Anonymizing Health Data

Chapter 4. Longitudinal Discharge Abstract Data: State Inpatient Databases

After patients are discharged from a hospital—in some cases months after—their medical information is organized and cleaned up to accurately reflect their stay in the hospital. The resulting document is known as a discharge abstract. A State Inpatient Database (SID) is a collection of all Discharge Abstract Data (DAD) for a state, and it’s a powerful tool for research and analysis to inform public policy.^[48]

The SID databases for many states are made available for research and other purposes. But there have been concerns raised about how well they’ve been de-identified when shared,^[49] and some have been successfully attacked.^[50] We’ll provide some analysis to inform de-identification practices for this kind of data, and we’ll look at methods that can be used to create a public use SID.

Note

In addition to quasi-identifiers, a data set can contain sensitive information such as drugs dispensed or diagnoses. This information could be used to infer things like mental health status or disabilities. We don’t consider that kind of sensitive information in the analysis here, for ease of presentation, but just assume that it exists in the data sets we refer to. Re-identifying patients therefore implies potentially learning about sensitive information that patients might not want others to know about.

While we’ll present de-identification algorithms here in the context of longitudinal data, any multilevel data set can ...