De-identification and linkage of data records

• US 20060020611A1
• Filed: 08/02/2005
• Published: 01/26/2006
• Est. Priority Date: 12/08/2000
• Status: Abandoned Application

• Current Assignee: Professional Solutions, LLC
• Original Assignee: Professional Solutions, LLC
• Inventors: Beck, Karl, Gilbert, Eric S., Clark, Troy S., Evans, Kathi S.
• Application Number:
  US11/195,058
• Publication Number:
  US 20060020611A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/00 Information retrieval; Database structures therefor; File system structures therefor
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: G16H 10/60 for patient-specific data, e.g. for electronic patient records
• CPC Class Codes: G16Z 99/00 Subject matter not provided for in other main groups of this subclass

Abstract

Apparatus and method for creating de-identified and linked records is described. More particularly, data records are de-identified at a client computer. De-identification includes field-level one-way encryption. De-identified records may then be sent to a server computer for linkage. Linkage is done using match codes created for such data records at the client computer. The server computer is configured to provide longitudinal linkage of de-identified client records to de-identified master records. In this manner, privacy may be maintained at the client computer prior to transmission of information, and longitudinal linkage of records may occur without exposing personally identifying information.

Claims

1. A system comprising:

client computers having one or more data records, the client computers in communication with a network, the client computers configured to field-level normalize and one-way encrypt one or more fields of the one or more data records to provide one or more de-identified records; and

a server computer in communication with the network to receive the one or more de-identified records and in communication with a database, the database including one or more master records, the server computer configured to compare the one or more de-identified records with the one or more master records and to determine which records of the one or more de-identified records and the one or more master records are to be linked.

2. The system of claim 1 wherein the database is partially described by a table of master records.

3. The system of claim 2 wherein the table is for comparing the one or more de-identified records are compared with the one or more master records.

4. A method for de-identification of at least one record by a programmed client computer, comprising:

obtaining the at least one record, the at least one record having data fields;

normalizing at least a portion of the data fields; and

one-way hashing the at least a portion of the data fields to provide a de-identified record.

5. The method of claim 4 further comprising:

two-way encrypting the de-identified record;

compressing the de-identified record; and

transmitting the de-identified record.

6. The method of claim 5 further comprising encoding the data fields after normalization.

7. (canceled)

8. (canceled)

9. (canceled)

10. (canceled)

11. (canceled)

12. (canceled)

13. (canceled)

14. (canceled)

15. (canceled)

16. (canceled)

17. (canceled)

18. (canceled)

19. (canceled)

20. (canceled)

21. (canceled)

22. A signal-bearing medium containing a program which, when executed by a processor, causes execution of a method comprising:

obtaining at least one record, the record having data fields;

normalizing at least a portion of the data fields; and

one-way hashing the at least a portion of the data fields to provide a de-identified record.

44. The signal-bearing medium of claim 22, wherein the method further comprises:

providing the de-identified record to a server computer; and

using a table of master records to link the de-identified record at the server computer.

45. The signal-bearing medium of claim 44, wherein the method further comprises:

linking the de-identified record with one or more of the master records.

46. The signal-bearing medium of claim 22, wherein the method further comprises encoding the data fields after normalization.

23. (canceled)

24. (canceled)

25. (canceled)

26. (canceled)

27. (canceled)

28. (canceled)

29. (canceled)

30. (canceled)

31. (canceled)

32. (canceled)

33. (canceled)

34. (canceled)

35. (canceled)

36. (canceled)

37. A method for transforming personal identifying information to facilitate protection of privacy interests while allowing use of non-personally identifying information, comprising:

receiving data on an individual including personally identifying information;

de-identifying the data at a client computer including field-level one-way encryption;

transmitting the de-identified data to a server computer for record linkage; and

using match codes created for the data at the client computer to link records at the server computer.

38. The method of claim 37 further comprising providing the records to the server computer from a database.

39. The method of claim 38 partially describing the database using a table of records, wherein the records are master records.

40. The method of claim 39 using the table is to compare the de-identified data with one or more of the master records.

41. The method of claim 37, wherein de-identifying the data at a client computer comprises:

obtaining the at least one record, the at least one record having data fields;

normalizing at least a portion of the data fields; and

one-way hashing the at least a portion of the data fields to provide a de-identified record.

42. The method of claim 41 further comprising:

two-way encrypting the de-identified record; and

compressing the de-identified record.

43. The method of claim 42 further comprising encoding the data fields after normalization.