| |||
PhysioToolkit
|
Advanced Search |
Tour |
Mirrors How to Cite | Contributing | FAQ |
||
| |||
For additional discussion of the methods used by the software
described here, see
Neamatullah I, Douglass M, Lehman LH, Reisner A, Villarroel M, Long WJ, Szolovits P, Moody GB, Mark RG, Clifford GD. Automated De-Identification of Free-Text Medical Records. Submitted to BMC Medical Informatics and Decision Making, December 2007. [Preprint] Please cite the above paper when referencing this material, and also include the standard citation for PhysioNet: Goldberger AL, Amaral LAN, Glass L, Hausdorff JM, Ivanov PCh, Mark RG, Mietus JE, Moody GB, Peng C-K, Stanley HE. PhysioBank, PhysioToolkit, and Physionet: Components of a New Research Resource for Complex Physiologic Signals. Circulation 101(23):e215-e220 [Circulation Electronic Pages; http://circ.ahajournals.org/cgi/content/full/101/23/e215]; 2000 (June 13). |
In the USA, the HIPAA Privacy Rule restricts exchange of medical data containing protected health information (PHI), defined as any information that might be used to identify the individual(s) from whom the data were collected. Data known to contain PHI can be shared for research purposes only under tightly controlled circumstances, typically involving data use agreements under which the researchers involved must obtain IRB or equivalent approvals for use of the data.
By contrast, medical data that do not contain PHI are exempt from the restrictions of the HIPAA Privacy Rule and may be shared freely. The data available on PhysioNet fall into this category.
Many of the research data sets currently being collected by PhysioNet are accompanied by PHI, and the process of removing this PHI ("de-identification" in the language of HIPAA, or "anonymization") is tedious and error-prone. For many research projects, the cost of de-identification is a significant barrier to data sharing.
The MIMIC II project has invested several years' effort to develop and evaluate software that is capable of removing PHI from text and, where appropriate, replacing it by realistic surrogate PHI. (For example, names are replaced by fictitious names, medical record numbers by fictitious medical record numbers, dates by fictitious dates, geographic locations by other geographic locations, etc.) The MIMIC II project has contributed to PhysioNet both its deidentification software, which may be useful to other researchers needing to remove PHI from their own data, and a large corpus of text drawn from ICU nursing notes that were gathered simultaneously with the signals, trends, laboratory reports, discharge summaries and other data in the MIMIC II database.
As is the case with all software available on PhysioNet, the de-identification software (deid) is provided in source form so that its workings can be studied, customized, and improved. This software is free software. You can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 2 of the License, or (at your option) any later version.
The deid software package was developed and tested using perl 5.8.8 on GNU/Linux (Fedora Core 6). It has also been tested on Fedora 7 and 8, and on MS-Windows XP, and should be usable on any platform for which perl version 5 or later is available.
The authors of the deid software package are Margaret M Douglass, Li-wei H Lehman, William J Long, and Ishna Neamatullah. An experimental prototype by Jason M Levine provided useful guidance in the design of deid.
The deid software package can be downloaded as a single file, deid.tar.gz. (Instructions on unpacking tar.gz files are here.) The contents of deid.tar.gz unpack into a directory named deid, which contains the files listed below. These files can also be viewed or downloaded individually by following the links below.
Except for functions related to calculating performance statistics (in stats.pm), the deidentification code is contained in a perl script, (deid.pl). Its configuration file, deid.config, can be used to set parameters of the deidentification process at run time. Associated word and phrase lists are in lists/ (containing possible PHI) and dict/ (containing probable non-PHI).
The shift.txt file contains a randomly assigned date shift (between 1000 and 3000 days) for each patient in the gold standard corpus. If the date shift filter is on, the dates will be shifted by the specified number of days. The date shifts in shift.txt are randomly generated for this public release, and are different than what is used internally to re-identify our medical notes. The per-patient date shifts used in re-identifying dates in our medical notes are generated to preserve the day of the week or season information in the medical notes.
The file id-phi.phrase is provided as a convenient index to the PHI in the gold standard corpus; it is not used by the deid software. Each line of this file contains 6 fields: PID, Record_Number, PHI_Start_Location, PHI_End_Location, PHI_Type, and PHI_Text.
The file id.deid also contains PHI locations in the gold standard corpus, and it is used as a reference for calculating performance statistics by the functions in stats.pm. It contains two types of lines. The first type is of the form
Patient PID Note Record_Number
and the second type is of the form
PHI_Start_Location PHI_Start_Location PHI_End_Location
The deid software package is command-line (text mode) software that must be run in a terminal emulator (console) window. Download deid.tar.gz and unpack it (see instructions here).
If you wish to test deid, follow this link to download the gold standard corpus, which is a text file named id.text. Copy id.text into the deid directory (created when deid.tar.gz was unpacked in the previous step), and enter that directory. Type the command
perl deid.pl id deid.config
The software will print a greeting message:
*******************************************************************************************************************
De-Identification Algorithm: Identifies Protected Health Information (PHI) in Discharge Summaries and Nursing Notes
*******************************************************************************************************************
Starting de-identification...
Running deid in output mode. Output files will be:
id.phi: the PHI locations found by the code.
id.res: the scrubbed text.
id.info: debug info about the PHI locations.
On a typical current PC, the process will run to completion in approximately 10 to 20 minutes. The three output files will be written into the current directory; they should be identical to the files of the same names that are included in the GSoutput directory.
The program runStat.pl can be used to derive performance statistics by comparing the id.phi file generated by deid.pl with the reference id.deid file provided with the deid software package. To do this, type the command
perl runStat.pl id.deid id.phi
which should produce the output
==========================
Num of true positives = 1720
Num of false positives = 545
Num of false negatives = 59
Sensitivity/Recall = 0.967
PPV/Specificity = 0.749
==========================
To use the gold standard corpus to test the performance of another
deidentifier, arrange for that deidentifier to produce a file in the
format of id.phi, then use runStat.pl as above.
Examine the configuration file, deid.config, to see how to modify the behavior of deid.pl. For additional information, see the user manual.
In order to customize this software to de-identify free text in other medical records, you may replace our filter modules with your data-specific filters. Additionally, at a minimum, you will have to replace the six files in lists that contain a priori information (see above).
Depending on the text you wish to de-identify, you may wish to re-classify names as ambiguous or not. For example, "Mae" is an unambiguous name in most contexts, but in nursing and discharge notes, it may be an acronym (meaning "moving all extremities") and it is therefore ambiguous in those contexts.
Evaluating software for de-identification turns out to be quite difficult. As in many of the projects contributing to PhysioNet, a reference database is highly useful. Ideally the developer of de-identification software needs an appropriate corpus of text in which all of the PHI has been labelled, so that the software's PHI detection performance can be assessed quickly and quantitatively. To compare different approaches to PHI removal objectively, we need a standard corpus. And here's the dilemma: we can't share such a corpus if it has any PHI in it!
The deid software package was developed and tested using a gold standard corpus of 2,434 nursing notes that have been thoroughly deidentified by a multi-pass process that included meticulous reviews by three or more experts working independently, as well as by a variety of automated methods. All detected instances of PHI in these nursing notes have been replaced by realistic surrogate data in the gold standard corpus. Although the deid software, as noted above, may be redistributed under the terms of the GPL, the gold standard corpus, because of the very small possibility that it may contain one or more instances of undetected PHI, is currently available only under terms that do not permit it to be redistributed. This corpus is available only under the following conditions:
To download the corpus, follow this link.
This work was performed with support from the National Institute of Biomedical Imaging and Bioengineering (NIBIB), under grant R01 EB001659.
Li-wei H Lehman (lilehman AT alum DOT mit DOT edu)
Gari D Clifford (gari AT mit DOT edu)
| Send feedback about this page to PhysioNet |
|
Your comments and suggestions are welcome. We encourage you to use our feedback form to comment on this page. If you would like to receive a reply, please send your comments by email to webmaster@physionet.org, or post them to: MIT Room E25-505A 77 Massachusetts Avenue Cambridge, MA 02139 USA |
 |
Updated Wednesday, 19-Dec-2007 21:57:45 EST