Ensuring Confidentiality of Geocoded Health Data: Assessing Geographic Masking Strategies for Individual-Level Data

Figure 7

Illustration of the 𝑘-anonymity concept using record linkage. Medical records contain a number of different fields which are removed to protect confidentiality, including name and address. When combined with voting records, however, it becomes possible to uniquely identify individuals in the medical records by combining fields for ZIP code, birthday, and sex. The 𝑘-anonymity provided by the released data is unacceptably low. By removing the field for birthdate (or replacing it with birth year), the 𝑘-anonymity is substantially increased and may reach acceptable levels. The concept of 𝑘-anonymity provides a quantitative measure of confidentiality protection. More specifically, it is a number that can be calculated for each subset of the data. For the example of medical record and voting records, values for 𝑘-anonymity can be calculated prior to release for all combination of ZIP code and sex or any other field of interest. Adapted from [66].