Search

The existing face image recognition algorithm can accurately identify underexposed facial images, but the abuse of face image recognition technology can associate face features with personally identifiable information, resulting in privacy disclosure of the users. The paper puts forward a method for private face image generation based on deidentification under low light. First of all, the light enhancement and attenuation networks are pretrained using the training set, and low-light face images in the test set are input into the light enhancement network for photo enhancement. Then the facial area is captured by the face interception network, and corresponding latent code will be created through the latent code generation network and feature disentanglement will be done. Tiny noise will be added to the latent code by the face generation network to create deidentified face images which will be input in a light attenuation network to generate private facial images in a low-lighting style. At last, experiments show that, compared with other state-of-the-art algorithms, this method is more successful in generating low-light private face images with the most similar structure to original photos. It protects users’ privacy effectively by reducing the accuracy of the face recognition network, while also ensuring the practicability of the images.

Face is one of the most attractive sensitive information in visual shared data. It is an urgent task to design an effective face deidentification method to achieve a balance between facial privacy protection and data utilities when sharing data. Most of the previous methods for face deidentification rely on attribute supervision to preserve a certain kind of identity-independent utility but lose the other identity-independent data utilities. In this article, we mainly propose a novel disentangled representation learning architecture for multiple attributes preserving face deidentification called replacing and restoring variational autoencoders (R²VAEs). The R²VAEs disentangle the identity-related factors and the identity-independent factors so that the identity-related information can be obfuscated, while they do not change the identity-independent attribute information. Moreover, to improve the details of the facial region and make the deidentified face blends into the image scene seamlessly, the image inpainting network is employed to fill in the original facial region by using the deidentified face as a priori. Experimental results demonstrate that the proposed method effectively deidentifies face while maximizing the preservation of the identity-independent information, which ensures the semantic integrity and visual quality of shared images.

Multi-dimensional data anonymization approaches (e.g., Mondrian) ensure more fine-grained data privacy by providing a different anonymization strategy applied for each attribute. Many variations of multi-dimensional anonymization have been implemented on different distributed processing platforms (e.g., MapReduce, Spark) to take advantage of their scalability and parallelism supports. According to our critical analysis on overheads, either existing iteration-based or recursion-based approaches do not provide effective mechanisms for creating the optimal number of and relative size of resilient distributed datasets (RDDs), thus heavily suffer from performance overheads. To solve this issue, we propose a novel hybrid approach for effectively implementing a multi-dimensional data anonymization strategy (e.g., Mondrian) that is scalable and provides high-performance. Our hybrid approach provides a mechanism to create far fewer RDDs and smaller size partitions attached to each RDD than existing approaches. This optimal RDD creation and operations approach is critical for many multi-dimensional data anonymization applications that create tremendous execution complexity. The new mechanism in our proposed hybrid approach can dramatically reduce the critical overheads involved in re-computation cost, shuffle operations, message exchange, and cache management.

Background Congenital Heart Defects (CHD) is the most commonly occurring congenital anomaly in Europe and a major paediatric health care concern. Investigations are needed to enable identification of CHD risk factors as studies have given conflicting results. This study aim was to identify maternal sociodemographic characteristics, behaviours, and birth outcomes as risk factors for CHD. This was a population based, data linkage cohort study using anonymised data from Northern Ireland (NI) covering the period 2010-2014. The study cohort composed of 94,067 live births with an outcome of 1162 cases of CHD using the International Statistical Classification of Diseases and Related Health Problems (ICD)-10 codes and based on the European Surveillance of Congenital Anomalies (EUROCAT) grouping system for CHD. CHD cases were obtained from the HeartSuite database (HSD) at the Royal Belfast Hospital for Sick Children (RBHSC), maternal data were extracted from the Northern Ireland Maternity System (NIMATS), and medication data were extracted from the Enhanced Prescribing Database (EPD). STATA version 14 was used for the statistical analysis in this study, Odds Ratio (OR), 95% Confident intervals (CI), P value, and logistic regression were used in the analysis. Ethical approval was granted from the National Health Service (NHS) Research Ethics Committee. Result In this study, a number of potential risk factors were assessed for statistically significant association with CHD, however only certain risk factors demonstrated a statistically significant association with CHD which included: gestational age at first booking (AOR = 1.21; 95% CI = 1.04-1.41; P Conclusion The results of this study suggested that there are certain maternal sociodemographic characteristics, behaviours and birth outcomes that are statistically significantly associated with higher risk of CHD. Appropriate prevention policy to target groups with higher risk for CHD may help to reduce CHD prevalence. These results are important for policy makers, obstetricians, cardiologists, paediatricians, midwives and the public.

Anonymization has the potential to foster the sharing of medical data. State-of-the-art methods use mathematical models to modify data to reduce privacy risks. However, the degree of protection must be balanced against the impact on statistical properties. We studied an extreme case of this trade-off: the statistical validity of an open medical dataset based on the German National Pandemic Cohort Network (NAPKON), which was prepared for publication using a strong anonymization procedure. Descriptive statistics and results of regression analyses were compared before and after anonymization of multiple variants of the original dataset. Despite significant differences in value distributions, the statistical bias was found to be small in all cases. In the regression analyses, the median absolute deviations of the estimated adjusted odds ratios for different sample sizes ranged from 0.01 [minimum = 0, maximum = 0.58] to 0.52 [minimum = 0.25, maximum = 0.91]. Disproportionate impact on the statistical properties of data is a common argument against the use of anonymization. Our analysis demonstrates that anonymization can actually preserve validity of statistical results in relatively low-dimensional data.

Objective Neural network deidentification studies have focused on individual datasets. These studies assume the availability of a sufficient amount of human-annotated data to train models that can generalize to corresponding test data. In real-world situations, however, researchers often have limited or no in-house training data. Existing systems and external data can help jump-start deidentification on in-house data; however, the most efficient way of utilizing existing systems and external data is unclear. This article investigates the transferability of a state-of-the-art neural clinical deidentification system, NeuroNER, across a variety of datasets, when it is modified architecturally for domain generalization and when it is trained strategically for domain transfer. Materials and Methods We conducted a comparative study of the transferability of NeuroNER using 4 clinical note corpora with multiple note types from 2 institutions. We modified NeuroNER architecturally to integrate 2 types of domain generalization approaches. We evaluated each architecture using 3 training strategies. We measured transferability from external sources; transferability across note types; the contribution of external source data when in-domain training data are available; and transferability across institutions. Results and Conclusions Transferability from a single external source gave inconsistent results. Using additional external sources consistently yielded an F1-score of approximately 80%. Fine-tuning emerged as a dominant transfer strategy, with or without domain generalization. We also found that external sources were useful even in cases where in-domain training data were available. Transferability across institutions differed by note type and annotation label but resulted in improved performance.

Background Advances in healthcare artificial intelligence (AI) are occurring rapidly and there is a growing discussion about managing its development. Many AI technologies end up owned and controlled by private entities. The nature of the implementation of AI could mean such corporations, clinics and public bodies will have a greater than typical role in obtaining, utilizing and protecting patient health information. This raises privacy issues relating to implementation and data security. Main body The first set of concerns includes access, use and control of patient data in private hands. Some recent public–private partnerships for implementing AI have resulted in poor protection of privacy. As such, there have been calls for greater systemic oversight of big data health research. Appropriate safeguards must be in place to maintain privacy and patient agency. Private custodians of data can be impacted by competing goals and should be structurally encouraged to ensure data protection and to deter alternative use thereof. Another set of concerns relates to the external risk of privacy breaches through AI-driven methods. The ability to deidentify or anonymize patient health data may be compromised or even nullified in light of new algorithms that have successfully reidentified such data. This could increase the risk to patient data under private custodianship. Conclusions We are currently in a familiar situation in which regulation and oversight risk falling behind the technologies they govern. Regulation should emphasize patient agency and consent, and should encourage increasingly sophisticated methods of data anonymization and protection.

Formerly considered part of general enterprise costs, industrial maintenance has become critical for business continuity and a real source of data. Despite the heavy investments made by companies in smart manufacturing, traditional maintenance practices still dominate the industrial landscape. Maintenance knowledge sharing between industries can significantly optimize maintenance activity and improve process efficiency. Different international standards and initiatives are promoting such an approach. However, this trend failed to gain ground in the manufacturing industry. In this article, we present the results of our investigation about the real roadblocks that obstruct the progress of the maintenance knowledge sharing approach. We determined that knowledge graphs and, more importantly, automated data anonymization techniques can facilitate the development of general-purpose solutions to share maintenance knowledge among concerned actors.

One of the main steps in the data lifecycle is to publish it for data analysts to discover hidden patterns. But, data publishing may lead to unwanted disclosure of personal information and cause privacy problems. Data anonymization techniques preserve privacy models to prevent the disclosure of individuals’ private information in published data. In this paper, a distributed in-memory method is proposed on the Apache Spark framework to preserve the l-diversity privacy model. This method anonymizes large-scale data in a three-phase process, which includes, seed selection, data clustering for $$\ell$$ -diversity, and finalizing phase. In this method, a hierarchical kmeans-based data clustering algorithm has been designed for data anonymization. One of the major challenges of anonymization methods is to establish a better trade-off between data utility and privacy. Therefore, for calculating the distance between records and forming more cohesive ldiverse-clusters, the authors have designed two Manhattan-based and Euclidean-based distance functions to satisfy the requirements of the l-diversity model. Given the 100-fold speed of the Spark compared to MapReduce, the proposed method is presented using in-memory RDD programming in Apache Spark, to address the runtime, scalability, and performance in large-scale data anonymization as it exists in the previous MapReduce-based algorithms. Our method provides general knowledge to use parallel in-memory computation of Spark in big data anonymization. In experiments, this method has obtained lower information loss and loses about 1% to 2% accuracy and FMeasure criteria; therefore, it establishes a better trade-off than the state-of-the-art MapReduce-based Mondrian methods

Data anonymization is commonly utilized for the protection of an individual's identity when his personal or sensitive data is published. A well-known anonymization model to define the privacy of transactional data is the km-anonymity model. This model ensures that an adversary who knows up to m items of an individual cannot determine which record in the dataset corresponds to the individual with a probability greater than 1/k. However, the existing techniques generally rely on the presence of similarity between items in the dataset tuples to achieve km-anonymization and are not suitable when transactional data contains tuples without many common values. The authors refer to this type of transactional data as diverse transactional data and propose an algorithm, anonymization of diverse transactional data (ADT). ADT is based on slicing and generalization to achieve km-anonymity for diverse transactional data. ADT has been experimentally evaluated on two datasets, and it has been found that ADT yields higher privacy protection and causes a lower loss in data utility as compared to existing methods.

Electrocardiogram (ECG) signals provide rich information on individuals' potential cardiovascular conditions and disease, ranging from coronary artery disease to the risk of a heart attack. While health providers store and share these information for medical and research purposes, such data is highly vulnerable to privacy concerns, similar to many other types of healthcare data. Recent works have shown the feasibility of identifying and authenticating individuals by using ECG as a biometric due to the highly individualized nature of ECG signals. However, to the best of our knowledge, there does not exist a method in the literature attempting to de-identify ECG signals. In this paper, to address this privacy protection gap, we propose a Generative Adversarial Network (GAN)-based framework for de-identification of ECG signals. We leverage a combination of a standard GAN loss, an Ordinary Differential Equations (ODE)-based, and identity-based loss values to train a generator that de-identifies a ECG signal while preserving structure the ECG signal and information regarding the target cardio vascular condition. We evaluate our framework in terms of both qualitative and quantitative metrics considering different weightings over the above-mentioned losses. Our experiments demonstrate the efficiency of our framework in terms of privacy protection and ECG signal structural preservation.

Introduction: In the absence of an overarching unique identifier [ref:1], Privacy-preserving record linkage (PPRL) is a probabilistic approach to find and link records in distributed data sets referring to the same real world person by considering privacy regulations. The use of Bloom filters [for full text, please go to the a.m. URL]

Introduction: The subject of this work is the creation of a synthetic German clinical corpus that does not contain any information useable to re-identify an individual. Clinical documents include sensitive patient information. The removal of 18 protected health information (PHI) (cf. [ref:1], [for full text, please go to the a.m. URL]

Background/Aims There are increasing pressures for anonymised datasets from clinical trials to be shared across the scientific community, and differing recommendations exist on how to perform anonymisation prior to sharing. We aimed to systematically identify, describe and synthesise existing recommendations for anonymising clinical trial datasets to prepare for data sharing. Methods We systematically searched MEDLINE®, EMBASE and Web of Science from inception to 8 February 2021. We also searched other resources to ensure the comprehensiveness of our search. Any publication reporting recommendations on anonymisation to enable data sharing from clinical trials was included. Two reviewers independently screened titles, abstracts and full text for eligibility. One reviewer extracted data from included papers using thematic synthesis, which then was sense-checked by a second reviewer. Results were summarised by narrative analysis. Results Fifty-nine articles (from 43 studies) were eligible for inclusion. Three distinct themes are emerging: anonymisation, de-identification and pseudonymisation. The most commonly used anonymisation techniques are: removal of direct patient identifiers; and careful evaluation and modification of indirect identifiers to minimise the risk of identification. Anonymised datasets joined with controlled access was the preferred method for data sharing. Conclusions There is no single standardised set of recommendations on how to anonymise clinical trial datasets for sharing. However, this systematic review shows a developing consensus on techniques used to achieve anonymisation. Researchers in clinical trials still consider that anonymisation techniques by themselves are insufficient to protect patient privacy, and they need to be paired with controlled access.

Patient privacy is a major concern when allowing data sharing and the flow of health information. Hence, de-identification and anonymization techniques are used to ensure the protection of patient health information while supporting the secondary uses of data to advance the healthcare system and improve patient outcomes. Several de-identification tools have been developed for free-text, however, this research focuses on developing notes de-identification and adjudication framework that has been tested for i2b2 searches. The aim is to facilitate clinical notes research without an additional HIPAA approval process or consent by a clinician or patient especially for narrative free-text notes such as physician and nursing notes. In this paper, we build a scalable, accurate, and maintainable pipeline for notes de-identification utilizing the natural language processing and REDCap database as a method of adjudication verification. The system is deployed at an enterprise-scale where researchers can search and visualize over 45 million de-identified notes hosted in an i2b2 instance.

KEY POINTS\ud In Canada, commercial data brokers collect deidentified patient data from pharmacies, private drug insurers, the federal government and medical clinics without patient consent.\ud \ud Although pharmaceutical companies are the data brokers’ primary customers, academics and nonprofit and public entities also use commercial data sets, given the absence of a coordinated public approach to collecting these data across Canada.\ud \ud Risks of commercialized patient data include loss of anonymity, surveillance and marketing, discrimination and violation of Indigenous data sovereignty.\ud \ud Coordinated infrastructure for the collection and coordination of health data across Canada and updated privacy legislation would protect individuals and communities and enable appropriate data uses.

Medical data is shared with a wide range for various research purposes and an extensive amount of research has been developed in the data privacy community for anonymization. Unfortunately, Data anonymization techniques do not provide data privacy guarantees and synthetic data generation is an alternative approach in data anonymization. Deep learning has recently achieved more reputation for its high accuracy and privacy concern. Nowadays, deep learning is extensively applied in the medical field for classification, segmentation and privacy-preserving. Using Deep learning, synthetic data can be generated to improve the privacy of the original medical data and also to prevent attacks. Deep learning models capture the relationship between multiple features in medical data. In this research, Healthcare Cramer Generative Adversarial Network (HCGAN) is proposed, where (i) the Quasi Identifiers (QI) are identified in medical data and separated as QI attributes and the remaining attributes are considered as Sensitive Attributes (SA) (ii) f–differential privacy anonymization technique is applied only to the identified QI and the final result is combined with the SA attribute (iii) The anonymized medical data is used as real data for training Cramer Generative Adversarial Network (GAN) where Cramer distance is used to improve the efficiency of the model. (iv) Finally, Privacy is checked by overcoming the attacks. The result shows that the HCGAN method effectively prevents attacks during the training and testing phase compared to Wasserstein GAN. The result demonstrates that health care GAN generates synthetic data that can provide high privacy and overcome various attacks.

Objectives: Federal open data initiatives that promote increased sharing of federally collected data are important for transparency, data quality, trust, and relationships with the public and state, tribal, local, and territorial (STLT) partners. These initiatives advance understanding of health conditions and diseases by providing data to more researchers, scientists, and policymakers for analysis, collaboration, and valuable use outside CDC responders. This is particularly true for emerging conditions such as COVID-19 where we have much to learn and have evolving data needs. Since the beginning of the outbreak, CDC has collected person-level, de-identified data from jurisdictions and currently has over 8 million records, increasing each day. This paper describes how CDC designed and produces two de-identified public datasets from these collected data. Materials and Methods: Data elements were included based on the usefulness, public request, and privacy implications; specific field values were suppressed to reduce risk of reidentification and exposure of confidential information. Datasets were created and verified for privacy and confidentiality using data management platform analytic tools as well as R scripts. Results: Unrestricted data are available to the public through Data.CDC.gov and restricted data, with additional fields, are available with a data use agreement through a private repository on GitHub.com. Practice Implications: Enriched understanding of the available public data, the methods used to create these data, and the algorithms used to protect privacy of de-identified individuals allow for improved data use. Automating data generation procedures allows greater and more timely sharing of data., Comment: 19 pages, 4 figures, 1 table, 5 supplements

Supplemental Digital Content is available in the text., OBJECTIVES: Critical care medicine is a natural environment for machine learning approaches to improve outcomes for critically ill patients as admissions to ICUs generate vast amounts of data. However, technical, legal, ethical, and privacy concerns have so far limited the critical care medicine community from making these data readily available. The Society of Critical Care Medicine and the European Society of Intensive Care Medicine have identified ICU patient data sharing as one of the priorities under their Joint Data Science Collaboration. To encourage ICUs worldwide to share their patient data responsibly, we now describe the development and release of Amsterdam University Medical Centers Database (AmsterdamUMCdb), the first freely available critical care database in full compliance with privacy laws from both the United States and Europe, as an example of the feasibility of sharing complex critical care data. SETTING: University hospital ICU. SUBJECTS: Data from ICU patients admitted between 2003 and 2016. INTERVENTIONS: We used a risk-based deidentification strategy to maintain data utility while preserving privacy. In addition, we implemented contractual and governance processes, and a communication strategy. Patient organizations, supporting hospitals, and experts on ethics and privacy audited these processes and the database. MEASUREMENTS AND MAIN RESULTS: AmsterdamUMCdb contains approximately 1 billion clinical data points from 23,106 admissions of 20,109 patients. The privacy audit concluded that reidentification is not reasonably likely, and AmsterdamUMCdb can therefore be considered as anonymous information, both in the context of the U.S. Health Insurance Portability and Accountability Act and the European General Data Protection Regulation. The ethics audit concluded that responsible data sharing imposes minimal burden, whereas the potential benefit is tremendous. CONCLUSIONS: Technical, legal, ethical, and privacy challenges related to responsible data sharing can be addressed using a multidisciplinary approach. A risk-based deidentification strategy, that complies with both U.S. and European privacy regulations, should be the preferred approach to releasing ICU patient data. This supports the shared Society of Critical Care Medicine and European Society of Intensive Care Medicine vision to improve critical care outcomes through scientific inquiry of vast and combined ICU datasets.

The education sector has been experiencing the progressive popularity of the Internet of Things (IoT) systems with a range of applications that can monitor simple attendance to physical locations. IoT systems in the education sector are smoothly integrated for managing marks’ digital copies, providing certificates related to medical purposes, parental consent, and so on, due to the Hyperledger blockchain fabric’s emergence. The Hyperledger blockchain fabric’s ability to yield multiple privacy options depending on the use-case is its key benefit. Access policies govern access to the channel’s resources (ledger state, transactions, and chaincodes) are used for configuration of the Hyperledger Fabric’s channels. Due to this, the confidentiality and privacy of the singular information enclosed in the nodes of the channel are preserved. A better quality of robustness is accomplished by the channels when a node is down given an alternative to arriving at the destination whilst also given the scalability to ensure the large data amounts’ efficient sharing. Leakage of information from people with high-level access can occur when, despite data privacy, there is no accomplishment of data anonymization. It is crucial to anonymize research data because of the extensive utilization of Artificial Intelligence Markup Language (AIML) in education. Data from an individual is utilized for the generation of an anonymized dataset. Proposal of a heuristic K-anonymity privacy-preserving technique for the hyper-ledger blockchain through the addition of a privacy system manager has been given in the work. The Non-deterministic Polynomial (NP) problem is overcome by these proposed privacy-preserving techniques through the utilization of stochastic diffusion search optimization algorithm gives a better results in various parameters like throughput, latency, misclassification rate, loss metric.

Surface rendering of MRI brain scans may lead to identification of the participant through facial characteristics. In this study, we evaluate three methods that overwrite voxels containing privacy‐sensitive information: Face Masking, FreeSurfer defacing, and FSL defacing. We included structural T1‐weighted MRI scans of children, young adults and older adults. For the young adults, test–retest data were included with a 1‐week interval. The effects of the de‐identification methods were quantified using different statistics to capture random variation and systematic noise in measures obtained through the FreeSurfer processing pipeline. Face Masking and FSL defacing impacted brain voxels in some scans especially in younger participants. FreeSurfer defacing left brain tissue intact in all cases. FSL defacing and FreeSurfer defacing preserved identifiable characteristics around the eyes or mouth in some scans. For all de‐identification methods regional brain measures of subcortical volume, cortical volume, cortical surface area, and cortical thickness were on average highly replicable when derived from original versus de‐identified scans with average regional correlations >.90 for children, young adults, and older adults. Small systematic biases were found that incidentally resulted in significantly different brain measures after de‐identification, depending on the studied subsample, de‐identification method, and brain metric. In young adults, test–retest intraclass correlation coefficients (ICCs) were comparable for original scans and de‐identified scans with average regional ICCs >.90 for (sub)cortical volume and cortical surface area and ICCs >.80 for cortical thickness. We conclude that apparent visual differences between de‐identification methods minimally impact reliability of brain measures, although small systematic biases can occur., De‐identification methods remove or blur facial characteristics on anatomical MRI scans, but also have a small effect on FreeSurfer brain measures. Furthermore, some methods are too invasive in younger participants or do not always succeed to remove all facial characteristics.