Data anonymization for pervasive health care: Systematic literature mapping study

Abstract

Background: Data science offers an unparalleled opportunity to identify new insights into many aspects of human life withrecent advances in health care. Using data science in digital health raises significant challenges regarding data privacy, transparency,and trustworthiness. Recent regulations enforce the need for a clear legal basis for collecting, processing, and sharing data, forexample, the European Union's General Data Protection Regulation (2016) and the United Kingdom's Data Protection Act (2018).For health care providers, legal use of the electronic health record (EHR) is permitted only in clinical care cases. Any other useof the data requires thoughtful considerations of the legal context and direct patient consent. Identifiable personal and sensitiveinformation must be sufficiently anonymized. Raw data are commonly anonymized to be used for research purposes, with riskassessment for reidentification and utility. Although health care organizations have internal policies defined for informationgovernance, there is a significant lack of practical tools and intuitive guidance about the use of data for research and modeling.Off-The-shelf data anonymization tools are developed frequently, but privacy-related functionalities are often incomparable withregard to use in different problem domains. In addition, tools to support measuring the risk of the anonymized data with regardto reidentification against the usefulness of the data exist, but there are question marks over their efficacy.Objective: In this systematic literature mapping study, we aim to alleviate the aforementioned issues by reviewing the landscapeof data anonymization for digital health care.Methods: We used Google Scholar, Web of Science, Elsevier Scopus, and PubMed to retrieve academic studies published inEnglish up to June 2020. Noteworthy gray literature was also used to initialize the search. We focused on review questionscovering 5 bottom-up aspects: basic anonymization operations, privacy models, reidentification risk and usability metrics,off-The-shelf anonymization tools, and the lawful basis for EHR data anonymization.Results: We identified 239 eligible studies, of which 60 were chosen for general background information; 16 were selected for7 basic anonymization operations; 104 covered 72 conventional and machine learning-based privacy models; four and 19 papersincluded seven and 15 metrics, respectively, for measuring the reidentification risk and degree of usability; and 36 explored 20data anonymization software tools. In addition, we also evaluated the practical feasibility of performing anonymization on EHRdata with reference to their usability in medical decision-making. Furthermore, we summarized the lawful basis for deliveringguidance on practical EHR data anonymization.Conclusions: This systematic literature mapping study indicates that anonymization of EHR data is theoretically achievable;yet, it requires more research efforts in practical implementations to balance privacy preservation and usability to ensure morereliable health care applications.