Re-Identification Risk in HIPAA De-Identified Datasets: The MVA Attack

Abstract

We present a re-identification attack that uses indirect (non-HIPAA) identifiers to target a vulnerable subset of records de-identified to the HIPAA Safe Harbor standard, those involving motor vehicle accidents (MVAs). Documentation of an MVA in a patient note creates a significant risk to patient privacy through the MVA re-identification attack, with a relative risk of 537 compared to the general population. Patients in a significant MVA resulting in either permanent injury, hospitalization or death (for any victim) should have the accident location information omitted due to the significant risk of re-identification of HIPAA de-identified data. Clinicians should also consider omitting location information for any MVA, as it significantly increases the risk of re-identification.

Introduction

Making EMR data available for research, such as part of an IRB submission or grant proposal, requires that the data first be stripped of protected health information (PHI) in accordance with the Health Insurance Portability and Accountability (HIPAA) law. HIPAA defines 18 identifiers, such as “Names,” and “Dates,” (excluding year) whose removal is required for de-identification to the “Safe Harbor” standard¹. HIPAA assumes that removal of these 18 identifiers provides sufficient protection against de-identification, regardless of the residual data. Is this a safe assumption? Per Benitez and Malin, “Anytime there is a level of individuality, or distinctiveness, there is the potential for re-identification”². Naranyan and Shmatikov phrased it similarly: “linkability” of data, not the sensitivity of data, is the key to re-identification risk³.

It is certainly possible to re-identify some records from de-identified datasets. A 2010 study re-identified 2 of 15,000 individuals (0.013%) from a Safe Harbor dataset⁴ and was the only re-identification attack on de-identified data in a 2011 review of re-identification attacks⁵. Based on the nationally accepted standard of re-identification risk no greater than 4 out of 10,000 individuals (0.04%, a number based on the level of uniqueness of characteristics in the population)⁶, this level of risk is acceptable. Risk analysis estimates indicate that 0.01% to 0.25% of a state’s population are vulnerable to a re-identification attack on Safe Harbor de-identified data². Safe Harbor de-identification, while not perfect, is sufficient for privacy at an overall population level.

However, when a more specific patient population is targeted, leveraging non-HIPAA residual data, the risk of re-identification grows to unacceptable levels. A 2016 study found a 42.8% risk of matching anesthesia records to the Texas Inpatient Public Use Data File for 2013 using data such as Age, Sex, Hospital, and Year⁷. El Emam and Malin described non-HIPAA identifiable elements like those used to match the anesthesia records as “quasi-identifiers” or “indirect identifiers” (in contrast to the 18 “direct” HIPAA identifiers)⁸. Indirect identifiers can be used together with other direct or indirect identifiers along with outside resources to re-identify a record. The challenge in remediating the risk of these indirect identifiers lies in ensuring privacy while preserving the value of the data for research as much as possible, as the records are being released for research purposes. This involves understanding which patient populations are vulnerable to re-identification attack and which identifiers are key to such attacks. As an example, we present the Motor Vehicle Accident (MVA) re-identification attack.

Background and Significance

One of the most well-known re-identification attacks is Sweeney’s voter registration attack described in 2002, one year before the compliance date of HIPAA⁹. Sweeney, a computer scientist, observed that in the 1990 census, 87.1% of the US population was uniquely identified by ZIP code, birth date, and sex, 53% by city, birth date, and sex, and 18% by county, birth date, and sex. She wondered whether this could be used to re-identify individuals from a freely available corpus of medical records of Massachusetts state employees and their families. The corpus was released by the Group Insurance Commission in the 1990’s and ostensibly de-identified, as the then-governor of Massachusetts, William Weld, had publicly stated that all identifiable information had been removed. Sweeney also purchased a copy of the Cambridge, MA voter registration list for 20 dollars, which contained the name, address, ZIP code, birth date, and gender of each registered voter. She was then able to uniquely identify the medical record of Governor Weld. She did this by noting that only 6 voters in Cambridge had the same birth date as the governor, only 3 of those were male, and only one of those lived in the same ZIP code as him (presumably the governor himself!) To illustrate the vulnerability, Sweeney famously mailed the governor’s office his own medical records. Sweeney’s population-level attack, can no longer be performed successfully because of HIPAA (ZIP codes, barring the first 3 digits for those containing more than 20,000 individuals, are direct identifiers). However, the voter registration attack still serves as a historic example of a re-identification attack: a combination of identifiers from the de-identified patient record (the direct identifiers of ZIP code and date of birth and the indirect identifier of gender) are cross-referenced against the records in an identifiable dataset (the voter registration list) to yield a likely match.

To perform a re-identification attack against HIPAA de-identified data, additional knowledge about the patient population (e.g. that they are anesthesia patients in Texas) is needed to link individuals to an outside data source using indirect identifiers. One vulnerable subset of patients are those involved in “newsworthy” events, where identifying information such as names may be published in the paper. What constitutes a newsworthy event? Although there is no clear legal definition, any event in the public interest could be considered newsworthy, and the act of publishing an account of such an event, even if individuals are named, is not a violation of privacy law¹⁰. If a newsworthy event is mentioned in a patient note, the potential exists for re-identification by linking with a newspaper article of the event. MVAs are a specific example of this. Although individuals are frequently named in newspapers in regards to accidents, publishing an accident victim’s name is not an invasion of privacy as events that take place in public are considered newsworthy. Which accidents newspapers choose to report on, and which individuals are named, is at the editorial discretion of the newspapers, often governed by codes of ethics that describe policies for naming victims of crimes, for example¹¹. In a 2015 op-ed entitled “Why name victims of accidents?”, Ehrlick, a journalist at the Billings Gazette, described why he reported on an accident that resulted in the death of a 1-year-old child¹². In his words, “We shouldn’t pick and choose which accidents to cover, or when to name victims. Instead, we develop a procedure which our journalists try to apply in the most uniform, consistent manner. We name victims of fatal or serious accidents because that’s what a newspaper of record does.” Besides fatal and serious accidents, Ehrlick also mentioned naming individuals “who are cited or charged in crimes.” By these criteria, “fatal or serious accidents” and “crimes” are newsworthy and thus identifiable events.

MVAs are a common cause to seek medical attention in the US. In 2007, about 3.2 million people sustained nonfatal injuries that resulted from traffic accidents 13. Accordingly, details of motor vehicle accidents and the resulting injuries are ubiquitous in medical records, especially in New York State, due to the requirement under the “No-Fault” law that insurance companies cover MVA related medical expenses regardless of accident “fault.” Given a de-identified database of free-text outpatient notes from the Buffalo area, it should be possible to re-identify some of them by linking them to newspaper articles from the same area, such as those published in the Buffalo News. This is the basic premise of the MVA attack.

Materials and Methods

The MVA attack uses 7 indirect identifiers: Accident Year, Encounter Year, Age, Gender, Accident Location, Encounter Location, and Accident Details to re-identify records. The identifiers are defined as follows, with examples of how they appear in text:

1. Accident Year

   1. Any reference to the year an MVA occurred in
   2. In 2016 she was involved in an MVA while working as a police officer
2. Encounter Year

   1. Any reference to the year that the patient encounter described in the text was conducted
   2. MM/DD/2016. The patient is a 53 Y old AAM who presents today for chronic back pain
3. Age

   1. Any reference to the age of an MVA victim, at present or at the time of the accident, including but not limited to the patient and the patient’s relatives
   2. MM/DD/2016. The patient is a 53 Y old AAM who presents today for chronic back pain
4. Gender

   1. Any reference to the gender of an MVA victim, including but not limited to the patient and the patient’s relatives
   2. MM/DD/2016. The patient is a 53 Y old AAM who presents today for chronic back pain
5. Accident Location

   1. Any reference to a non-HIPAA-protected location related to an MVA, including the site of the accident or any healthcare facilities (e.g. hospitals) accident victims were taken to
   2. Patient states she was driving 55-56 MPH and T-boned a car who cut her off at an intersection
6. Encounter Location

   1. Any reference to a non-HIPAA protected location related to the patient encounter described in the text, including proxies for location such as the documenting provider’s name or another provider’s name (which can be cross-referenced against physician databases to yield a practice location)
   2. Private Physician: Internist
7. Accident Details

   1. Any descriptive details of an MVA, including accident mechanism and features of vehicles involved, may include other identifiers such as Accident Location
   2. Patient states she was driving 55-56 MPH and T-boned a car who cut her off at an intersection

We conducted a retrospective study on encounter notes from the Buffalo area that occurred between 2014 and 2016. An SQL database of 242,343 patients seen at outpatient encounters in the Buffalo area (ZIP codes beginning in 142-) between 2014 and 2016 that had been previously de-identified was selected as the data source. The following query was used to extract the data (whitespace in target text is necessary for matches at word boundaries):

SELECT research_id, encounter_id, text_out FROM dbo.StudyNotesData WHERE text_out like ‘% MVA %’ OR text_out like ‘%MVA %’ OR text_out like ‘%MVA %’ / “motor vehicle accident”

Results were exported as individual text files whose titles were determined by research_id (a unique integer) and whose contents were the combined text_out (free text HPI) fields for every encounter_id (a unique integer), formed by appending the text_out fields in order of encounter_id. Each text file was manually reviewed in order of title (research_id) by a single clinician reviewer (VJ) for 6 target indirect identifiers: Accident Year, Age, Gender, Accident Location, Encounter Year, and Accident Details. All records were assumed to have an implicit Encounter Location identifier equal to the 142- ZIP code (i.e. the Buffalo area). Encounter Location was used as a proxy for Accident Location if the file did not contain Accident Location, and Encounter Year was similarly used as a proxy for Accident Year (unless it was clear from the text that the accident and encounter years were different). Files that did not contain any of the 6 indirect identifiers (excluding Encounter Location) were discarded. All indirect identifiers for each remaining file were extracted and recorded in a spreadsheet.

For each row in the spreadsheet, the clinician reviewer made a determination on whether there was sufficient data to attempt a re-identification attack. The criteria for an attack were as follows:

1. For non-fatal accidents, text must contain at minimum the Accident Year (or Encounter Year, if the accident could reasonably be assumed to take place in that year) and Accident Details indirect identifiers. For fatal accidents that could reasonably be assumed to take place the same year as the encounter, text need only to contain the Accident Details. In this case, all fatal accidents from 2014 to 2016 will be searched. Rows failing to meet this criterion were labeled as “Lacks Identifiers,” and no further criteria were checked.

2. Text must describe a motor vehicle accident that occurred after the year 2000. Rows failing to meet this criterion were labeled as “Earlier than 2000,” and no further criteria were checked.

3. Note must describe a motor vehicle accident that occurred in New York State. Rows to meet failing this criterion were labeled as “Not NY,” and no further criteria were checked.

4. There must be a reasonable possibility that the accident was described in the newspaper to the level of naming victims (e.g. a serious or fatal accident). Rows failing to meet this criterion were labeled as “Not Newsworthy,” and no further criteria were checked.

5. There must be enough distinguishing information (e.g. demographics from Age and Gender identifiers, knowledge about victim’s location in vehicle or injury from Accident Details identifier) such that, assuming an article describes the victim’s accident and that the victim was named in it, the target victim could be distinguished from other victims. Rows failing this criteria were labeled as “Not Distinct.”

For those rows meeting the 5 criteria, the attack was attempted as follows:

1. For non-fatal accidents or fatal accidents where the Accident Year or Encounter Year is known, the Buffalo News online archives (accessed through the Factiva news database at https://www.dowjones.com/products/factiva/ using the University at Buffalo institutional login) were searched from January 1^st to December 31^st of the Accident Year (or Encounter Year). For fatal accidents of unknown year otherwise assumed to take place the same year as the encounter, the archives were searched from January 1^st 2014 to December 31^st, 2016. Articles of fewer than 300 words were searched first, as the Buffalo News, in general, describes accidents in short articles. The two search queries used were:

   1. (accident or crash or collision) NOT (plane or train or boat or ski or pilot or flight or craft or stock) AND wc<300
   2. (accident or crash or collision) NOT (plane or train or boat or ski or pilot or flight or craft or stock) AND (wc=300 OR wc>300)

2. Articles matching the first query were manually reviewed by the clinician reviewer from the Factiva results webpage in order of date for the presence of indirect identifiers that matched the target record. If all indirect identifiers in an article matched the record, this was considered a match. For target records that contained Age, Accident Year, and Encounter Year identifiers, for the purposes of better matching to newspaper articles the patient’s age was adjusted based on the difference (if any) between the accident year and encounter year.

3. If a match was made, the article was further examined for the presence of the patient’s full name or other direct identifier (or from any HIPAA-protected entity, such as a relative). If this was found, the re-identification attack was successful and no further articles were examined.

4. If no match was made, or if a match was made but re-identification was unsuccessful, the process was repeated for the next article in order of date until either a successful re-identification occurred or the articles returned by the query were exhausted.

5. At this point, the results of the second query were examined following the same process as steps 2-4.

6. If re-identification was still unsuccessful, the re-identification attack was considered to have tentatively failed. However, if the reviewer determined there was a possibility that the accident may have occurred outside of the Buffalo News reporting area, such as via the presence of an Accident Location identifier suggesting a different “reportable area,” for a different newspaper in New York, the attack may be re-attempted by following steps 1-5 with the second source.

7. Similarly, if a match was made that provided additional information about the MVA (such as exact date) but that did not name the victim or otherwise provide a direct identifier, the reviewer could choose to search a non-newspaper data source such as Google for accident keywords (such as “Buffalo NY accident MM/DD/YYYY”) and attempt to locate a result that may contain the target victim’s name (such as a social media post about the accident).

Results

The SQL query returned 1015 rows, of which 198 were duplicates, leaving 817 unique results. These consisted of 451 unique patients (by research_id) and 751 unique encounters (by encounter_id). After encounters were combined into a single text file for each patient, 178 patient files (representing 39.5% of patients from the original query) remained that contained at least 1 indirect identifier besides Encounter Location (all 178 implicitly contained Encounter Location, the 142- ZIP code for the Buffalo area), with file lengths ranging from 22-133 words. By identifier, 124 contained Accident Year, 85 contained Age, 153 contained Gender, 85 contained Accident Location, 33 contained Encounter Year, and 176 contained Accident Details. On average, each file had 3.69 indirect identifiers. 14 of the 178 files (7.9%) met the 5 aforementioned criteria for MVA attack. 4 of the 14 files (28.6% of attempted patients, 0.88% of MVA patients, and 0.0017% of database patients) were successfully re-identified using the attack methodology. Each successful case of re-identification is discussed below in detail.

Examining the subset of MVAs severe enough for hospital admission, 8/178 (4.5%) files mention the patient being admitted to the hospital as a result of the MVA, 4/8 met the criteria for attack (the other 4 lacked Accident Year and were labeled “Lacks Identifiers”), and 2/4 were successful attacks. Along with Fatal MVAs, MVAs requiring admission (with or without permanent injury) can be categorized into an aggregate “high risk” group (Table 1).

Table 1.

The risk of various groups to MVA attack

Type	Sample Population at Risk	Successful Attacks	Risk	Relative Risk
General outpatient	242,343	4	0.0017%	1
Documented MVA	451	4	0.89%	537
Documented MVA with 1+ Indirect Identifier	178	4	2.25%	1,361
Documented MVA with admission	8	2	25%	15,146
Documented MVA with admission, permanent injury	3	2	66.67%	40,391
Documented fatal MVA	2	1	50%	30,293
High-Risk Group (Aggregate of above 3 groups)	10	3	30%	18,176

Re-Identification Case 1

This was one of two files that met the criteria for attack that described a fatal accident, and the only one that did not contain an Accident Year or Encounter Year. The target of this attack was the deceased child of the patient, who sought medical attention after developing symptoms on learning of the child’s death. Although the Accident Year and Encounter Year were not known, all other indirect identifiers were present: Age, Gender, Accident Location, and Accident Details. The Accident Details were particularly instructive, noting the day of the week the accident occurred and the injuries to those involved. The first Buffalo News query for 2014-2016, word count < 300 returned 44 results, none of which were matches. The second query (word count ≥ 300) returned 2712 results, one of which was a match. The article did not reveal the victim’s name and was not a successful re-identification, however it did give an exact date. A subsequent Google search for “fatal accident [Accident Location] Buffalo [Accident Date]” contained a result from local news website http://www.wivb.com that also did not identify the victim in the body of the article. However, in the comments section of the article a user posted the victim’s name and thus the re-identification was successful. The key to this attack was the distinctiveness of fatal accidents in the Buffalo area, as well as the fact that a commenter on the second news article identified the victim when news sources did not. Fatal MVAs, in general, are a small subset of all MVAs. There were only 38 fatalities from MVAs in Buffalo from 2014-2016¹³. In comparison, there were 10,967 injuries from MVAs for the same time period¹⁴.

Re-Identification Case 2

This file was the only one of the 14 that met attack criteria to contain all 6 indirect identifiers and was also the only article of all 178 to mention that the patient was transported to the hospital via Mercy Flight, a helicopter medical transport service covering Western New York. However, no match was made in the Buffalo News archives after searching 3 articles from the accident year with word count < 300 and 1077 of word count ≥ 300. Despite this, the Accident Location suggested that perhaps the accident occurred outside the Buffalo News reporting area. The online archives of the Batavian (http://www.thebatavian.com), which covers the location in question, were searched with the query “Mercy Flight [Accident Location] 2014,” and, when that yielded 0 hits, “Mercy Flight [Accident Location],” which yielded 67 hits, one of which matched the record and was a match and successful re-identification. The key to this attack was the presence of the Accident Location identifier and the unique (among the 178 records with identifiers) mention of a Mercy Flight.

Re-Identification Case 3

This file contained 5 indirect identifiers, all but Accident Location. The Buffalo News query returned 179 articles of word count < 300 (one of which was a match and re-identification) and 1175 of word count ≥ 300 (which were not examined due to a match in an article from the first set). The 179 articles were examined in further detail. 84 of these were found either not to describe an MVA at all, not describe an MVA in the year of accident, or not describe an MVA that took place in New York State. Of the other 95 records, 45 did not involve an injury to a victim of the same gender as the patient. Of the 50 remaining records, 46 did not involve a victim of the same age (adjusted for the difference between encounter year and accident year) as the patient. The 4 remaining articles all matched the target note for 4 indirect identifiers (Accident Year, Encounter Year, Age, Gender), but only one matched the Accident Details identifier (namely, the fact that the patient suffered a severe injury from the accident) as well. The other 3 articles describe victims that were either uninjured or sustained minor injuries that did not warrant hospital admission. The key to this attack was using all 5 identifiers present to narrow down the search space to a unique match.

Re-Identification Case 4

This file contained only one identifier, Accident Location, other than the two required identifiers required to pass the attack criteria for a non-fatal accident, Accident Year and Accident Details. It was the only one of the 14 files that met the criteria that contained only those three identifiers. Nevertheless, it was successfully identified from one of the 1339 Buffalo News articles of word count ≥300 from the year in question, after the 238 articles of word count > 300 failed to yield a match. The key to this attack was using the very detailed description of the accident mechanism (which included an uncommon model of car) in the Accident Details identifier in order to find a unique match.

Discussion

The 4 successful re-identifications of patients from a database population of 242,343 represent a 0.0017% re-identification rate, well below the risk cutoff of 0.04%. When considering just the number of patients with documented MVAs (451), however, the rate jumps to 0.88%, an unacceptably high level of risk. Knowing that an accident victim was admitted to the hospital (not just the ED) as a result of the accident further raises the risk to 25%. Knowing that an accident victim was admitted to the hospital and sustained permanent injury as a result of the accident raises the risk to 66.7%. Knowing that a victim (e.g. patient’s relative, or other HIPAA-protected entity) sustained fatal injuries from the MVA raises the risk to 50%. Simply having a documented MVA (and its corresponding details and indirect identifiers) raises a patient’s risk of re-identification by 537 times just based on the MVA attack, a simple attack which can be carried out manually by a single attacker using only a computer and a newspaper subscription. Using a more sophisticated, automated attack methodology, it is not hard to imagine the risk being even higher. MVAs are indeed vulnerable, identifiable events that should be subject to additional scrutiny during de-identification to mitigate this risk.

Noting that all of the successful re-identifications made use of the Accident Location or (implicit) Encounter Location, Accident Year and Accident Details identifiers, these seem like obvious identifiers to redact. However, knowing when an accident took place relative to the patient encounter for a related injury is clinically relevant and thus useful for research. Similarly, some details about the accident are also clinically relevant (such as the nature of injuries sustained, whether the accident required hospitalization, etc.) Removing the Accident Location and Encounter Location identifiers, however, would mitigate risk without the loss of valuable data. The MVA attack relies on searching local newspapers for the accident area. Without knowing the right newspaper to search, the attack fails. Consider Re-Identification Case 2, which would have failed if not for an explicit mention of the accident location (as the accident took place outside of the Buffalo News reporting area) that guided the search to the Batavia, NY news. Location identifiers are not always obvious, however, making their removal a challenge. For example, hospital names or provider names (which can be searched on the internet to find a practice location) are proxies for location. Providers’ names are ubiquitous in medical records (and are not removed during HIPAA scrubbing) but are unlikely to have clinical significance.

If all 178 patients with encounter notes containing at least one indirect identifier could be identified, this would correspond to a 0.07% re-identification rate, above the 0.04% risk cutoff. It is possible that a more sophisticated re-identification attack could accomplish this. Improving the re-identification rate of the MVA attack would be instructive in developing ways to defend against it. For example, an attack using New York State MVA reports would capture more accidents than were newsworthy (Figure 5).

Figure 5.

Cross-referencing indirect identifiers (by color) between mock patient note and NYS accident report

Conclusion

Patients in a significant MVA resulting in either permanent injury, hospitalization or death (for any victim) should have the accident location information omitted due to the significant risk of re-identification of HIPAA de-identified data. Clinicians should also consider omitting location information for any MVA, as it significantly increases the risk of re-identification.

Documentation of an MVA in a patient note creates a significant risk to patient privacy through the MVA re-identification attack, with a relative risk of 537 compared to the general population. The risk is further increased to an RR of 1361 by the presence of one or more indirect identifiers such as Accident Location and Accident Year. The risk can be remediated by deleting Accident Location and Encounter Location identifiers and their proxies, such as hospitals and physician names, but the best solution is to avoid including these identifiers in the first place. HIPAA is not perfect, and it is time to shift trust from technology (de-identification software) to people (physicians and researchers as stewards of patient data) by encouraging active involvement in provider-patient confidentiality, such as by diligently reviewing notes for clinically irrelevant indirect identifiers.

Perhaps in the future a “New HIPAA” will emerge, as has been suggested by Ohm in 2009, where instead of releasing scrubbed datasets that are potentially vulnerable to attack, full, unscrubbed databases will instead be released but only to verifiably trusted third parties, subject to new controls on use of data and new penalties for abuse¹⁵. Alternatively only SNOMED CT, LOINC and RxNORM codes with a HIPAA de-identified dataset will be released which also would be protective against this sort of attack.

Figure 1.

Timeline for Re-Identification Case 1

Figure 2.

Timeline for Re-Identification Case 2

Figure 3.

Timeline for Re-Identification Case 3

Figure 4.

Timeline for Re-Identification Case 4