Evaluating the risk of patient re-identification from adverse drug event reports

Khaled El Emam, Fida K. Dankar, Angelica Neisa, Elizabeth Jonker

Research output: Contribution to journalArticlepeer-review

23 Citations (Scopus)


Background: Our objective was to develop a model for measuring re-identification risk that more closely mimics the behaviour of an adversary by accounting for repeated attempts at matching and verification of matches, and apply it to evaluate the risk of re-identification for Canada's post-marketing adverse drug event database (ADE).Re-identification is only demonstrably plausible for deaths in ADE. A matching experiment between ADE records and virtual obituaries constructed from Statistics Canada vital statistics was simulated. A new re-identification risk is considered, it assumes that after gathering all the potential matches for a patient record (all records in the obituaries that are potential matches for an ADE record), an adversary tries to verify these potential matches. Two adversary scenarios were considered: (a) a mildly motivated adversary who will stop after one verification attempt, and (b) a highly motivated adversary who will attempt to verify all the potential matches and is only limited by practical or financial considerations. Methods. The mean percentage of records in ADE that had a high probability of being re-identified was computed. Results: Under scenario (a), the risk of re-identification from disclosing the province, age at death, gender, and exact date of the report is quite high, but the removal of province brings down the risk significantly. By only generalizing the date of reporting to month and year and including all other variables, the risk is always low. All ADE records have a high risk of re-identification under scenario (b), but the plausibility of that scenario is limited because of the financial and practical deterrent even for highly motivated adversaries. Conclusions: It is possible to disclose Canada's adverse drug event database while ensuring that plausible re-identification risks are acceptably low. Our new re-identification risk model is suitable for such risk assessments.

Original languageEnglish
Article number114
JournalBMC Medical Informatics and Decision Making
Issue number1
Publication statusPublished - 2013
Externally publishedYes

ASJC Scopus subject areas

  • Health Policy
  • Health Informatics
  • Computer Science Applications


Dive into the research topics of 'Evaluating the risk of patient re-identification from adverse drug event reports'. Together they form a unique fingerprint.

Cite this