{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,9]],"date-time":"2026-06-09T04:42:39Z","timestamp":1780980159107,"version":"3.54.1"},"reference-count":58,"publisher":"Oxford University Press (OUP)","issue":"5","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2015,9,1]]},"abstract":"<jats:title>Abstract<\/jats:title>\n               <jats:p>Objective The Health Insurance Portability and Accountability Act Privacy Rule enables healthcare organizations to share de-identified data via two routes. They can either 1) show re-identification risk is small (e.g., via a formal model, such as k-anonymity) with respect to an anticipated recipient or 2) apply a rule-based policy (i.e., Safe Harbor) that enumerates attributes to be altered (e.g., dates to years). The latter is often invoked because it is interpretable, but it fails to tailor protections to the capabilities of the recipient. The paper shows rule-based policies can be mapped to a utility (U) and re-identification risk (R) space, which can be searched for a collection, or frontier, of policies that systematically trade off between these goals.<\/jats:p>\n               <jats:p>Methods We extend an algorithm to efficiently compose an R-U frontier using a lattice of policy options. Risk is proportional to the number of patients to which a record corresponds, while utility is proportional to similarity of the original and de-identified distribution. We allow our method to search 20\u2009000 rule-based policies (out of 2700) and compare the resulting frontier with k-anonymous solutions and Safe Harbor using the demographics of 10 U.S. states.<\/jats:p>\n               <jats:p>Results The results demonstrate the rule-based frontier 1) consists, on average, of 5000 policies, 2% of which enable better utility with less risk than Safe Harbor and 2) the policies cover a broader spectrum of utility and risk than k-anonymity frontiers.<\/jats:p>\n               <jats:p>Conclusions R-U frontiers of de-identification policies can be discovered efficiently, allowing healthcare organizations to tailor protections to anticipated needs and trustworthiness of recipients.<\/jats:p>","DOI":"10.1093\/jamia\/ocv004","type":"journal-article","created":{"date-parts":[[2015,4,25]],"date-time":"2015-04-25T03:01:42Z","timestamp":1429930902000},"page":"1029-1041","source":"Crossref","is-referenced-by-count":18,"title":["R-U policy frontiers for health data de-identification"],"prefix":"10.1093","volume":"22","author":[{"given":"Weiyi","family":"Xia","sequence":"first","affiliation":[{"name":"Department of Electrical Engineering & Computer Science, Vanderbilt University, Nashville, TN, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Raymond","family":"Heatherly","sequence":"additional","affiliation":[{"name":"Department of Biomedical Informatics, Vanderbilt University, Nashville, TN, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xiaofeng","family":"Ding","sequence":"additional","affiliation":[{"name":"Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jiuyong","family":"Li","sequence":"additional","affiliation":[{"name":"School of Information Technology and Mathematical Sciences, University of South Australia, Mawson Lakes, South Australia, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Bradley A","family":"Malin","sequence":"additional","affiliation":[{"name":"Department of Electrical Engineering & Computer Science, Vanderbilt University, Nashville, TN, USA"},{"name":"Department of Biomedical Informatics, Vanderbilt University, Nashville, TN, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"286","published-online":{"date-parts":[[2015,4,23]]},"reference":[{"key":"2020110612593805400_ocv004-B1","article-title":"The age of big data","volume-title":"New York Times","author":"Lohr"},{"key":"2020110612593805400_ocv004-B2","doi-asserted-by":"crossref","first-page":"2151","DOI":"10.1056\/NEJMp1401111","article-title":"Learning fro big health care data","volume":"370","author":"Schneeweiss","year":"2014","journal-title":"N Engl J Med."},{"key":"2020110612593805400_ocv004-B3","doi-asserted-by":"crossref","first-page":"1351","DOI":"10.1001\/jama.2013.393","article-title":"THe inevitable application of big data to health care","volume":"309","author":"Murdoch","year":"2013","journal-title":"JAMA."},{"key":"2020110612593805400_ocv004-B4","doi-asserted-by":"crossref","article-title":"Big data analytics for healthcare","author":"Sun","DOI":"10.1145\/2487575.2506178"},{"key":"2020110612593805400_ocv004-B5","doi-asserted-by":"crossref","first-page":"160","DOI":"10.1016\/j.jbi.2013.12.012","article-title":"PARAMO: a PARAllel predictive MOdeling platform for healthcare analytic research using electronic health records","volume":"48","author":"Ng","year":"2014","journal-title":"J Biomed Inform."},{"key":"2020110612593805400_ocv004-B6","doi-asserted-by":"crossref","first-page":"410","DOI":"10.1016\/j.jbi.2013.01.005","article-title":"The Analytic Information Warehouse (AIW): a platform for analytics using electronic health record data","volume":"46","author":"Post","year":"2013","journal-title":"J Biomed Inform."},{"key":"2020110612593805400_ocv004-B7","doi-asserted-by":"crossref","first-page":"1102","DOI":"10.1038\/nbt.2749","article-title":"Systematic comparison of phenome-wide association study of electronic medical record data and genome-wide association study data","volume":"31","author":"Denny","year":"2013","journal-title":"Nat Biotechnol."},{"key":"2020110612593805400_ocv004-B8","doi-asserted-by":"crossref","first-page":"e147","DOI":"10.1136\/amiajnl-2012-000896","article-title":"Validation of electronic medical record-based phenotyping algorithms: results and lessons learned from the eMERGE network","volume":"20","author":"Newton","year":"2013","journal-title":"J Am Med Inform Assoc."},{"key":"2020110612593805400_ocv004-B9","doi-asserted-by":"crossref","first-page":"e206","DOI":"10.1136\/amiajnl-2013-002428","article-title":"Electronic health records-driven phenotypoing challenges: recent advances, and perspectives","volume":"20","author":"Pathak","year":"2013","journal-title":"J Am Med Inform Assoc."},{"key":"2020110612593805400_ocv004-B10","doi-asserted-by":"crossref","first-page":"S660","DOI":"10.1007\/s11606-013-2455-8","article-title":"Bringing big data to personalized healthcare: a patient-centered framework","volume":"28","author":"Chawla","year":"2013","journal-title":"J Gen Intern Med."},{"key":"2020110612593805400_ocv004-B11","doi-asserted-by":"crossref","first-page":"235","DOI":"10.1038\/clpt.2012.66","article-title":"Optimizing drug outcomes through pharmacogenetics: a case for preemptive genotyping","volume":"92","author":"Schildcrout","year":"2012","journal-title":"Clin Pharmacol Ther."},{"key":"2020110612593805400_ocv004-B12","doi-asserted-by":"crossref","first-page":"763","DOI":"10.1016\/j.jbi.2012.01.009","article-title":"Building a robust, scalable, and standards-driven infrastructure for secondary use of EHR data: the SHARPn project","volume":"45","author":"Rea","year":"2012","journal-title":"J Biomed Inform."},{"key":"2020110612593805400_ocv004-B13","doi-asserted-by":"crossref","first-page":"596","DOI":"10.1136\/amiajnl-2014-002746","article-title":"Developing a data infrastructure for a learning health system: the PORTAL network","volume":"21","author":"McGlynn","year":"2014","journal-title":"J Am Med Inform Assoc."},{"key":"2020110612593805400_ocv004-B14","first-page":"1777","article-title":"Science and government","volume":"303","author":"Arzberger","year":"2004","journal-title":"An international framework to promote access to data. Science."},{"key":"2020110612593805400_ocv004-B15","doi-asserted-by":"crossref","first-page":"102","DOI":"10.1186\/1745-6215-14-102","article-title":"Data sharing among data monitoring committees and responsibilities to patients and science","volume":"14","author":"Chalmers","year":"2013","journal-title":"Trials."},{"key":"2020110612593805400_ocv004-B16"},{"key":"2020110612593805400_ocv004-B17","doi-asserted-by":"crossref","first-page":"263","DOI":"10.1016\/j.clsr.2012.03.005","article-title":"Citizens\u2019 perceptions of data protection and privacy in Europe","volume":"28","author":"Hallinan","year":"2012","journal-title":"Computer L Sec Rev"},{"key":"2020110612593805400_ocv004-B18","doi-asserted-by":"crossref","first-page":"279","DOI":"10.1016\/j.ijmedinf.2012.01.005","article-title":"Perspectives of Australian adults about protecting the privacy of their health information in statistical databases","volume":"81","author":"King","year":"2012","journal-title":"Int J Med Inform Assoc."},{"key":"2020110612593805400_ocv004-B19","doi-asserted-by":"crossref","article-title":"A study of preferences for sharing and privacy","author":"Olson","DOI":"10.1145\/1056808.1057073"},{"key":"2020110612593805400_ocv004-B20","doi-asserted-by":"crossref","first-page":"94","DOI":"10.1016\/j.ijmedinf.2010.11.005","article-title":"Views on health information sharing and privacy from primary care practices using electronic medical records","volume":"80","author":"Perera","year":"2011","journal-title":"Int J Med Inform."},{"key":"2020110612593805400_ocv004-B21","doi-asserted-by":"crossref","first-page":"477","DOI":"10.2307\/40041279","article-title":"A taxonomy of privacy","volume":"154","author":"Solove","year":"2006","journal-title":"Univ Penn L Rev."},{"key":"2020110612593805400_ocv004-B22","doi-asserted-by":"crossref","first-page":"612","DOI":"10.1038\/msb.2012.47","article-title":"The changing privacy landscape in the era of big data","volume":"8","author":"Schadt","year":"2012","journal-title":"Mol Syst Biol."},{"key":"2020110612593805400_ocv004-B23","first-page":"63","article-title":"Privacy in the age of big data: a time for big decisions","volume":"64","author":"Tene","year":"2012","journal-title":"Stan L Rev Online."},{"key":"2020110612593805400_ocv004-B24","doi-asserted-by":"crossref","first-page":"29","DOI":"10.1136\/amiajnl-2012-000936","article-title":"Building public trust in uses of health insurance portability and accountability Act de-identified data","volume":"20","author":"McGraw","year":"2013","journal-title":"J Am Med Inform Assoc."},{"key":"2020110612593805400_ocv004-B25"},{"key":"2020110612593805400_ocv004-B26"},{"key":"2020110612593805400_ocv004-B27","doi-asserted-by":"crossref","first-page":"169","DOI":"10.1136\/jamia.2009.000026","article-title":"Evaluating re-identification risks with respect to the HIPAA privacy rule","volume":"17","author":"Benitez","year":"2010","journal-title":"J Am Med Inform Assoc."},{"key":"2020110612593805400_ocv004-B28","doi-asserted-by":"crossref","first-page":"98","DOI":"10.1111\/j.1748-720X.1997.tb01885.x","article-title":"Weaving technology and policy together to maintain confidentiality","volume":"25","author":"Sweeney","year":"1997","journal-title":"J Law Med Ethics."},{"key":"2020110612593805400_ocv004-B29","doi-asserted-by":"crossref","first-page":"3","DOI":"10.1136\/jamia.2010.004622","article-title":"Never too old for anonymity: a statistical standard for demographic data sharing via the HIPAA Privacy Rule","volume":"18","author":"Malin","year":"2011","journal-title":"J Am Med Inform Assoc."},{"key":"2020110612593805400_ocv004-B30","doi-asserted-by":"crossref","first-page":"557","DOI":"10.1142\/S0218488502001648","article-title":"K-anonymity: a model for protecting privacy","volume":"10","author":"Sweeney","year":"2002","journal-title":"Int J Uncertain, Fuzz"},{"key":"2020110612593805400_ocv004-B31","doi-asserted-by":"crossref","article-title":"Efficient discovery of de-identification policy options through a risk-utility frontier","author":"Xia","DOI":"10.1145\/2435349.2435357"},{"key":"2020110612593805400_ocv004-B32","article-title":"UCI Machine Learning Repository","author":"Bache"},{"key":"2020110612593805400_ocv004-B33","doi-asserted-by":"crossref","first-page":"761","DOI":"10.1038\/gim.2013.72","article-title":"The Electronic Medical Records and Genomics (eMERGE) Network: past, present, and future","volume":"15","author":"Gottesman","year":"2013","journal-title":"Genet Med."},{"key":"2020110612593805400_ocv004-B34","first-page":"329","article-title":"Finding a needle in a haystack or identifying anonymous census records","volume":"2","author":"Dalenius","year":"1986","journal-title":"J Off Stat."},{"key":"2020110612593805400_ocv004-B35","doi-asserted-by":"crossref","first-page":"14:1","DOI":"10.1145\/1749603.1749605","article-title":"Privacy-preserving data publishing: a survey of recent developments","volume":"42","author":"Fung","year":"2010","journal-title":"ACM Comput Surv."},{"key":"2020110612593805400_ocv004-B36"},{"key":"2020110612593805400_ocv004-B37","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/1217299.1217302","article-title":"l-diversity: privacy beyond k-anonymity","volume":"1","author":"Machanavajjhala","year":"2007","journal-title":"ACM Trans Knowl Discov Data."},{"key":"2020110612593805400_ocv004-B38","doi-asserted-by":"crossref","article-title":"t-closeness: privacy beyond k-anonymity and l-diversity","author":"Li","DOI":"10.1109\/ICDE.2007.367856"},{"key":"2020110612593805400_ocv004-B39","doi-asserted-by":"crossref","first-page":"627","DOI":"10.1197\/jamia.M2716","article-title":"Protecting privacy using k-anonymity","volume":"15","author":"El Emam","year":"2008","journal-title":"J Am Med Inform Assoc."},{"key":"2020110612593805400_ocv004-B40","doi-asserted-by":"crossref","first-page":"670","DOI":"10.1197\/jamia.M3144","article-title":"A globally optimal k-anonymity method for the de-identification of health data","volume":"16","author":"El Emam","year":"2009","journal-title":"J Am Med Informatics Assoc."},{"key":"2020110612593805400_ocv004-B41","doi-asserted-by":"crossref","first-page":"18:1","DOI":"10.1145\/1857947.1857950","article-title":"Centralized and distributed anonymization for high-dimensional healthcare data","volume":"4","author":"Mohammed","year":"2010","journal-title":"ACM Trans Knowl Discov Data."},{"key":"2020110612593805400_ocv004-B42","volume-title":"k-anonymity","author":"Ciriani"},{"key":"2020110612593805400_ocv004-B43","doi-asserted-by":"crossref","first-page":"571","DOI":"10.1142\/S021848850200165X","article-title":"Achieving k-anonymity privacy protection using generalization and suppression","volume":"10","author":"Sweeney","year":"2002","journal-title":"Int J Uncertain, Fuzz."},{"key":"2020110612593805400_ocv004-B44","doi-asserted-by":"crossref","article-title":"Transforming data to satisfy privacy constraints","author":"Iyengar","DOI":"10.1145\/775047.775089"},{"key":"2020110612593805400_ocv004-B45","doi-asserted-by":"crossref","article-title":"On the complexity of optimal k-anonymity","author":"Meyerson","DOI":"10.1145\/1055558.1055591"},{"key":"2020110612593805400_ocv004-B46","article-title":"Protecting privacy when disclosing information: k-anonymity and its enforcement through generalization and suppression","author":"Samarati"},{"key":"2020110612593805400_ocv004-B47","doi-asserted-by":"crossref","article-title":"Data privacy through optimal k-anonymization","author":"Bayardo","DOI":"10.1109\/ICDE.2005.42"},{"key":"2020110612593805400_ocv004-B48","volume-title":"Disclosure risk vs. data utility: The R-U confidentiality map","author":"Duncan"},{"key":"2020110612593805400_ocv004-B49","doi-asserted-by":"crossref","article-title":"On the tradeoff between privacy and utility in data publishing","author":"Li","DOI":"10.1145\/1557019.1557079"},{"key":"2020110612593805400_ocv004-B50","doi-asserted-by":"crossref","article-title":"On the optimal selection of k in the k-anonymity problem","author":"Dewri","DOI":"10.1109\/ICDE.2008.4497557"},{"key":"2020110612593805400_ocv004-B51","article-title":"On balancing disclosure risk and data utility in transaction data sharing using R-U confidentiality map","author":"Loukides"},{"key":"2020110612593805400_ocv004-B52","doi-asserted-by":"crossref","article-title":"Beyond Safe Harbor: automatic discovery of health information de-identification policy alternatives","author":"Benitez","DOI":"10.1145\/1882992.1883017"},{"key":"2020110612593805400_ocv004-B53","article-title":"American fact finder website","author":"U.S. Census Bureau"},{"key":"2020110612593805400_ocv004-B54"},{"key":"2020110612593805400_ocv004-B55","doi-asserted-by":"crossref","article-title":"Incognito: efficient full-domain K-anonymity","author":"LeFevre","DOI":"10.1145\/1066157.1066164"},{"key":"2020110612593805400_ocv004-B56"},{"key":"2020110612593805400_ocv004-B57","article-title":"Disclosure risk measures for microdata. Barth-Jones","author":"Truta"},{"key":"2020110612593805400_ocv004-B58","doi-asserted-by":"crossref","article-title":"A MapReduce based approach of scalable multidimensional anonymization for big data privacy preservation on cloud","author":"Zhang","DOI":"10.1109\/CGC.2013.24"}],"container-title":["Journal of the American Medical Informatics Association"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/academic.oup.com\/jamia\/article-pdf\/22\/5\/1029\/34146561\/ocv004.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"http:\/\/academic.oup.com\/jamia\/article-pdf\/22\/5\/1029\/34146561\/ocv004.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2020,11,6]],"date-time":"2020-11-06T18:38:38Z","timestamp":1604687918000},"score":1,"resource":{"primary":{"URL":"https:\/\/academic.oup.com\/jamia\/article\/22\/5\/1029\/929347"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2015,4,23]]},"references-count":58,"journal-issue":{"issue":"5","published-online":{"date-parts":[[2015,4,23]]},"published-print":{"date-parts":[[2015,9,1]]}},"URL":"https:\/\/doi.org\/10.1093\/jamia\/ocv004","relation":{},"ISSN":["1527-974X","1067-5027"],"issn-type":[{"value":"1527-974X","type":"electronic"},{"value":"1067-5027","type":"print"}],"subject":[],"published-other":{"date-parts":[[2015,9]]},"published":{"date-parts":[[2015,4,23]]}}}