Privacy & Confidentiality in Data Disclosure: Balancing Integrity & Protection

1. Privacy & Confidentiality Presentation by Peter Thomson For the APS Statistical Network 30th October 2002 Privacy & Confidentiality

2. Scene Setting • Vision - Improve Australia’s Health through payments and information • 2001-02 - $7.8 B program expenditure on Medicare (MDC) • 2001-02 - $ 4.6 B program expenditure on PBS/RPBS • 2001-02 - More than 220 million MDC services were processed • 2001-02 - More than 160 million PBS/RPBS services were processed • Enrolment population for Medicare is approximately 21 million • More than 50,000 providers registered for MDC • Other Programs Administered - Childhood Immunisation Register, Organ Donor Register, Practice Incentives Register, 30% Rebate on Private Health Insurance, DVA Treatment Accounts • Good source is www.hic.gov.au Privacy & Confidentiality

3. People Can Trust Us to Protect the Privacy of All Information We Handle • At HIC we protect the privacy and confidentiality of all personal information • Respect our customers and always provide high quality service Privacy & Confidentiality

4. Business Challenge (Case Study) • Develop an information product that enables providers to analyse service activity by: • Division of General Practice (121 geographical) • Period (quarter, annual) • Category, Group, Sub Group and Item • Various counts - number of services, number of patients, number of providers and dollars Privacy & Confidentiality

5. Amount of Data • The DGP site contains • Millions of cells of data • Many cells contain small numbers • Some of these involved less than 4 providers or less than 6 patients Privacy & Confidentiality

6. Business Problem/Constraint • Concern that some people could be identified (local knowledge, combining various data sources) • HIC prides itself on appropriate release of information (personal information should not be released) • Must aim for a reasonable degree of protection against disclosure of precise information Privacy & Confidentiality

7. What Options Were Considered • Cell Suppression • Random Rounding • Random Perturbation • Dominance Rule • No Disclosure Avoidance Privacy & Confidentiality

8. Evaluate Impact of Disclosure Methods on Data • What are the Issues to Consider? • Impact on data • Amount of data that can be released • Degree of change in absolute data • Impact on longitudinal trends • How easy is it to automate • Impact on data extraction time, reporting time & cost Privacy & Confidentiality

9. Evaluate Impact of Disclosure Methods on Data (cont.) • What are the Issues to Consider? • How easy is it to automate checking of data in final reports • Pros & cons of each method • Feedback from stakeholders Privacy & Confidentiality

10. Cell Suppression • Cell replaced by an asterisk or symbol • Useful when accuracy in figures and consistency between tables is necessary • Good when only a few cells need suppression • Leads to wastage of information because of consequential suppression • Less easy to automate (especially if there are dependent tables) Privacy & Confidentiality

11. Random Rounding • Each figure is rounded up or down to an integer (ie multiple of 5) • Rounding up or down random based • A particular cell value may vary from table to table • Can lead to inconsistency in figures between tables • Totals can be based on raw or random figures • A cell threshold can be applied meaning rounding is applied only to some cells • Useful if many cells are below the threshold as this allows release of those cells • Inconsistencies can be handled by a disclaimer Privacy & Confidentiality

12. Random Perturbation • Introducing random noise/error to the data • Random amount of error is added to each cell • Better method for longitudinal data as it allows more subtle changes • Inconsistencies can be handled by a disclaimer • Disadvantage for HIC is that a small increase over time may appear as a large decrease Privacy & Confidentiality

13. Dominance Rule • Cells are suppressed if a certain percentage of activity is provided by a few individuals • ie say we had a 60/80 rule • Cell suppressed if 60% or more activity was provided by 1 doctor or • Cell suppressed if 80% or more activity was provided by 2 doctors • Suppressed cells set to zero • Do totals include the value of suppressed cells or not Privacy & Confidentiality

14. No Disclosure Avoidance • No privacy constraints • This maintains the integrity of the data • Does not reduce the risk that individuals will be identified • Will have significant legal and customer impact Privacy & Confidentiality

15. Summary • Disclosure avoidance is a very sensitive issue • Privacy of HIC customers’ records is of the upmost importance to HIC • All options either compromise the integrity of the data or have a degree of risk • Challenge - to find the right balance between respecting and maintaining the privacy of data versus the benefit of releasing low level data • Need to appreciate appreciate the complexity and sensitivity of each business issue & consider which technique is appropriate • Over time it may be necessary to use a different technique for the same business issue Privacy & Confidentiality

16. Questions • What are the experiences of other agencies • What entities need to be protected (ie patients, providers, practices, companies, etc.) • ?????? Privacy & Confidentiality