CoChat
Sign Up
Cited by 161Privacy-Preserving Technologies in DataThoreau and American LiteratureData Quality and Management

Feasibility of Reidentifying Individuals in Large National Physical Activity Data Sets From Which Protected Health Information Has Been Removed With Use of Machine Learning

Open access
Na, Liangyuan, Yang, Cong, Lo, Chi-Cheng, Zhao, Fangyuan, Fukuoka, Yoshimi, Aswani, Anil·2018·JAMA Network Open
DOI 10.1001/jamanetworkopen.2018.6040PMC PMC6324329
Open this paper in CoChat — free accountOpen PDF

Abstract

Importance: Despite data aggregation and removal of protected health information, there is concern that deidentified physical activity (PA) data collected from wearable devices can be reidentified. Organizations collecting or distributing such data suggest that the aforementioned measures are sufficient to ensure privacy. However, no studies, to our knowledge, have been published that demonstrate the possibility or impossibility of reidentifying such activity data. Objective: To evaluate the feasibility of reidentifying accelerometer-measured PA data, which have had geographic and protected health information removed, using support vector machines (SVMs) and random forest methods from machine learning. Design, Setting, and Participants: In this cross-sectional study, the National Health and Nutrition Examination Survey (NHANES) 2003-2004 and 2005-2006 data sets were analyzed in 2018. The accelerometer-measured PA data were collected in a free-living setting for 7 continuous days. NHANES uses a multistage probability sampling design to select a sample that is representative of the civilian noninstitutionalized household (both adult and children) population of the United States. Exposures: The NHANES data sets contain objectively measured movement intensity as recorded by accelerometers worn during all walking for 1 week. Main Outcomes and Measures: The primary outcome was the ability of the random forest and linear SVM algorithms to match demographic and 20-minute aggregated PA data to individual-specific record numbers, and the percentage of correct matches by each machine learning algorithm was the measure. Results: A total of 4720 adults (mean [SD] age, 40.0 [20.6] years) and 2427 children (mean [SD] age, 12.3 [3.4] years) in NHANES 2003-2004 and 4765 adults (mean [SD] age, 45.2 [19.9] years) and 2539 children (mean [SD] age, 12.1 [3.4] years) in NHANES 2005-2006 were included in the study. The random forest algorithm successfully reidentified the demographic and 20-minute aggregated PA data of 4478 adults (94.9%) and 2120 children (87.4%) in NHANES 2003-2004 and 4470 adults (93.8%) and 2172 children (85.5%) in NHANES 2005-2006 (P < .001 for all). The linear SVM algorithm successfully reidentified the demographic and 20-minute aggregated PA data of 4043 adults (85.6%) and 1695 children (69.8%) in NHANES 2003-2004 and 4041 adults (84.8%) and 1705 children (67.2%) in NHANES 2005-2006 (P < .001 for all). Conclusions and Relevance: This study suggests that current practices for deidentification of accelerometer-measured PA data might be insufficient to ensure privacy. This finding has important policy implications because it appears to show the need for deidentification that aggregates the PA data of multiple individuals to ensure privacy for single individuals.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1001/jamanetworkopen.2018.6040

Cites

18 of 18 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 5

  1. [14]Narayanan A, Shmatikov V Robust de-anonymization of large sparse datasets. In: SP ’08 Proceedings of the 2008 IEEE Symposium on Security and Privacy Washington, DC: IEEE Computer Society; 2018:111-125.
  2. [15]Narayanan A, Shmatikov V De-anonymizing social networks. In: SP ’08 Proceedings of the 2008 IEEE Symposium on Security and Privacy Washington, DC: IEEE Computer Society; 2009:173-187.
  3. [17]Lane ND, Xie J, Moscibroda T, Zhao F On the feasibility of user de-anonymization from shared mobile sensor data. Paper presented at: Third International Workshop on Sensing Applications on Mobile Phones; November 6, 2012; Toronto, ON.
  4. [27]Keerthi SS, Sundararajan S, Chang KW, Hsieh CJ, Lin CJ A sequential dual method for large scale multi-class linear SVMs. In: Proceedings of the 14th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining New York, NY: Association for Computing Machinery; 2008:408-416.
  5. [30]Crammer K, Singer Y On the learnability and design of output codes for multiclass problems. In: Proceedings of the 13th Annual Conference on Computational Learning Theory. San Francisco, CA: Morgan Kauffman Publishers Inc; 2000:35-46.

Cited by

Sorted by citations

Related

Authors
Na, L., Yang, C., Lo, C.-C., Zhao, F., Fukuoka, Y., & Aswani, A.
Affiliations
  • Massachusetts Institute of Technology (US)
  • University of California, Berkeley (US)
  • Tsinghua–Berkeley Shenzhen Institute (CN)
  • University of California, San Francisco (US)
Corresponding author
Aswani, Anil
ORCID
Venue
JAMA Network Open
Publisher
American Medical Association (AMA)
Published
2018-12-21
Volume
1
Issue
8
Pages
e186040
ISSN
2574-3805 (ISSN-L)
DOI
10.1001/jamanetworkopen.2018.6040
PMC
PMC6324329
OpenAlex
W2905657479
Cited by
161
References
18
Citations by year
2026: 19 · 2025: 22 · 2024: 21 · 2023: 25 · 2022: 17 · 2021: 22 · 2020: 22 · 2019: 11 · 2018: 2
FWCI
8.02
Type
journal article
Language
en
Open access
Licence
cc-by
Locations
  • JAMA Network Open (publishedVersion, cc-by)
  • Europe PMC (PubMed Central) (publishedVersion, cc-by)
  • PubMed Central (publishedVersion, cc-by)
  • PubMed (publishedVersion)
  • eScholarship (California Digital Library) (submittedVersion)
Funders
  • Center for Long-Term Cybersecurity, University of California Berkeley
  • National Institute of Nursing Research (K24NR015812)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
  • Physical Sciences › Computer Science › Information Systems › Thoreau and American Literature
  • Social Sciences › Decision Sciences › Management Science and Operations Research › Data Quality and Management
Keywords
de-identification, re-identification, physical activity data, wearable accelerometers, privacy, protected health information, NHANES, random forest, support vector machine, children, adults, data aggregation, third-party data sharing
MeSH terms
Machine Learning, Fitness Trackers, Adolescent, Adult, Child, Confidentiality, Feasibility Studies, Female, Humans, Male, Medical Informatics, Middle Aged, Exercise, Databases, Factual, Computer Security, Young Adult, Biometric Identification, Support Vector Machine, Accelerometry

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review