Practicing Differential Privacy in Health Care: A Review

Differential privacy has gained a lot of attention in recent years as a general model for the protection of personal information when used and dis‐ closed for secondary purposes. It has also been proposed as an appropriate model for protecting health data. In this paper we review the current literature on differential privacy and highlight important general limitations to the model and the proposed mechanisms. We then examine some practical challenges to the application of differential privacy to health data. The most severe limitation is the theoretical nature of the privacy parameter . It has implications on our ability to quantify the level of anonymization that would be guaranteed to pa‐ tients, as well as assessing responsibilities when a privacy breach occurs. The review concludes by identifying the areas that researchers and practitioners need to address to increase the adoption of differential privacy for health data. 1 Background We consider private data analysis in the setting of a trusted data custodian that has a database consisting of rows of data (records). Each row represents infor‐ mation about an individual. The custodian needs to publish an anonymized ver‐ sion of the data, a version that is useful to data analysts and that protects the privacy of the individuals in the database. The problem is known as privacy‐ preserving data publishing. Various approaches/models have been proposed in different research commu‐ nities over the past few years [1]. These models depend on the background knowledge of adversaries; as these adversaries can infer sensitive information from the dataset by exploiting background information. Because of that de‐