A group of researchers from Melbourne University say it is possible to re-identify people with a high degree of confidence from de-identified medical data that was released last year.
The three researchers — Dr Vanessa Teague, Dr Christopher Culnane and Dr Benjamin Rubinstein of Melbourne University's Department of Computing and Information Systems — had identified issues with the data last year, and shown that analysing the 10% linked dataset made it possible to decrypt some service provider IDs.
The dataset was made available to the public by the Department of Health on the data.gov.au website but was removed after the researchers pointed out that service provider IDs could be identified.
The data was extracted from the Pharmaceutical Benefits and Medicare Benefits schemes. It included the de-identified medical billing records of 2.9 million people, or 10% of all Australians, from 1984 to 2014. The year of birth, gender, and medical events were also present.
{loadposition sam08}Teague, Culnane and Rubinstein said they had found that patients could be re-identified from the data by linking unencrypted parts of the record with known information about the individual.
Last year, after the data was pulled from the Web, Attorney-General George Brandis announced that the Privacy Act would be amended to make it a criminal offence to re-identify government data that had been de-identified.
The researchers said their findings were similar to those obtained in studies of other de-identified datasets:
- A few mundane facts taken together often suffice to isolate an individual.
- Some patients can be identified by name from publicly available information.
- Decreasing the precision of the data, or perturbing it statistically, makes re-identification gradually harder at a substantial cost to utility.
Teague, Culnane and Rubinstein said anyone with technical skills about the level of an under-graduate computing degree would be able to re-identify patients from the dataset.