Organizations often release and receive medical data with all explicit identifiers, such as name, address, telephone number, and Social Security number, removed on the assumption that patient confidentiality is maintained because the resulting data look anonymous. However, in most of these cases, the remaining data can be used to reidenafy individuals by linking or matching the data to other data bases or by looking at unique characteristics found in the fields and records of the data base itself. When these less (...) apparent aspects are taken into account, each released record can map to many possible people, providing a level of anonymity that the recordholder determines. The greater the number of candidates per record, the more anonymous the data.I examine three general-purpose computer programs for maintaining patient confidentiality when disclosing electronic medical records: the Scrub System, which locates and suppresses or replaces personally identifying information in letters between doctors and in notes written by clinicians; the Datafly System, which generalizes values based on a profile of the data recipient at the time of disclosure; and the μ-Argus System, a somewhat similar system which is becoming a European standard for disclosing public use data. (shrink)

Organizations often release and receive medical data with all explicit identifiers, such as name, address, telephone number, and Social Security number, removed on the assumption that patient confidentiality is maintained because the resulting data look anonymous. However, in most of these cases, the remaining data can be used to reidenafy individuals by linking or matching the data to other data bases or by looking at unique characteristics found in the fields and records of the data base itself. When these less (...) apparent aspects are taken into account, each released record can map to many possible people, providing a level of anonymity that the recordholder determines. The greater the number of candidates per record, the more anonymous the data.I examine three general-purpose computer programs for maintaining patient confidentiality when disclosing electronic medical records: the Scrub System, which locates and suppresses or replaces personally identifying information in letters between doctors and in notes written by clinicians; the Datafly System, which generalizes values based on a profile of the data recipient at the time of disclosure; and the μ-Argus System, a somewhat similar system which is becoming a European standard for disclosing public use data. (shrink)

Among the vast amounts of personal information published on the World Wide Web (“Web”) and indexed by search engines are lists of names of people. Examples include employees at companies, students enrolled in universities, officers in the military, law enforcement personnel, members of social organizations, and lists of acquaintances. Knowing who works where, attends what, or affiliates with whom provides strategic knowledge to competitors, marketers, and government surveillance efforts. However, finding online rosters of people does not lend itself to keyword (...) lookup on search engines because the keywords tend to be common expressions such as “employees” or “students.” A typical search often retrieves hundreds of Web pages requiring many hours of human inspection to locate a page containing a list of names. As a result, people may falsely believe online rosters provide more privacy than they do. This paper presents RosterFinder, a set of simple algorithms for locating Web pages that consist predominately of a list of names. The specific names are not known beforehand. RosterFinder works by identifying rosters from candidate Web pages based on the ratio of distinct known names to distinct words appearing in the page. Accurate classification by RosterFinder depends on the set of names used. Results are reported on real Web pages using: (1) dictionary lookup employing a limited set of known names; and, (2) dictionary lookup on utilizing an extensive set of known names. Privacy implications are discussed using the example of FERPA and online student rosters. (shrink)