ArticleInternational journal of health geographics2008
Re-identification of home addresses from spatial locations anonymized by Gaussian skew.
Article in International journal of health geographics, 2008. The graph could read no effect estimate from its abstract, so it casts no vote on the map. Cited by 15 papers.
What it found
Each row is one number read from the abstract, on the scale the paper reported it, with its interval. Left of the dashed line favours the treatment, right favours the comparator. Under each row is the sentence it came from. New to these charts? A ten-minute tutorial.
The abstract states no effect estimate the extractor could read, or names no intervention and outcome on the map, so this paper lights no cell and moves no belief. It is still indexed, cited and linked below.
The trial behind it
Trials whose registry record cites this paper, or whose number appears in the abstract. A trial that started after this paper was published is citing it as background, not reporting it.
Neither the registry nor the abstract names a trial number. If this is a trial report, that itself is worth knowing.
Who cites it
15 citing papers in PubMed.
- Ethical guidelines for geoprivacy: a framework for researchers and ethics committees.International journal of health geographics · 2026Article
- The role of artificial intelligence in paediatric neuroradiology.Pediatric radiology · 2022Review
- Data sharing and privacy issues in neuroimaging research: Opportunities, obstacles, challenges, and monsters under the bed.Human brain mapping · 2022Review
- Working toward effective anonymization for surveillance data: innovation at South Africa's Agincourt Health and Socio-Demographic Surveillance Site.Population and environment · 2021Article
- Mass Tracking in Cellular Networks for the COVID-19 Pandemic Monitoring.Sensors (Basel, Switzerland) · 2021Article
- Practical Considerations for Data Collection and Management in Mobile Health Micro-randomized Trials.Statistics in biosciences · 2019Article
- A Geoprivacy by Design Guideline for Research Campaigns That Use Participatory Sensing Data.Journal of empirical research on human research ethics : JERHRE · 2018Article
- Confidentiality considerations for use of social-spatial data on the social determinants of health: Sexual and reproductive health case study.Social science & medicine (1982) · 2016Article
- The Ethics of Big Data: Current and Foreseeable Issues in Biomedical Contexts.Science and engineering ethics · 2016Review
- Anonymisation of address coordinates for microlevel analyses of the built environment: a simulation study.BMJ open · 2015Article
- A spectrum of sharing: maximization of information content for brain imaging data.GigaScience · 2015Article
- A linear programming model for preserving privacy when disclosing patient spatial information for secondary purposes.International journal of health geographics · 2014Article
- Ensuring Confidentiality of Geocoded Health Data: Assessing Geographic Masking Strategies for Individual-Level Data.Advances in medicine · 2014Review
- Privacy versus public health: the impact of current confidentiality rules.American journal of public health · 2010Article
- Musings on privacy issues in health research involving disaggregate geographic data about individuals.International journal of health geographics · 2009Review
Corrections and comments
PubMed lists nothing against this paper. Absence here is not a guarantee, only a check that was made.
Authors and funding
3 authors.
Funding
Abstract
backgroundKnowledge of the geographical locations of individuals is fundamental to the practice of spatial epidemiology. One approach to preserving the privacy of individual-level addresses in a data set is to de-identify the data using a non-deterministic blurring algorithm that shifts the geocoded values. We investigate a vulnerability in this approach which enables an adversary to re-identify individuals using multiple anonymized versions of the original data set. If several such versions are available, each can be used to incrementally refine estimates of the original geocoded location.
resultsWe produce multiple anonymized data sets using a single set of addresses and then progressively average the anonymized results related to each address, characterizing the steep decline in distance from the re-identified point to the original location, (and the reduction in privacy). With ten anonymized copies of an original data set, we find a substantial decrease in average distance from 0.7 km to 0.2 km between the estimated, re-identified address and the original address. With fifty anonymized copies of an original data set, we find a decrease in average distance from 0.7 km to 0.1 km.
conclusionWe demonstrate that multiple versions of the same data, each anonymized by non-deterministic Gaussian skew, can be used to ascertain original geographic locations. We explore solutions to this problem that include infrastructure to support the safe disclosure of anonymized medical data to prevent inference or re-identification of original address data, and the use of a Markov-process based algorithm to mitigate this risk.
Indexed as
Identifiers
What OpenQuestion holds
Registered trials
Read under generation 80e0d062 · epoch 390. Bibliography from PubMed, PubMed Central and OpenAlex; grants from NIH RePORTER; trial links from ClinicalTrials.gov; estimates, votes and beliefs from the OpenQuestion graph.