do patient records come with multiple identifiers crucial to ensuring patient safety for clinical care, but they also contain other information that may allow the identification of patients even if direct identifiers are stripped from the records.

Moreover, health- or medicine-related data may also come from sample surveys in which the participants have been promised that their data will not be released in ways that would allow them to be individually identified. Disclosure of such data can produce substantial harm to the personal reputations or financial interests of the participants, their families, and others with whom they have personal relationships. For example, in the pilot surveys for the National Household Seroprevalence Survey, the National Center for Health Statistics moved to make responses during the data collection phase of the study anonymous because of the harm that could potentially result from information that an individual had an HIV infection or engaged in high-risk behavior. But such efforts still could not guarantee that one could not identify a participant in the survey database.

The question about the confidentiality of registry data persists after an individual's death, in part because of the potential for harm to others. The health information of decedents is subject to the HIPAA Privacy Rule until 50 years after their death (see Chapter 7 for more information), and several statistical agencies explicitly treat the identification of a deceased individual as a violation of their confidentiality obligations.

4.1. Methodology for Mitigating the Risk of Re-Identification

The disclosure limitation methods briefly described in this section are designed to protect against identification of individuals in statistical databases, and are among the techniques that data linkage projects involving registries are most likely to use. One problem these methods do not address is the simultaneous protection of individual and institutional data sources. The discussion here also relates to the problems addressed by secure computation methodologies, which are explored in the next section.