{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2023,1,12]],"date-time":"2023-01-12T11:19:33Z","timestamp":1673522373877},"reference-count":23,"publisher":"Oxford University Press (OUP)","issue":"3","content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2017,5,1]]},"abstract":"<jats:p>Objective: Online data centers (ODCs) are becoming increasingly popular for making health-related data available for research. Such centers provide good privacy protection during analysis by trusted researchers, but privacy concerns may still remain if the system outputs are not sufficiently anonymized. In this article, we propose a method for anonymizing analysis outputs from ODCs for publication in academic literature.<\/jats:p>\n               <jats:p>Methods: We use as a model system the Secure Unified Research Environment, an online computing system that allows researchers to access and analyze linked health-related data for approved studies in Australia. This model system suggests realistic assumptions for an ODC that, together with literature and practice reviews, inform our solution design.<\/jats:p>\n               <jats:p>Results: We propose a two-step approach to anonymizing analysis outputs from an ODC. A data preparation stage requires data custodians to apply some basic treatments to the dataset before making it available. A subsequent output anonymization stage requires researchers to use a checklist at the point of downloading analysis output. The checklist assists researchers with highlighting potential privacy concerns, then applying appropriate anonymization treatments.<\/jats:p>\n               <jats:p>Conclusion: The checklist can be used more broadly in health care research, not just in ODCs. Ease of online publication as well as encouragement from journals to submit supplementary material are likely to increase both the volume and detail of analysis results publicly available, which in turn will increase the need for approaches such as the one suggested in this paper.<\/jats:p>","DOI":"10.1093\/jamia\/ocw152","type":"journal-article","created":{"date-parts":[[2016,10,11]],"date-time":"2016-10-11T14:19:40Z","timestamp":1476195580000},"page":"544-549","source":"Crossref","is-referenced-by-count":5,"title":["Anonymization for outputs of population health and health services research conducted via an online data center"],"prefix":"10.1093","volume":"24","author":[{"given":"Christine M","family":"O\u2019Keefe","sequence":"first","affiliation":[{"name":"CSIRO, Canberra"}]},{"given":"Mark","family":"Westcott","sequence":"additional","affiliation":[{"name":"CSIRO, Canberra"}]},{"given":"Maree","family":"O\u2019Sullivan","sequence":"additional","affiliation":[{"name":"Sydney"}]},{"given":"Adrien","family":"Ickowicz","sequence":"additional","affiliation":[{"name":"Hobart, Australia"}]},{"given":"Tim","family":"Churches","sequence":"additional","affiliation":[{"name":"Sax Institute, Sydney, Australia"}]}],"member":"286","published-online":{"date-parts":[[2016,12,19]]},"reference":[{"key":"2020110612435682700_ocw152-B1","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1197\/jamia.M2273","article-title":"Toward a National Framework for the Secondary Use of Health Data: An American Medical Informatics Association White Paper","volume":"14","author":"Safran","year":"2007","journal-title":"J Am Med Inform Assoc"},{"key":"2020110612435682700_ocw152-B2","doi-asserted-by":"crossref","first-page":"359","DOI":"10.7326\/0003-4819-151-5-200909010-00141","article-title":"Toward reuse of clinical data for research and quality improvement: the end of the beginning?","volume":"151","author":"Weiner","year":"2009","journal-title":"Ann Intern Med"},{"key":"2020110612435682700_ocw152-B3","doi-asserted-by":"crossref","DOI":"10.2139\/ssrn.2289850","volume-title":"Matching Known Patients to Health Records in Washington State Data","author":"Sweeney","year":"2013"},{"key":"2020110612435682700_ocw152-B4","doi-asserted-by":"crossref","first-page":"3081","DOI":"10.1002\/sim.6543","article-title":"Individual privacy versus public good: protecting confidentiality in health research","volume":"34","author":"O'Keefe","year":"2015","journal-title":"Stats Med"},{"key":"2020110612435682700_ocw152-B5","article-title":"Protecting confidentiality in statistical analysis outputs from a virtual data centre","volume-title":"Joint UNECE\/Eurostat Work Session on Statistical Data Confidentiality","author":"O'Keefe","year":"2013"},{"key":"2020110612435682700_ocw152-B6","doi-asserted-by":"crossref","first-page":"163","DOI":"10.1214\/088342305000000043","article-title":"Data dissemination and disclosure limitation in a world without microdata: a risk-utility framework for remote access analysis servers","volume":"1","author":"Gomatam","year":"2005","journal-title":"Stat Sci"},{"issue":"3","key":"2020110612435682700_ocw152-B7","doi-asserted-by":"crossref","first-page":"208","DOI":"10.1016\/j.cmpb.2008.04.001","article-title":"Remote access methods for exploratory data analysis and statistical modelling: Privacy-Preserving Analytics\u00ae","volume":"91","author":"Sparks","year":"2008","journal-title":"Comput Methods Programs Biomed"},{"key":"2020110612435682700_ocw152-B8","article-title":"A framework for performing statistical analyses of unit record health data without violating either privacy or confidentiality of individuals","author":"Sparks","year":"2005","journal-title":"Proc 55th Session of the International Statistical Institute"},{"key":"2020110612435682700_ocw152-B9","first-page":"3115","article-title":"The current stage of the microdata analysis system at the US Census Bureau","author":"Lucero","year":"2011"},{"key":"2020110612435682700_ocw152-B10","article-title":"Methodology for the Automatic Anonymization of Statistical Outputs from Remote Servers at the Australian Bureau of Statistics","author":"Thompson","year":"2013","journal-title":"UNECE Work Session on Statistical Data"},{"key":"2020110612435682700_ocw152-B11","doi-asserted-by":"crossref","first-page":"102","DOI":"10.1136\/amiajnl-2012-001047","article-title":"Toward practicing privacy","volume":"20","author":"Dwork","year":"2013","journal-title":"J Am Med Inform Assoc"},{"key":"2020110612435682700_ocw152-B12","first-page":"158","article-title":"The application of differential privacy to health data","author":"Dankar","year":"2012","journal-title":"Proc 5th International Workshop on Privacy and Anonymity in the Information Society"},{"key":"2020110612435682700_ocw152-B13","author":"Elliot"},{"key":"2020110612435682700_ocw152-B14","volume-title":"Guidance Regarding Methods for De-Identification of Protected Health Information in Accordance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule","author":"US Department of Health and Human Services","year":"2016"},{"key":"2020110612435682700_ocw152-B15","doi-asserted-by":"crossref","DOI":"10.1002\/9781118348239","volume-title":"Statistical Disclosure Control","author":"Hundepool","year":"2012"},{"key":"2020110612435682700_ocw152-B16","volume-title":"Data Lab Output Guide","author":"Statistics New Zealand","year":"2011"},{"key":"2020110612435682700_ocw152-B17","volume-title":"Secure Unified Research Environment (SURE) Guide, Version 1.3","author":"Sax Institute","year":"2012"},{"key":"2020110612435682700_ocw152-B18","volume-title":"Secure Data Service Website","author":"UK Data Archive"},{"key":"2020110612435682700_ocw152-B19","doi-asserted-by":"crossref","first-page":"157","DOI":"10.1186\/1472-6963-9-157","article-title":"The SAIL Databank: building a national architecture for e-health research and evaluation","volume":"9","author":"Ford","year":"2009","journal-title":"BioMed Central Health Services Res"},{"key":"2020110612435682700_ocw152-B20","volume-title":"NORC Website","author":"University of Chicago"},{"key":"2020110612435682700_ocw152-B21","volume-title":"Health Insurance Portability and Accountability Act (HIPAA)","author":"US Government","year":"1996"},{"key":"2020110612435682700_ocw152-B22","doi-asserted-by":"crossref","DOI":"10.1201\/b14764","volume-title":"Guide to the De-identification of Personal Health Information","author":"El Emam","year":"2013"},{"key":"2020110612435682700_ocw152-B23","doi-asserted-by":"crossref","first-page":"138","DOI":"10.1007\/978-3-642-15838-4_13","article-title":"Data environment analysis and the key variable mapping system","volume-title":"Privacy in Statistical Databases","author":"Elliot","year":"2010"}],"container-title":["Journal of the American Medical Informatics Association"],"original-title":[],"language":"en","link":[{"URL":"http:\/\/academic.oup.com\/jamia\/article-pdf\/24\/3\/544\/34149151\/ocw152.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"http:\/\/academic.oup.com\/jamia\/article-pdf\/24\/3\/544\/34149151\/ocw152.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2020,11,6]],"date-time":"2020-11-06T18:16:35Z","timestamp":1604686595000},"score":1,"resource":{"primary":{"URL":"https:\/\/academic.oup.com\/jamia\/article\/24\/3\/544\/2723130"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2016,12,19]]},"references-count":23,"journal-issue":{"issue":"3","published-online":{"date-parts":[[2016,12,19]]},"published-print":{"date-parts":[[2017,5,1]]}},"URL":"https:\/\/doi.org\/10.1093\/jamia\/ocw152","relation":{},"ISSN":["1067-5027","1527-974X"],"issn-type":[{"value":"1067-5027","type":"print"},{"value":"1527-974X","type":"electronic"}],"subject":[],"published-other":{"date-parts":[[2017,5]]},"published":{"date-parts":[[2016,12,19]]}}}