How Secure Is Your Medical Data?

In 2022, the number of healthcare data breaches affecting more than 500 people rose for the seventh consecutive year. Progress in data security over the past decade has not matched rapid advances in big data and artificial intelligence (AI) technology—and data breaches continue to be a common and costly problem that institutions struggle to address.

Developing better privacy tools and techniques to meet the data collection and distribution demands of the 21st century is crucial for enabling organizations to conduct essential data operations while remaining responsible data stewards capable of maintaining individual privacy.

In data-rich fields such as biomedical research and individual and public health, stewarding massive amounts of sensitive data and creating cross-linkages through trusted partnerships are necessary to inform research and planning efforts in public and biomedical health. Unfortunately, due to the size, scope, and complexity of collecting and linking large datasets, combined with the increased cybersecurity threats that often accompany digital transformation initiatives, there has been an alarming increase in data privacy exploitation by bad actors who engage in fraud, identity theft, and ransomware attacks, among other illegal and unethical behavior.

The average cost of a data breach in 2023 was $4.45 million, which represents a 15% increase over the past three years. In the first half of 2023 alone, more than 39 million individuals were affected by healthcare data breaches, and, in many of these cases, protected health information (PHI) such as names, addresses, Social Security numbers, and diagnoses was stolen. While the financial costs for reconciliation, tech stack repair, and, in some cases, penalties are indeed substantial, the longer term cost of reputational damage and breach of patient trust is incalculable.

To address today’s data security challenges, one proven technique that has recently seen increased adoption is differential privacy (DP): a robust statistical framework that provably minimizes the risk of aggregate data being linked back to an individual while still allowing for secure data sharing and downstream analysis.  

To fully grasp the benefit of DP as a data protection tool, it’s first necessary to understand what the current practices are and why they are insufficient to address today’s security risks. In the health field, the standard practice for safeguarding medical data, as required under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), has been to “de-identify” patient data. Covered entities (i.e., healthcare providers, healthcare clearinghouses, and health plans) can satisfy the de-identification requirement in one of two ways: Expert Identification or Safe Harbor.

Expert Identification requires that a person familiar with the general statistical and scientific principles of individual identifiability prevention certify the security of the health data in question. Safe Harbor, on the other hand, requires that specific identifiers (e.g., names, addresses, telephone numbers) be removed before the data is shared.

However, many previous studies have shown the relative ease with which a malicious entity can re-identify an individual by combining an anonymized dataset with other available open-source data. As far back as 1996, computer scientist Latanya Sweeney proved that with the currently available data 87% of Americans could be identified by gender, birth date, and zip code alone through an experiment linking “anonymized” health data from the Massachusetts Group Insurance Commission to individuals.

Similarly, a 2018 study proved that anonymized hospital data from the states of Maine and Vermont could be vulnerable to composition attacks. Researchers were able to use publicly available newspaper data to identify 28% of anonymized patient records in a statewide hospital database in Maine, and 34% of names could be mapped to a single hospitalization when querying against anonymized patient records in Vermont.

Unsurprisingly, the risk for an individual to be de-anonymized has only increased since that time: Scientists from Imperial College London published research in 2019 showing that 99.98% of Americans could be identified with as few as 15 pieces of demographic data. To further put this into context, the anonymized data of 120 million Americans shared by Experian contains 248 pieces of demographic data.  

DP is a mathematical framework that maintains the aggregate properties of a population’s data while simultaneously preserving the privacy of individual-level information. First developed in 2006 by Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith, the applied technique ensures that no third party can identify the presence of an individual within the privatized dataset no matter how much other relevant data they have at their disposal. In other words, through the introduction of a systematic level of statistical noise into the data, anyone accessing it will not know the true original properties of the individual.

Figure 1 showcases an overview of the DP framework where a database containing user-submitted records is programmatically queried by a querier. Mathematical privacy parameters such as the probability of privacy breach, a privacy budget, and the noise generation distribution are set as part of the initial query. The resultant data from the query contains the differentially private result defined as (ε.δ)-differentially private, referring to the defined mathematical parameters. In practice, this could look like a researcher writing an R script to understand average healthcare expenses by state and age group. Within this query, the researcher would set the aforementioned mathematical parameters and define the noise distribution model appropriate for working with continuous variables. Using this methodology, the averages would be calculated after noise integration, and the output table would be considered differentially private.

Since DP corresponds to a framework as opposed to a specific algorithm, many different algorithms have been developed to suit particular use cases. Technological innovations have coincided with greater adoption capabilities by companies and government agencies alike; the U.S. Census Bureau adopted a DP strategy for the 2020 census due to its proven ability to ensure disclosure avoidance. 

The inability to draw inferences about whether a user’s data is present in a dataset provides significant protection against:

Linkage Attacks

• These occur when “anonymized” data is re-identified by combining the dataset with other sources of data. The privacy guarantee of DP makes this kind of attack highly improbable.

Reconstruction Attacks

• This attack happens when an adversary has access to a trained model and then regenerates the training data samples that fed it. Newer, sophisticated DP methods used for machine learning (ML) limit privacy loss and data leakage.

Differencing Attacks

• When a bad actor already has background information on someone and knows they were included in an aggregate statistic, the target’s individual contribution to the data can be uncovered. Properly applied DP gives “plausible deniability” to that person’s contribution to the aggregate values.

Wearable sensors allow users to submit their personal fitness data—from minute-to-minute heart rate monitoring to nightly sleep conditions—into centralized repositories that can then be queried by curators for aggregated analysis. In many cases, a local DP architecture is employed: noise is applied at the user level on the user’s own device before the data is sent to the server side for aggregation.

This approach offers an additional layer of protection to an individual’s data since it does not depend on a trusted data curator to create the appropriate perturbations. When someone queries the central server, they will be able to receive counts, summations, and averages that are differentially private, and, if a malicious agent were to somehow hack into the central server, all they would find is the differentially private data. Previous cryptographic protective measures, such as encryption and k-anonymity, have been discarded in favor of DP methods over the past few years due to DP’s proven superiority in balancing privacy and utility.   

DP innovations have enabled greater access to biomedical data research without compromising patient confidentiality. A tool called Damson, developed by the University of Illinois, bridges the gap between theoretical and practical DP by facilitating common biomedical data tasks such as regression, clustering, selection counts, and bucketing. Using DP as the basis for a privacy protection model, medical data can be properly secured and then released for analysis and mining with minimal disruption to data availability. 

Models built for tasks such as cancer diagnosis or chest X-ray anomaly detection require voluminous patient data to learn from. ML researchers in the medical field have adopted DP as an optimal way to prevent leakage of private information from trained models. Not only has DP successfully protected sensitive training data used in ML models, but recent research has shown that, in some cases, using DP can actually improve a model’s accuracy on unseen data—DP itself is a form of regularization that can help a model become more generalizable. 

Genomic data is particularly sensitive due to the possibility of uncovering a person’s familial relationships and disease risk. Even seemingly innocuous data, such as minor allele frequencies (MAF) can reveal whether someone is in a medical study cohort. Recent computational advances in local differential privacy (LDP) allow for perturbing genomic data contributions before they are sent to a data collector, while still providing ample utility to the researchers using the data for scientific procedures.

Additionally, a newer variant of LDP developed specifically for protecting genomic data enhances the privacy guarantee by adding an additional set of parameters that prevent an attacker from making correlations in the data that could lead them to infer the original values. At the same time, utility is enhanced by adjusting the probability distribution to reduce the chance of an MAF deviating from its useful value. For example, someone could query the count of a particular MAF through a genomic data-sharing beacon (a webserver designed specifically for the sharing of genomic data). If it does exist in the dataset, the probability of the differentially private count being “0” would be greatly reduced with these newer methods. 

The need for newer and better methods for data privacy protection is clear. DP is a proven tool; as methods for incorporation become more feasible due to improved open-source packages and automation capabilities, it will see wider adoption as an essential component of an organization’s data security infrastructure. Particularly in the fields of biomedical research and public health, where data sharing is commonplace and necessary, DP should be a key component of any organization’s approach for ensuring advancement of science and health initiatives without compromising the trust of patients. 

One concern around DP implementation is the loss of utility that occurs when data is shared, analyzed, or modeled. There has been a proliferation of published research in recent years to address the issue of balancing privacy protection and data utility. Significant progress has been made to ensure that accuracy costs are minimized without concurrent privacy loss.

For example, researchers are finding innovative ways to apply DP to the training of models in order to better protect ML outputs from being reverse-engineered to identify individuals. Studies have shown the relative ease with which an adversary could infer an individual’s membership in the training data based on summary statistics alone. While abundant research and working implementations exist for using DP on tabular and image ML data, applying DP to text data for natural language processing (NLP) is less studied. The known tendency for NLP models to “memorize” training data, as well as the popularity of these models, have made this a rapidly growing area of research in the past few years. 

As DP becomes more autonomous and, therefore, easier for institutions to implement over time, more institutions will start to see the real-world benefits. While there will always be data privacy trade-offs, organizations must consider the full impact of compromised security: financial, reputational, and operational losses that last for years, if not decades. The much smaller upfront expense of applying the latest privacy tools with the help of knowledgeable experts can provide enough risk reduction to prevent these unintentional and avoidable catastrophes.