Embracing Differential Privacy for Anonymizing Spontaneous ADE Reporting Data.

Spontaneous ADE (Adverse Drug Event) reporting system, a widely established system for collecting adverse event of drug reaction, is a kind of medical data repository containing personal information, such as sex, age, weight, disease and drug information. These data have to be anonymized to protect patient’s privacy before being released to the professionals for analysis. We previously have proposed a privacy model MS(k, $\\theta^{\\ast}$)-bounding for ADE reporting data, a kind of syntactic anonymity model. One of its weakness is the requirement of background knowledge available to the attacker. This model becomes awkward when full knowledge of the background information held by the attacker is impossible. Differential privacy is an emerging anonymization technique with rigorous theoretical foundation and recognized as a replacement of syntactic anonymity models. It can provide effective privacy protection without considering background knowledge available to the attacker at the cost of causing serious data distortion. This makes its hardly applicable to anonymize medical data. This research endeavored to fuse both advantages of syntactic anonymity and differential privacy. We combine MS(k, $\\theta^{\\ast}$)-bounding with differential privacy, proposing a new privacy framework MSDP(k, $\\theta^{\\ast}$, $\\varepsilon$)-bounding and the corresponding anonymization algorithm. Empirical evaluation on the FAERS data show that in comparison with MS-bounding and two contemporary differential privacy methods, our proposed method achieves better trade-off between protecting personal privacy and reducing data distortion, while maintaining the same level of strength of the ADR signal as done by MS-bounding.