An unsupervised classification method for inferring original case locations from low-resolution disease maps

Exploring geomasking methods for geoprivacy: a pilot study in an environment with built features

This study discusses the ethical use of geographical information systems (GIS) data with a focus on geomasking for upholding locational privacy. As part of a pilot study in Jeddah City, Saudi Arabia, we used open-source geomasking methods to ensure geoprivacy while examining built environment features that determine the quality of life among individuals with type-II diabetes. We employed the open-source algorithms Maskmy.XYZ and NRand-k for geomasking 329 data points. The results showed no differences between global and city-level spatial patterns, but significant variations were observed with respect to local patterns. These findings indicate the promising potential of the chosen geomasking technologies with respect to ensuring locational privacy but it was noted that further improvements are needed. We recommend developing enhanced algorithms and conducting additional studies to minimize any negative impact of geomasking in spatial analysis with the overall aim of achieving a better understanding of ethical considerations in GIS sciences. In conclusion, application of geomasking is straightforward and can lead to enhanced use for privacy protection in geospatial data analysis.

The utility of Zip4 codes in spatial epidemiological analysis

There are many public health situations within the United States that require fine geographical scale data to effectively inform response and intervention strategies. However, a condition for accessing and analyzing such data, especially when multiple institutions are involved, is being able to preserve a degree of spatial privacy and confidentiality. Hospitals and state health departments, who are generally the custodians of these fine-scale health data, are sometimes understandably hesitant to collaborate with each other due to these concerns. This paper looks at the utility and pitfalls of using Zip4 codes, a data layer often included as it is believed to be "safe", as a source for sharing fine-scale spatial health data that enables privacy preservation while maintaining a suitable precision for spatial analysis. While the Zip4 is widely supplied, researchers seldom utilize it. Nor is its spatial characteristics known by data guardians. To address this gap, we use the context of a near-real time spatial response to an emerging health threat to show how the Zip4 aggregation preserves an underlying spatial structure making it potentially suitable dataset for analysis. Our results suggest that based on the density of urbanization, Zip4 centroids are within 150 meters of the real location almost 99% of the time. Spatial analysis experiments performed on these Zip4 data suggest a far more insightful geographic output than if using more commonly used aggregation units such as street lines and census block groups. However, this improvement in analytical output comes at a spatial privy cost as Zip4 centroids have a higher potential of compromising spatial anonymity with 73% of addresses having a spatial k anonymity value less than 5 when compared to other aggregations. We conclude that while offers an exciting opportunity to share data between organizations, researchers and analysts need to be made aware of the potential for serious confidentiality violations.

How Culture and Sociopolitical Tensions Might Influence People’s Acceptance of COVID-19 Control Measures That Use Individual-Level Georeferenced Data

This study extends an earlier study in the United States and South Korea on people’s privacy concerns for and acceptance of COVID-19 control measures that use individual-level georeferenced data (IGD). Using a new dataset collected via an online survey in Hong Kong, we first examine the influence of culture and recent sociopolitical tensions on people’s privacy concerns for and acceptance of three types of COVID-19 control measures that use IGD: contact tracing, self-quarantine monitoring, and location disclosure. We then compare Hong Kong people’s views with the views of people in the United States and South Korea using the pooled data of the three study areas. The results indicate that, when compared to people in the United States and South Korea, people in Hong Kong have a lower acceptance rate for digital contact tracing and higher acceptance rates for self-quarantine monitoring using e-wristbands and location disclosure. Further, there is geographic heterogeneity in the age and gender differences in privacy concerns, perceived social benefits, and acceptance of COVID-19 control measures: young people (age < 24) and women in Hong Kong and South Korea have greater privacy concerns than men. Further, age and gender differences in privacy concerns, perceived social benefits, and acceptance of COVID-19 control measures in Hong Kong and South Korea are larger than those in the United States, and people in Hong Kong have the largest age and gender differences in privacy concerns, perceived social benefits, and acceptance of COVID-19 measures among the three study areas.

Daily activity locations k-anonymity for the evaluation of disclosure risk of individual GPS datasets

Background

Personal privacy is a significant concern in the era of big data. In the field of health geography, personal health data are collected with geographic location information which may increase disclosure risk and threaten personal geoprivacy. Geomasking is used to protect individuals’ geoprivacy by masking the geographic location information, and spatial k-anonymity is widely used to measure the disclosure risk after geomasking is applied. With the emergence of individual GPS trajectory datasets that contains large volumes of confidential geospatial information, disclosure risk can no longer be comprehensively assessed by the spatial k-anonymity method.

Methods

This study proposes and develops daily activity locations (DAL) k-anonymity as a new method for evaluating the disclosure risk of GPS data. Instead of calculating disclosure risk based on only one geographic location (e.g., home) of an individual, the new DAL k-anonymity is a composite evaluation of disclosure risk based on all activity locations of an individual and the time he/she spends at each location abstracted from GPS datasets. With a simulated individual GPS dataset, we present case studies of applying DAL k-anonymity in various scenarios to investigate its performance. The results of applying DAL k-anonymity are also compared with those obtained with spatial k-anonymity under these scenarios.

Results

The results of this study indicate that DAL k-anonymity provides a better estimation of the disclosure risk than does spatial k-anonymity. In various case-study scenarios of individual GPS data, DAL k-anonymity provides a more effective method for evaluating the disclosure risk by considering the probability of re-identifying an individual’s home and all the other daily activity locations.

Conclusions

This new method provides a quantitative means for understanding the disclosure risk of sharing or publishing GPS data. It also helps shed new light on the development of new geomasking methods for GPS datasets. Ultimately, the findings of this study will help to protect individual geoprivacy while benefiting the research community by promoting and facilitating geospatial data sharing.

Addressing the data guardian and geospatial scientist collaborator dilemma: how to share health records for spatial analysis while maintaining patient confidentiality

BACKGROUND

The utility of being able to spatially analyze health care data in near-real time is a growing need. However, this potential is often limited by the level of in-house geospatial expertise. One solution is to form collaborative partnerships between the health and geoscience sectors. A challenge in achieving this is how to share data outside of a host institution's protection protocols without violating patient confidentiality, and while still maintaining locational geographic integrity. Geomasking techniques have been previously championed as a solution, though these still largely remain an unavailable option to institutions with limited geospatial expertise. This paper elaborates on the design, implementation, and testing of a new geomasking tool Privy, which is designed to be a simple yet efficient mechanism for health practitioners to share health data with geospatial scientists while maintaining an acceptable level of confidentiality. The basic premise of Privy is to move the important coordinates to a different geography, perform the analysis, and then return the resulting hotspot outputs to the original landscape.

RESULTS

We show that by transporting coordinates through a combination of random translations and rotations, Privy is able to preserve location connectivity among spatial point data. Our experiments with typical analytical scenarios including spatial point pattern analysis and density analysis shows that, along with protecting spatial privacy, Privy maintains the spatial integrity of data which reduces information loss created due to data augmentation.

CONCLUSION

The results from this study suggests that along with developing new mathematical techniques to augment geospatial health data for preserving confidentiality, simple yet efficient software solutions can be developed to enable collaborative research among custodians of medical and health data records and GIS experts. We have achieved this by developing Privy, a tool which is already being used in real-world situations to address the spatial confidentiality dilemma.

A Geoprivacy by Design Guideline for Research Campaigns That Use Participatory Sensing Data

Participatory sensing applications collect personal data of monitored subjects along with their spatial or spatiotemporal stamps. The attributes of a monitored subject can be private, sensitive, or confidential information. Also, the spatial or spatiotemporal attributes are prone to inferential disclosure of private information. Although there is extensive problem-oriented literature on geoinformation disclosure, our work provides a clear guideline with practical relevance, containing the steps that a research campaign should follow to preserve the participants' privacy. We first examine the technical aspects of geoprivacy in the context of participatory sensing data. Then, we propose privacy-preserving steps in four categories, namely, ensuring secure and safe settings, actions prior to the start of a research survey, processing and analysis of collected data, and safe disclosure of datasets and research deliverables.

Confidentiality considerations for use of social-spatial data on the social determinants of health: Sexual and reproductive health case study

Understanding whether and how the places where people live, work, and play are associated with health behaviors and health is essential to understanding the social determinants of health. However, social-spatial data which link a person and their attributes to a geographic location (e.g., home address) create potential confidentiality risks. Despite the growing body of literature describing approaches to protect individual confidentiality when utilizing social-spatial data, peer-reviewed manuscripts displaying identifiable individual point data or quasi-identifiers (attributes associated with the individual or disease that narrow identification) in maps persist, suggesting that knowledge has not been effectively translated into public health research practices. Using sexual and reproductive health as a case study, we explore the extent to which maps appearing in recent peer-reviewed publications risk participant confidentiality. Our scoping review of sexual and reproductive health literature published and indexed in PubMed between January 1, 2013 and September 1, 2015 identified 45 manuscripts displaying participant data in maps as points or small-population geographic units, spanning 26 journals and representing studies conducted in 20 countries. Notably, 56% (13/23) of publications presenting point data on maps either did not describe approaches used to mask data or masked data inadequately. Furthermore, 18% (4/22) of publications displaying data using small-population geographic units included at least two quasi-identifiers. These findings highlight the need for heightened education for researchers, reviewers, and editorial teams. We aim to provide readers with a primer on key confidentiality considerations when utilizing linked social-spatial data for visualizing results. Given the widespread availability of place-based data and the ease of creating maps, it is critically important to raise awareness on when social-spatial data constitute protected health information, best practices for masking geographic identifiers, and methods of balancing disclosure risk and scientific utility. We conclude with recommendations to support the preservation of confidentiality when disseminating results.

Why does geoprivacy matter? The scientific publication of confidential data presented on maps

We examined published maps containing sensitive data, and the protection methods, if any, that were used. We investigated whether the many published warnings about disclosure risk have been effective in reducing privacy risk. During an 8-year period (2005-2012), 19 journals related to GIScience, geography, spatial crime analysis, and health geography were examined. We identified 41 articles that display actual confidential information and 16 articles where confidential information is protected by the use of a geographical mask. During the investigated time frame, the numbers of articles with unmasked confidential data increased, and in total more than 68,000 home addresses were disclosed. One of the more significant findings of this study is that efforts to instill sensitivity to location privacy and disclosure risk have been relatively unsuccessful.

A linear programming model for preserving privacy when disclosing patient spatial information for secondary purposes

Background

A linear programming (LP) model was proposed to create de-identified data sets that maximally include spatial detail (e.g., geocodes such as ZIP or postal codes, census blocks, and locations on maps) while complying with the HIPAA Privacy Rule’s Expert Determination method, i.e., ensuring that the risk of re-identification is very small. The LP model determines the transition probability from an original location of a patient to a new randomized location. However, it has a limitation for the cases of areas with a small population (e.g., median of 10 people in a ZIP code).

Methods

We extend the previous LP model to accommodate the cases of a smaller population in some locations, while creating de-identified patient spatial data sets which ensure the risk of re-identification is very small.

Results

Our LP model was applied to a data set of 11,740 postal codes in the City of Ottawa, Canada. On this data set we demonstrated the limitations of the previous LP model, in that it produces improbable results, and showed how our extensions to deal with small areas allows the de-identification of the whole data set.

Conclusions

The LP model described in this study can be used to de-identify geospatial information for areas with small populations with minimal distortion to postal codes. Our LP model can be extended to include other information, such as age and gender.

Ensuring Confidentiality of Geocoded Health Data: Assessing Geographic Masking Strategies for Individual-Level Data

Public health datasets increasingly use geographic identifiers such as an individual's address. Geocoding these addresses often provides new insights since it becomes possible to examine spatial patterns and associations. Address information is typically considered confidential and is therefore not released or shared with others. Publishing maps with the locations of individuals, however, may also breach confidentiality since addresses and associated identities can be discovered through reverse geocoding. One commonly used technique to protect confidentiality when releasing individual-level geocoded data is geographic masking. This typically consists of applying a certain amount of random perturbation in a systematic manner to reduce the risk of reidentification. A number of geographic masking techniques have been developed as well as methods to quantity the risk of reidentification associated with a particular masking method. This paper presents a review of the current state-of-the-art in geographic masking, summarizing the various methods and their strengths and weaknesses. Despite recent progress, no universally accepted or endorsed geographic masking technique has emerged. Researchers on the other hand are publishing maps using geographic masking of confidential locations. Any researcher publishing such maps is advised to become familiar with the different masking techniques available and their associated reidentification risks.

Global positioning system: a new opportunity in physical activity measurement

Accurate measurement of physical activity is a pre-requisite to monitor population physical activity levels and design effective interventions. Global Positioning System (GPS) technology offers potential to improve the measurement of physical activity. This paper 1) reviews the extant literature on the application of GPS to monitor human movement, with a particular emphasis on free-living physical activity, 2) discusses issues associated with GPS use, and 3) provides recommendations for future research. Overall findings show that GPS is a useful tool to augment our understanding of physical activity by providing the context (location) of the activity and used together with Geographical Information Systems can provide some insight into how people interact with the environment. However, no studies have shown that GPS alone is a reliable and valid measure of physical activity.

Musings on privacy issues in health research involving disaggregate geographic data about individuals

This paper offers a state-of-the-art overview of the intertwined privacy, confidentiality, and security issues that are commonly encountered in health research involving disaggregate geographic data about individuals. Key definitions are provided, along with some examples of actual and potential security and confidentiality breaches and related incidents that captured mainstream media and public interest in recent months and years. The paper then goes on to present a brief survey of the research literature on location privacy/confidentiality concerns and on privacy-preserving solutions in conventional health research and beyond, touching on the emerging privacy issues associated with online consumer geoinformatics and location-based services. The 'missing ring' (in many treatments of the topic) of data security is also discussed. Personal information and privacy legislations in two countries, Canada and the UK, are covered, as well as some examples of recent research projects and events about the subject. Select highlights from a June 2009 URISA (Urban and Regional Information Systems Association) workshop entitled 'Protecting Privacy and Confidentiality of Geographic Data in Health Research' are then presented. The paper concludes by briefly charting the complexity of the domain and the many challenges associated with it, and proposing a novel, 'one stop shop' case-based reasoning framework to streamline the provision of clear and individualised guidance for the design and approval of new research projects (involving geographical identifiers about individuals), including crisp recommendations on which specific privacy-preserving solutions and approaches would be suitable in each case.

Residential Anonymous Linking Fields (RALFs): a novel information infrastructure to study the interaction between the environment and individuals' health

BACKGROUND

The necessity of aggregating health data over areas can impede our understanding of health determinants.

METHODS

We demonstrate the possibility of creating anonymous links between individual residences and the local environment using digital map data and a data linkage system.

RESULTS

Digital map data were used successfully to anonymously link 1.3 million addresses to the local environment. The data linkage system allows detailed environment data surrounding each residence to be linked both to each resident therein and to their medical records.

CONCLUSIONS

Local environment data specific to each house can be effectively and anonymously linked to the population registered with the National Health Service. Our integrated approach potentially enables flexible fine-scale, large-area observational studies of communities and health.

Evaluating predictors of geographic area population size cut-offs to manage re-identification risk

OBJECTIVE

In public health and health services research, the inclusion of geographic information in data sets is critical. Because of concerns over the re-identification of patients, data from small geographic areas are either suppressed or the geographic areas are aggregated into larger ones. Our objective is to estimate the population size cut-off at which a geographic area is sufficiently large so that no data suppression or further aggregation is necessary.

DESIGN

The 2001 Canadian census data were used to conduct a simulation to model the relationship between geographic area population size and uniqueness for some common demographic variables. Cut-offs were computed for geographic area population size, and prediction models were developed to estimate the appropriate cut-offs.

MEASUREMENTS

Re-identification risk was measured using uniqueness. Geographic area population size cut-offs were estimated using the maximum number of possible values in the data set and a traditional entropy measure.

RESULTS

The model that predicted population cut-offs using the maximum number of possible values in the data set had R2 values around 0.9, and relative error of prediction less than 0.02 across all regions of Canada. The models were then applied to assess the appropriate geographic area size for the prescription records provided by retail and hospital pharmacies to commercial research and analysis firms.

CONCLUSIONS

To manage re-identification risk, the prediction models can be used by public health professionals, health researchers, and research ethics boards to decide when the geographic area population size is sufficiently large.

The perceived impact of location privacy: a web-based survey of public health perspectives and requirements in the UK and Canada

BACKGROUND

The "place-consciousness" of public health professionals is on the rise as spatial analyses and Geographic Information Systems (GIS) are rapidly becoming key components of their toolbox. However, "place" is most useful at its most precise, granular scale - which increases identification risks, thereby clashing with privacy issues. This paper describes the views and requirements of public health professionals in Canada and the UK on privacy issues and spatial data, as collected through a web-based survey.

METHODS

Perceptions on the impact of privacy were collected through a web-based survey administered between November 2006 and January 2007. The survey targeted government, non-government and academic GIS labs and research groups involved in public health, as well as public health units (Canada), ministries, and observatories (UK). Potential participants were invited to participate through personally addressed, standardised emails.

RESULTS

Of 112 invitees in Canada and 75 in the UK, 66 and 28 participated in the survey, respectively. The completion proportion for Canada was 91%, and 86% for the UK. No response differences were observed between the two countries. Ninety three percent of participants indicated a requirement for personally identifiable data (PID) in their public health activities, including geographic information. Privacy was identified as an obstacle to public health practice by 71% of respondents. The overall self-rated median score for knowledge of privacy legislation and policies was 7 out of 10. Those who rated their knowledge of privacy as high (at the median or above) also rated it significantly more severe as an obstacle to research (P < 0.001). The most critical cause cited by participants in both countries was bureaucracy.

CONCLUSION

The clash between PID requirements - including granular geography - and limitations imposed by privacy and its associated bureaucracy require immediate attention and solutions, particularly given the increasing utilisation of GIS in public health. Solutions include harmonization of privacy legislation with public health requirements, bureaucratic simplification, increased multidisciplinary discourse, education, and development of toolsets, algorithms and guidelines for using and reporting on disaggregate data.