|
|
- Annabella Woods
- 2 years ago
- Views:
Transcription
1 ProtectingPrivacywhenDisclosingInformation:k-Anonymity anditsenforcementthroughgeneralizationandsuppression ComputerScienceLaboratory MenloPark,CA94025,USA PierangelaSamaratiy SRIInternational MassachusettsInstituteofTechnology LaboratoryforComputerScience Cambridge,MA02139,USA LatanyaSweeney Today'sgloballynetworkedsocietyplacesgreatdemandonthedisseminationandsharingofperson-specic data.situationswhereaggregatestatisticalinformationwasoncethereportingnormnowrelyheavilyonthe transferofmicroscopicallydetailedtransactionandencounterinformation.thishappensatatimewhen Abstract asangerprint,evenwhenthesourcesoftheinformationcontainsnoexplicitidentiers,suchasname together,theyprovideanelectronicshadowofapersonororganizationthatisasidentifyingandpersonal moreandmorehistoricallypublicinformationisalsoelectronicallyavailable.whenthesedataarelinked otherdistinctivedata,whichwetermquasi-identiers,oftencombineuniquelyandcanbelinkedtopublicly andphonenumber.inordertoprotecttheanonymityofindividualstowhomreleaseddatarefer,data holdersoftenremoveorencryptexplicitidentierssuchasnames,addressesandphonenumbers.however, availableinformationtore-identifyindividuals. usinggeneralizationandsuppressiontechniques.weintroducetheconceptofminimalgeneralization,which ambiguouslymaptheinformationtoatleastkentities.weillustratehowk-anonymitycanbeprovidedby theanonymityoftheindividualstowhomthedatarefer.theapproachisbasedonthedenitionofkanonymity.atableprovidesk-anonymityifattemptstolinkexplicitlyidentifyinginformationtoitscontents Inthispaperweaddresstheproblemofreleasingperson-specicdatawhile,atthesametime,safeguarding capturesthepropertyofthereleaseprocessnottodistortthedatamorethanneededtoachievek-anonymity. releasesofrealmedicalinformation.wealsoreportonthequalityofthereleaseddatabymeasuringthe Weillustratepossiblepreferencepoliciestochooseamongdierentminimalgeneralizations.Finally,we presentanalgorithmandexperimentalresultswhenanimplementationofthealgorithmwasusedtoproduce precisionandcompletenessoftheresultsfordierentvaluesofk. bymedicalinformaticstraininggrantit15lm07092fromthenationallibraryofmedicine. andbythenationalsciencefoundationundergrantecs theworkoflatanyasweeneywassupported TheworkofPierangelaSamaratiwassupportedinpartDARPA/RomeLaboratoryundergrantF C-0337 yonleavefromuniversitadimilano. 1
2 forinformation,allkindsofinformationformanynewandoftenexcitinguses.mostactionsindailylife 1IntheageoftheInternetandinexpensivecomputingpower,societyhasdevelopedaninsatiableappetite arerecordedonsomecomputersomewhere.thatinformationinturnisoftenshared,exchanged,andsold. Introduction Manypeoplemaynotcarethatthelocalgrocerkeepstrackofwhichitemstheypurchase,butshared informationcanbequitesensitiveordamagingtoindividualsandorganizations.improperdisclosureof medicalinformation,nancialinformationormattersofnationalsecuritycanhavealarmingramications, andmanyabuseshavebeencited[2,23].theobjectiveistoreleaseinformationfreelybuttodosoinaway thattheidentityofanyindividualcontainedinthedatacannotberecognized.inthisway,informationcan besharedfreelyandusedformanynewpurposes. andphonenumber,fromdatasothatotherinformationinthedatacanbeshared,incorrectlybelieving thattheidentitiesofindividualscannotbedetermined.onthecontrary,de-identifyingdataprovidesno Dataholders,includinggovernmentagencies,oftenremoveallexplicitidentiers,suchasname,address, guaranteeofanonymity[18].releasedinformationoftencontainsotherdata,suchasbirthdate,gender, Shockingly,thereremainsacommonincorrectbeliefthatifthedatalooksanonymous,itisanonymous. andzipcode,thatincombinationcanbelinkedtopubliclyavailableinformationtore-identifyindividuals. Mostmunicipalitiessellpopulationregistersthatincludetheidentitiesofindividualsalongwithbasicdemographics;examplesincludelocalcensusdata,voterlists,citydirectories,andinformationfrommotorvehicle uniquebirthdates,29%wereuniquewithrespecttobirthdateandgender,69%withrespecttobirthdate anda5-digitzipcode,and,97%wereidentiablewithjustthefullpostalcodeandbirthdate[18].these agencies,taxassessors,andrealestateagencies.forexample,anelectronicversionofacity'svoterlistwas namesandaddresses,thevoterlistincludedthebirthdatesandgendersof54,805voters.ofthese,12%had ofbirth,ethnicity,genderandmartialstatus,canbe. resultsrevealhowuniquelyidentifyingcombinationsofbasicdemographicattributes,suchaszipcode,date purchasedfortwentydollarsandusedtoshowtheeaseofre-identifyingmedicalrecords[18].inadditionto MaritalStatusgcanalsoappearinsomeexternaltablejointlywiththeindividualidentity,andcanthereforeallowittobetracked.AsillustratedinFigure1,ZIP,DateOfBirth,andSexcanbelinkedtothingnamesandSocialSecurityNumbers(SSNs)soasnottodisclosetheidentitiesofindividualstowhom thedatarefer.however,valuesofotherreleasedattributes,suchasfzip,dateofbirth,ethnicity,sex, Toillustratethisproblem,Figure1exempliesatableofreleasedmedicaldatade-identiedbysuppress- tootherpubliclyavailablepopulationregisters.inthemedicaldatatableoffigure1,thereisonlyone VoterListtorevealtheName,Address,andCity.Likewise,EthnicityandMaritalStatuscanbelinked female,bornon9/15/61andlivinginthe02142area.fromtheuniquenessresultsmentionedpreviously regardinganactualvoterlist,morethan69%ofthe54,805voterscouldbeuniquelyidentiedusingjust theseattributes.thiscombinationuniquelyidentiesthecorrespondingbulletedtupleinthereleaseddata determinewhichmedicaldataamongthosereleasedarehers.)whilethisexampledemonstratedanexact individuals,andthedesiredprotectionistoreleasethemedicalinformationsuchthattheidentitiesofthe individualscannotbedetermined.however,theofthereleasedcharacteristicsforsuej.carlsonleadsto shortnessofbreath.(noticethemedicalinformationisnotassumedtobepubliclyassociatedwiththe aspertainingto\suej.carlson,1459mainstreet,cambridge"andthereforerevealsshehasreported match,insomecases,releasedinformationcanbelinkedtoarestrictivesetofindividualstowhomthe releasedinformationcouldrefer. blingandswappingvaluesandaddingnoisetothedatainsuchawayastomaintainanoverallstatistical propertyoftheresult[1,21].however,manynewusesofdata,includingdatamining,costanalysisand systemshavebeenreleasedwhichusesuppressionandgeneralizationastechniquestoprovidedisclosurecon- retrospectiveresearch,oftenneedaccurateinformationwithinthetupleitself.twoindependentlydeveloped Severalprotectiontechniqueshavebeendevelopedwithrespecttostatisticaldatabases,suchasscram- 2
3 SSNNameEthnicityDateOfBirthSex asian MedicalDataReleasedasAnonymous 09/27/64 09/30/64 04/18/64 04/15/64 03/13/63 female02139divorced ZIP 02139married MaritalStatusProblem chestpain black 03/18/63 09/13/64 09/07/64 05/14/61 05/08/61 female02141married 02138married 02138single hypertension chestpain Name white Address09/15/61CityVoterList female02142widow ZIP DOB Sex Party obesity shortnessofbreath SueJ.Carlson1459MainSt.Cambridge021429/15/61femaledemocrat Figure1:Re-identifyinganonymousdatabylinkingtoexternaldata trolwhilemaintainingtheintegrityofthevalueswithineachtuple-namelydatayintheunitedstates[17] andmu-argus[11]ineurope.however,noformalfoundationsorabstractionhavebeenprovidedforthe techniquesemployedbyboth.furtherapproximationsmadebythesystemscansuerfromdrawbacks,such asgeneralizingdatamorethanisneeded,like[17],ornotprovidingadequateprotection,like[11]. applicationofgeneralizationandsuppressiontowardsitssolution.weintroducethedenitionofquasiidentiersasattributesthatcanbeexploitedforlinking,andofk-anonymityascharacterizingthedegree Inthispaperweprovideaformalfoundationfortheanonymityproblemagainstlinkingandforthe ininformationreleasesbygeneralizingand/orsuppressingpartofthedatatobedisclosed.withinthis ofprotectionofdatawithrespecttoinferencebylinking.weshowhowk-anonymitycanbeensured presentanalgorithmtocomputeapreferredminimalgeneralizationofagiventable.finally,wediscuss framework,weintroducetheconceptsofgeneralizedtableandofminimalgeneralization.intuitively,a thedenitionofpreferredgeneralizationallowstheusertoselect,amongpossibleminimalgeneralizations, someexperimentalresultsderivedfromtheapplicationofourapproachtoamedicaldatabasecontaining thosethatsatisfyparticularconditions,suchasfavoringcertainattributesinthegeneralizationprocess.we generalizationisminimalifdataarenotgeneralizedmorethannecessarytoprovidek-anonymity.also, informationon265patients. 4,8,9,12,22]problems.Accesscontrolsystemsaddresstheproblemofcontrollingspecicaccesstodata withrespecttorulesstatingwhetherapieceofdatacanorcannotbereleased.inourworkitisnotthe ratherthefactthatthedatareferstoaparticularentity.statisticaldatabasetechniquesaddresstheproblem disclosureofthespecicpieceofdatatobeprotected(i.e.,onwhichanaccessdecisioncanbetaken),but Theproblemweconsiderdiersfromthetraditionalaccesscontrol[3]andfromstatisticaldatabase[1, insuchaframeworkbyensuringthatitisnotpossibleforuserstoinferoriginalindividualdatafromthe ofproducingtabulardatarepresentingasummaryoftheinformationtobequeried.protectionisenforced producedsummary.inourapproach,instead,weallowthereleaseofgeneralizedperson-specicdataon whichuserscanproducesummariesaccordingtotheirneeds.theadvantagewithrespecttoprecomputed andavailabilityhasasadrawback,fromtheend-userstandpoint,acoarsegranularitylevelofthedata. release-specicstatisticsisanincreasedexibilityandavailabilityofinformationfortheusers.thisexibility Thisnewtypeofdeclassicationandreleaseofinformationseemstoberequiredmoreandmoreintoday's emergingapplications[18]. Theremainderofthispaperisorganizedasfollows.InSection2weintroducebasicassumptionsand 3
4 denitions.insection3wediscussgeneralizationtoprovideanonymity,andinsection4wecontinuethe discussiontoincludesuppression.insection5basicpreferencepoliciesforchoosingamongdierentminimal generalizationsareillustrated.insection6wediscussanalgorithmicimplementationofourapproach. Section7reportssomeexperimentalresults.Section8concludesthepaper. Weconsiderthedataholder'stabletobeaprivatetablePTwhereeachtuplereferstoadierententity 2(individual,organization,andsoon).FromtheprivatetablePT,thedataholderconstructsatablewhichis tobeananonymousreleaseofpt.forthesakeofsimplicity,wewillsubsequentlyrefertotheprivacyandreidenticationofindividualsincasesequallyapplicabletootherentities.weassumethatallexplicitidentiers (e.g.,names,ssns,andaddresses)areeitherencryptedorsuppressed,andwethereforeignoretheminthe remainderofthispaper.borrowingtheterminologyfrom[6],wecallthecombinationofcharacteristicson whichlinkingcanbeenforcedquasi-identiers.quasi-identiersmustthereforebeprotected.theyare denedasfollows. Denition2.1(Quasi-identier)LetT(A1;:::;An)beatable.Aquasi-identierofTisasetofattributesfAi;:::;AjgfA1;:::;Angwhosereleasemustbecontrolled. maintainingduplicatetuples,ofattributesai;:::;ajint.also,qitdenotesthesetofquasi-identiers t[ai;:::;aj]denotesthesequenceofthevaluesofai;:::;ajint,t(ai;:::;aj)denotestheprojection, associatedwitht,andjtjdenotescardinality,thatis,thenumberoftuplesint. GivenatableT(A1;:::;An),asubsetofattributesfAi;:::;AjgfA1;:::;Ang,andatuplet2T, Assumptionsandpreliminarydenitions Theanonymityconstraintrequiresreleasedinformationtoindistinctlyrelatetoatleastagivennumberkof individuals,wherekistypicallysetbythedataholder,asstatedbythefollowingrequirement. Denition2.2(k-anonymityrequirement)Eachreleaseofdatamustbesuchthateverycombination Ourgoalistoallowthereleaseofinformationinthetablewhileensuringtheanonymityoftheindividuals. obviouslyanimpossibletaskforthedataholder.althoughwecanassumethatthedataholderknows matches.thiscanbedonebyexplicitlylinkingthereleaseddatawithexternallyavailabledata.thisis ofvaluesofquasi-identierscanbeindistinctlymatchedtoatleastkindividuals. valuesofdatainexternalknowledgecannotbeassumed.thekeytosatisfyingthek-anonymityrequirement, whichattributesmayappearinexternaltables,andthereforewhatconstitutesquasi-identiers,thespecic Adherencetotheanonymityrequirementnecessitatesknowinghowmanyindividualseachreleasedtuple therefore,istotranslatetherequirementintermsofthereleaseddatathemselves.inordertodothat,we Assumption2.1AllattributesintablePTwhicharetobereleasedandwhichareexternallyavailablein requirethefollowingassumptiontohold. combination(i.e.,appearingtogetherinanexternaltableorinpossiblejoinsbetweenexternaltables)1toa datarecipientaredenedinaquasi-dentierassociatedwithpt. attributesmightbeusedtolinkwithoutsideknowledge;thisofcourseformsthebasisforaquasi-identier. Whiletheexpectationofthisknowledgeissomewhatreasonableforpubliclyavailabledata,werecognizethat therearefartoomanysourcesofsemipublicandprivateinformationsuchaspharmacyrecords,longitudinal Althoughthisisnotatrivialassumptionitsenforcementispossible.Thedataholderestimateswhich 1Auniversalrelationcombiningexternaltablescanbeimagined[20]. 4
5 studies,nancialrecords,surveyresponses,occupationallists,andmembershiplists,toaccountapriorifor alllinkingpossibilities[18].supposethechoiceofattributesforaquasi-identierisincorrect;thatis,the dataholdermisjudgeswhichattributesaresensitiveforlinking.inthiscase,thereleaseddatamaybeless anonymousthanwhatwasrequired,andasaresult,individualsmaybemoreeasilyidentied.sweeney[18] examinesthisriskandshowsthatitcannotbeperfectlyresolvedbythedataholdersincethedataholder andcontracts.intheremainderofthiswork,weassumethatproperquasi-identiershavebeenrecognized. cannotalwaysknowwhateachrecipientofthedataknows.[18]posessolutionsthatresideinpolicies,laws, Denition2.3(k-anonymity)LetT(A1;:::;An)beatableandQITbethequasi-identiersassociated withit.tissaidtosatisfyk-anonymityiforeachquasi-identierqi2qiteachsequenceofvaluesin T[QI]appearsatleastwithkoccurrencesinT[QI]. Weintroducethedenitionofk-anonymityforatableasfollows. tupleforeachidentitytobeprotected(i.e.,towhomaquasi-identierrefers),k-anonymityofareleased atablesatisfyingdenition2.3foragiven,ksatisesthek-anonymityrequirementforsuchak.consider tablerepresentsasucientconditionforthesatisfactionofthek-anonymityrequirement.inotherwords, aquasi-identierqi;ifdenition2.3issatised,eachtupleinpt[qi]hasatleastkoccurrences.since UnderAssumption2.1,andunderthehypothesisthattheprivatelystoredtablecontainsatmostone thepopulationoftheprivatetableisasubsetofthepopulationoftheoutsideworld,therewillbeatleast kindividualsintheoutsideworldmatchingthesevalues.also,sinceallattributesavailableoutsidein suchaset.(notealsothatanysubsetoftheattributesinqiwillrefertok0>kindividuals.)toillustrate, considerthesituationexempliedinfigure1butassumethatthereleaseddatacontainedtwooccurrences combinationareincludedinqi,noadditionalattributescanbejointtoqitoreducethecardinalityof ofthesequencewhite,09/15/64,female,02142,widow.thenatleasttwoindividualsmatchingsuch occurrenceswillexistinthevoterlist(orinthetablecombiningthevoterlistwithallotherexternaltables), providedintherelease,eachmedicalrecordcouldindistinctlybelongtoatleasttwoindividuals. withthesevaluesofthequasi-identierbelongtowhichofthetwoindividuals.sincek-anonymityof2was anditwillnotbepossibleforthedatarecipienttodeterminewhichofthetwomedicalrecordsassociated 3theproblemofproducingaversionofPTwhichsatisesk-anonymity. Giventheassumptionanddenitionsabove,andgivenaprivatetablePTtobereleased,wefocuson Ourrstapproachtoprovidingk-anonymityisbasedonthedenitionanduseofgeneralizationrelationships betweendomainsandbetweenvaluesthatattributescanassume. Generalizingdata Inaclassicalrelationaldatabasesystem,domainsareusedtodescribethesetofvaluesthatattributes 3.1Generalizationrelationships assume.forexample,theremightbeazipcodedomain,anumberdomain,andastringdomain.we extendthisnotionofadomaintomakeiteasiertodescribehowtogeneralizethevaluesofanattribute.in theoriginaldatabase,whereeveryvalueisasspecicaspossible,everyattributeisinthegrounddomain. usedtodescribezipcodes,z1,inwhichthelastdigithasbeenreplacedbya0.thereisalsoamappingfrom Forexample,02139isinthegroundZIPcodedomain,Z0.Toachievek-anonymity,wecanmaketheZIP codelessinformative.wedothisbysayingthatthereisamoregeneral,lessspecic,domainthatcanbe Z0toZ1,suchas02139!02130.Thismappingbetweendomainsisstatedbymeansofageneralization relationship,whichrepresentsapartialorderdonthesetdomofdomains,andwhichisrequiredto satisfythefollowingconditions:(1)eachdomaindihasatmostonedirectgeneralizeddomain,and(2)all 5
6 Z2=f02100g Z1=f02130;02140g Z0=f02138;20239;02141;02142g 6DGHZ * 02139HYHH E0=fasian;black;caucasiang E1=fpersong 6DGHE0 asian * VGHE0 person black HY6HH M2=fnotreleasedg caucasian H M1=foncemarried;nevermarriedg M0=fmarried;divorced;widow;singleg 6DGHM0 oncemarriednotreleased marrieddivorcedwidow 36Q * QkQ HYHH VGHM0nevermarried Hsingle 6 E1=fnotreleasedg E0=fmale;femaleg 6DGHG0 notreleased Figure2:Examplesofdomainandvaluegeneralizationhierarchies female generalizedvaluescanbeusedinplaceofmorespecicones,itisimportantthatalldomainsinahierarchy maximalelementsofdomaresingleton.2thedenitionofthisgeneralizationimpliestheexistence,foreach domaind2dom,ofahierarchy,whichwetermthedomaingeneralizationhierarchydghd.since becompatible.compatibilitycanbeensuredbyusingthesamestoragerepresentationformforalldomains inageneralizationhierarchy.avaluegeneralizationrelationship,partialorderv,isalsodenedwhich associateswitheachvalueviinadomaindiauniquevalueindomaindjdirectgeneralizationofdi.such Example3.1Figure2illustratesanexampleofdomainandvaluegeneralizationhierarchiesfordomain arelationshipimpliestheexistence,foreachdomaind,ofavaluegeneralizationhierarchyvghd. Z0representingzip-codesoftheCambridge,MA,area,E0representingethnicities,M0representingmarital impliedgeneralizationrelationshipsdonotappearasarcsinthegraph).wewillusethetermhierarchy status,andg0representinggender. ofthegraphrepresentingallandonlythedirectgeneralizationrelationshipsbetweentheelementsinit(i.e., generalizationrelationshipsbetweenitselements.wewillexplicitlyrefertotheorderedsetortothegraph interchangeablytodenoteeitherapartiallyorderedsetorthegraphrepresentingthesetandallthedirect Intheremainderofthispaperwewilloftenrefertoadomainorvaluegeneralizationhierarchyinterms andhierarchiesintermsoftuplescomposedofelementsofdomoroftheirvalues.givenatupledt= whenitisnototherwiseclearfromcontext. hd1;:::;dnisuchthatdi2dom;i=1;:::;n,wedenethedomaingeneralizationhierarchyofdtas DGHDT=DGHD1:::DGHDn,assumingthattheCartesianproductisorderedbyimposingcoordinatewiseorder[7].DGHDTdenesalatticewhoseminimalelementisDT.Thegeneralizationhierarchyof Also,sincewewillbedealingwithsetsofattributes,itisusefultovisualizethegeneralizationrelationship fromdttotheuniquemaximalelementofdghdtinthegraphdescribingdghdtdenesapossible alternativepaththatcanbefollowedinthegeneralizationprocess.werefertothesetofnodesineachof adomaintupledtdenesthedierentwaysinwhichdtcanbegeneralized.inparticular,eachpath suchpathstogetherwiththegeneralizationrelationshipsbetweenthemasageneralizationstrategyfor singlevalue. DGHDT.Figure3illustratesthedomaingeneralizationhierarchyDGHE0;Z0wherethedomaingeneralization hierarchiesofe0andz0areasillustratedinfigure2. 2Themotivationbehindcondition2istoensurethatallvaluesineachdomaincanbeeventuallygeneralizedtoa 6
7 he1;z1i he0;z2i he0;z0i he0;z1i 6 he1;z2i he1;z1i he1;z2i DGH DT he1;z0i he0;z0i 6GS1 he1;z1i he1;z2i he0;z1i he0;z0i GS2 6 he0;z2i he0;z1i he0;z0i GS3 6 Eth:E0ZIP:Z0 Figure3:DomaingeneralizationhierarchyDGHDTandstrategiesforDT=hE0;Z0i asian Eth:E1ZIP:Z0 black whitept Eth:E1ZIP:Z1 person02138 person02139 person02141 person02142 Eth:E0ZIP:Z2 GT[1;0] person02130 asian person02140 Eth:E0ZIP:Z1 GT[1;1] white black GT[0;2] asian black Figure4:ExamplesofgeneralizedtablesforPT white GT[0;1] generalizedvalues.sincemultiplevaluescanmaptoasinglegeneralizedvalue,generalizationmaydecrease inthetable.intuitively,attributevaluesstoredintheprivatetablecanbesubstituted,uponrelease,with GivenaprivatetablePT,ourrstapproachtoprovidek-anonymityconsistsofgeneralizingthevaluesstored 3.2Generalizedtableandminimalgeneralization thenumberofdistincttuples,therebypossiblyincreasingthesizeoftheclusterscontainingtupleswiththe AiintableT.Di=dom(Ai;PT)denotesthedomainassociatedwithattributeAiintheprivatetablePT. itsvalueswithcorrespondingvaluesfromamoregeneraldomain.generalizationattheattributelevel process,thedomainofanattributecanchange.inthefollowing,dom(ai;t)denotesthedomainofattribute ensuresthatallvaluesofanattributebelongtothesamedomain.however,asaresultofthegeneralization samevalues.weperformgeneralizationattheattributelevel.generalizinganattributemeanssubstituting Denition3.1(GeneralizedTable)LetTi(A1;:::;An)andTj(A1;:::;An)betwotablesdenedonthe samesetofattributes.tjissaidtobeageneralizationofti,writtentitj,i 1.jTij=jTjj 2.8z=1;:::;n:dom(Az;Ti)Ddom(Az;Tj) i(1)tiandtjhavethesamenumberoftuples,(2)thedomainofeachattributeintjisequaltoora 3.ItispossibletodeneabijectivemappingbetweenTiandTjthatassociateseachtuplestiandtjsuch Denition3.1statesthatatableTjisageneralizationofatableTi,denedonthesameattributes, thatti[az]vtj[az]. 7
8 he1;z1i he0;z2i he0;z0i he0;z1i 6 [1,1][1,2][0,2] he0;z0i intj(andviceversa)suchthatthevalueforeachattributeintjisequaltoorageneralizationofthevalue generalizationofthedomainoftheattributeinti,and(3)eachtupletiintihasacorrespondingtupletj Figure5:HierarchyDGHhE0;Z0iandcorrespondinglatticeondistancevectors chiesfore0andz0illustratedinfigure2.theremainingfourtablesinfigure4areallpossiblegeneralized Example3.2ConsiderthetablePTillustratedinFigure4andthedomainandvaluegeneralizationhierar- ofthecorrespondingattributeinti. k-anonymityfork=1;2;gt[1;0]satisesk-anonymityfork=1;2;3;gt[0;2]satisesk-anonymityfor tablesforpt,butthetopmostonegeneralizeseachtupletohperson;02100i.fortheclarityoftheexample, eachtablereportsthedomainforeachattributeinthetable.withrespecttok-anonymity,gt[0;1]satises equallysatisfactory.forinstance,thetrivialgeneralizationbringingeachattributetothehighestpossible k=1;:::;4,andgt[1;1]satisesk-anonymityfork=1;:::;6: levelofgeneralization,thuscollapsingalltuplesinttothesamelistofvalues,providesk-anonymityat thepriceofastronggeneralizationofthedata.suchextremegeneralizationisnotneededifamorespecic table(i.e.,containingmorespecicvalues)existswhichsatisesk-anonymity.thisconceptiscapturedby Givenatable,dierentpossiblegeneralizationsexist.Notallgeneralizations,however,canbeconsidered thedenitionofk-minimalgeneralization.tointroduceitwerstintroducethenotionofdistancevector. Example3.3ConsidertablePTanditsgeneralizedtablesillustratedinFigure4.Thedistancevectors ThedistancevectorofTjfromTiisthevectorDVi;j=[d1;:::;dn]whereeachdzisthelengthoftheunique pathbetweend=dom(az;ti)anddom(az;tj)inthedomaingeneralizationhierarchydghd. Denition3.2(Distancevector)LetTi(A1;:::;An)andTj(A1;:::;An)betwotablessuchthatTiTj. betweenptanditsdierentgeneralizationsarethevectorsappearingasasubscriptofeachtable. 1;:::;n;DV<DV0iDVDV0andDV6=DV0.Ageneralizationhierarchyforadomaintuplecanbeseen representingtherelationshipbetweenthedistancevectorscorrespondingtothepossiblegeneralizationof asahierarchy(lattice)onthecorrespondingdistancevectors.forinstance,figure5illustratesthelattice he0;z0i. GiventwodistancevectorsDV=[d1;:::;dn]andDV0=[d01;:::;d0n],DVDV0idid0iforalli= beak-minimalgeneralizationoftii Denition3.3(k-minimalgeneralization)LetTiandTjbetwotablessuchthatTiTj.Tjissaidto Wecannowintroducethedenitionofk-minimalgeneralization. 1.Tjsatisesk-anonymity 8
9 EthnDOB asian09/27/64female02139divorced asian09/30/64female02139divorced asian04/18/64male asian04/15/64male black03/13/63male black03/18/63male Sex ZIP 02139married 02138married Status black09/13/64female02141married black09/07/64female02141married white05/14/61male white05/08/61male white09/15/61female02142widow EthnDOBSexPT ZIP02138single asian64 black63 Status EthnDOB black64 white61 Sex ZIP Status GT[0;2;1;2;2] [60-65]female02130been notrel02100notrel [60-65]male 02130been Figure6:AnexampleoftablePTanditsminimalgeneralizations pers [60-65]female02140been GT[1;3;0;1;1] 02130never anonymitywhichisdominatedbytjinthedomaingeneralizationhierarchyofhd1;:::;dni(or,equivalently, inthecorrespondinglatticeofdistancevectors).ifthiswerethecasetjwoulditselfbeageneralizationfor 2.69Tz:TiTz;Tzsatisesk-anonymity,andDVi;z<DVi;j. Tz.Notealsothatatablecanbeaminimalgeneralizationofitselfifthetablealreadyachievedk-anonymity. Intuitively,ageneralizationTjisminimalitheredoesnotexistanothergeneralizationTzsatisfyingk- Example3.4ConsidertablePTanditsgeneralizedtablesillustratedinFigure4.AssumeQI=(Eth;ZIP) tobeaquasi-identier.itiseasytoseethatfork=2thereexisttwok-minimalgeneralizations,whichare GT[1;0]andGT[0;1].TableGT[0;2],whichsatisestheanonymityrequirements,isnotminimalsinceitisa generalizationofgt[0;1].analogouslygt[1;1]cannotbeminimal,beingageneralizationofbothgt[1;0]and GT[0;1].Therearealsoonlytwok-minimalgeneralizedtablesfork=3,whichareGT[1;0]andGT[0;2]. quasi-identiers,foreveryminimalgeneralizationtj,dvi;j[dz]=0forallattributesazwhichdonotbelong toanyquasi-identier. Notethatsincek-anonymityrequirestheexistenceofk-occurrencesforeachsequenceofvaluesonlyfor 4InSection3wediscussedhow,givenaprivatetablePT,ageneralizedtablecanbeproducedwhichreleases theadvantageofallowingreleaseofallthesingletuplesinthetable,althoughinamoregeneralform.here, amoregeneralversionofthedatainptandwhichsatisesak-anonymityconstraint.generalizationhas Suppressingdata Suppressionisusedto\moderate"thegeneralizationprocesswhenalimitednumberofoutliers(thatis, new[5,21].weapplysuppressionatthetuplelevel,thatis,atuplecanbesuppressedonlyinitsentirety. weillustrateacomplementaryapproachtoprovidingk-anonymity,whichissuppression.suppressingmeans toremovedatafromthetablesothattheyarenotreleasedandasadisclosurecontroltechniqueisnot 9
10 EthnDOB asian09/27/64female02139divorced asian09/30/64female02139divorced asian04/18/64male asian04/15/64male black03/13/63male black03/18/63male Sex ZIP 02139married 02138married Status EthnDOBSex black09/13/64female02141married black09/07/64female02141married ZIP Status white05/14/61male white05/08/61male female02139divorced 02138single asian64 black63 black64 female02141married 02138married 02139married Figure7:AnexampleoftablePTanditsminimalgeneralization white61gt[0;2;0;0;0] 02138single Eth:E0ZIP:Z0 white02138 black02138 black02141 black02142 asian PT Eth:E1ZIP:Z0 person02141 Eth:E0ZIP:Z1 GT[1;0] black02130 asian Eth:E0ZIP:Z2 white02130 GT[0;1] black asian Eth:E1ZIP:Z1 white02100 GT[0;2] Figure8:ExamplesofgeneralizedtablesforPT person02140 person02130 GT[1;1] tupleswithlessthatkoccurrences)wouldforceagreatamountofgeneralization.toclarify,considerthe andsupposek-anonymitywithk=2istobeprovided.attributedateofbirthhasadomaindatewith tableillustratedinfigure1,whoseprojectionontheconsideredquasi-identierisillustratedinfigure6 onmaritalstatus,andeitheronefurthersteponsex,zipcode,andmaritalstatus,or,alternatively, stepsofgeneralizationondateofbirth,onestepofgeneralizationonzipcode,onestepofgeneralization thefollowinggeneralizations:fromthespecicdate(mm/dd/yy)tothemonth(mm/yy)totheyear(yy)toa 5-yearinterval(e.g.,[60-64])toa10-yearinterval(e.g.,[60,69])toa25-yearintervalandsoon.3Itiseasy toseethatthepresenceofthelasttupleinthetablenecessitates,forthisrequirementtobesatised,two generalizationonattributedateofbirth,asillustratedinfigure7.suppressingthetuplewouldinthis time,thathadthislasttuplenotbeenpresentk-anonymitycouldhavebeensimplyachievedbytwostepsof casepermitenforcementoflessgeneralization. onethnicityanddateofbirth.thetwopossibleminimalgeneralizationsareasillustratedinfigure6. Inpractice,inbothcasesalmostalltheattributesmustbegeneralized.Itcanbeeasilyseen,atthesame Denition4.1(GeneralizedTable-withsuppression)LetTi(A1;:::;An)andTj(A1;:::;An)betwo statingthedenitionofgeneralizedtableasfollows. tablesdenedonthesamesetofattributes.tjissaidtobeageneralizationofti,writtentitj,i Inillustratinghowsuppressioninterplayswithgeneralizationtoprovidek-anonymity,webeginbyre- 1.jTjjjTij 2.8z=1;:::;n:dom(Az;Ti)Ddom(Az;Tj) usingthesamerepresentationform.forinstance,themonthcanberepresentedalwaysasaspecicday.thisis 3Notethatalthoughgeneralizationmayseemtochangetheformatofthedata,compatibilitycanbeassuredby 3.ItispossibletodeneaninjectivemappingbetweenTiandTjthatassociatestuplesti2Tiandtj2Tj actuallythetrickthatweusedinourapplicationofgeneralization. suchthatti[az]vtj[az]. 10
11 Eth:E0ZIP:Z0 black asian Eth:E1ZIP:Z0 whitept Eth:E0ZIP:Z1 person02142 person GT[1;0] black asian Eth:E0ZIP:Z2 GT[0;1] black asian Eth:E1ZIP:Z1 GT[0;2] Figure9:ExamplesofgeneralizedtablesforPT person02140 person02130 GT[1;1] correspondinggeneralizedtupleintj.intuitively,tuplesintinothavinganycorrespondentintjaretuples whichhavebeensuppressed. ThedenitionabovediersfromDenition3.1sinceitallowstuplesappearinginTinottohaveany Thisiscapturedbythefollowingdenition. intablesthatsuppressmoretuplesthannecessarytoachievek-anonymityatagivenlevelofgeneralization. Denition4.2(Minimalrequiredsuppression)LetTibeatableandTjageneralizationofTisatisfyingk-anonymity.Tjissaidtoenforceminimalrequiredsuppressioni69TzsuchthatTiTz;DVi;z= DVi;j;jTjj<jTzjandTzsatisesk-anonymity. boldfaceandmarkedwithdoublelinesineachtablearethetuplesthatmustbesuppressedtoachievek- anysupersetwouldbeunnecessary(notsatisfyingminimalrequiredsuppression). anonymityof2.suppressionofasubsetofthemwouldnotreachtherequiredanonymity.suppressionof Denition4.1allowsanyamountofsuppressioninageneralizedtable.Obviously,wearenotinterested Example4.1ConsiderthetablePTanditsgeneralizationsillustratedinFigure8.Thetupleswrittenin occurrences. straintbyenforcingminimalsuppressionisunique.thistableisobtainedbyrstapplyingthegeneralization describedbythedistancevectorandthenremovingallandonlythetuplesthatappearwithfewerthank prove,however,thatforeachpossibledistancevector,thegeneralizedtablesatisfyingak-anonymitycon- Allowingtuplestobesuppressedtypicallyaordsmoretablesperlevelofgeneralization.Itistrivialto generalizationsthatweconsiderenforceminimalrequiredsuppression.hence,inthefollowing,withinthe contextofak-anonymityconstraint,whenreferringtothegeneralizationatagivendistancevectorwewill intendtheuniquegeneralizationforthatdistancevectorwhichsatisesthek-anonymityconstraintenforcing minimalrequiredsuppression.toillustrate,considerthetableptinfigure8;withrespecttok-anonymity IntheremainderofthispaperweassumetheconditionstatedinDenition4.2tobesatised,thatis,all applied.forinstance,wehavealreadynoticedhow,withrespecttothetableinfigure1,generalization haveleftanemptyrowtocorrespondtoeachremovedtuple.) whichsatisesk-anonymity.itistrivialtonotethatthetwoapproachesproducethebestresultswhenjointly withk=2,wewouldrefertoitsgeneralizationsasillustratedinfigure9.(notethatforsakeofclarity,we tuplesinthetable.jointapplicationofthetwotechniquesallows,instead,thereleaseofatablelikethe aloneisunsatisfactory(seefigure6).suppressionalone,ontheotherside,wouldrequiresuppressionofall Generalizationandsuppressionaretwodierentapproachestoobtaining,fromagiventable,atable oneinfigure7.thequestionisthereforewhetheritisbettertogeneralize,atthecostoflessprecision acceptablethreshold,suppressionisconsideredpreferabletogeneralization(inotherwords,itisbetterto inthedata,ortosuppress,atthecostofcompleteness.fromobservationsofreal-lifeapplicationsand requirements[16],weassumethefollowing.weconsideranacceptablesuppressionthresholdmaxsup,as specied,statingthemaximumnumberofsuppressedtuplesthatisconsideredacceptable.withinthis 11
12 suppressmoretuplesthantoenforcemoregeneralization).thereasonforthisisthatsuppressionaects inthetable.tableswhichenforcesuppressionbeyondmaxsupareconsideredunacceptable. singletupleswhereasgeneralizationmodiesallvaluesassociatedwithanattribute,thusaectingalltuples Denition4.3(k-minimalgeneralization-withsuppression)LetTiandTjbetwotablessuchthat intoconsideration. TiTjandletMaxSupbethespeciedthresholdofacceptablesuppression.Tjissaidtobeak-minimal Giventheseassumptions,wecannowrestatethedenitionofk-minimalgeneralizationtakingsuppression generalizationofatabletii 1.Tjsatisesk-anonymity 2.jTij?jTjjMaxSup thanitisallowed,andtheredoesnotexistanothergeneralizationsatisfyingtheseconditionswithadistance vectorsmallerthanthatoftj,nordoesthereexistanothertablewiththesamelevelofgeneralization 3.69Tz:TiTz;Tzsatisesconditions1and2,andDVi;z<DVi;j. satisfyingtheseconditionswithlesssuppression. Intuitively,generalizationTjisk-minimaliitsatisesk-anonymity,itdoesnotenforcemoresuppression Example4.2ConsidertheprivatetablePTillustratedinFigure9andsupposek-anonymitywithk=2 illustratedinfigure9.dependingontheacceptablesuppressionthreshold,thefollowinggeneralizationsare isrequired.thepossiblegeneralizations(butthetopmostonecollapsingeverytupletohperson;02100i)are consideredminimal: MaxSup2:GT[1;0]andGT[0;1] becauseofgt[1;0]andgt[1;2]isnotminimalbecauseofgt[1;0]andgt[0;2]); MaxSup=1:GT[1;0]andGT[0;2](GT[0;1]suppressesmoretuplethanitisallowed,GT[1;1]isnotminimal MaxSup=0:GT[1;1] minimalbecauseofgt[1;1]); (GT[1;0];GT[0;1],orGT[0;2]suppressmoretuplethanitisallowed,GT[1;2]isnot 5minimalbecauseofGT[1;0]andGT[0;1]). Preferences (GT[0;2]isnotminimalbecauseofGT[0;1],GT[1;1]andGT[1;2]arenot solutionsistobepreferreddependsonsubjectivemeasuresandpreferencesofthedatarecipient.forinstance,dependingontheuseofthereleaseddata,itmaybepreferabletogeneralizesomeattributesinsteaanonymityisenforced.however,multiplesolutionsmayexistwhichsatisfythiscondition.whichofthe onlycapturestheconceptthattheleastamountofgeneralizationandsuppressionnecessarytoachieveksionthresholdandk-anonymityconstraint.thisiscompletelylegitimatesincethedenitionof\minimal" ItisclearfromSection4thattheremaybemorethanoneminimalgeneralizationforagiventable,suppres- andrelativedistance.letti(a1;:::;an)beatableandtj(a1;:::;an)beoneofitsgeneralizationswith imalgeneralization.todothat,werstintroducetwodistancemeasuresdenedbetweentables:absolute ofothers.weoutlineheresomesimplepreferencepoliciesthatcanbeappliedinchoosingapreferredmin- wherehzistheheightofthedomaingeneralizationhierarchyofdom(az;ti). distancevectordvi;j=[d1;:::;dn].theabsolutedistanceoftjfromti,writtenabsdisti;j,isthesumof thedistancesforeachattribute.formally,absdisti;j=pni=1di.therelativedistanceoftjfromti,written isobtainedbydividingthedistanceoverthetotalheightofthehierarchy.formally,reldisti;j=pnz=1dz Reldisti;j,isthesumofthe\relative"distanceforeachattribute,wheretherelativedistanceofeachattribute Giventhosedistancemeasureswecanoutlinethefollowingbasicpreferencepolicies: hz, 12
13 Minimumabsolutedistanceprefersthegeneralization(s)thathasasmallerabsolutedistance,thatis, Minimumrelativedistanceprefersthegeneralization(s)thathasasmallerrelativedistance,thatis, withasmallertotalnumberofgeneralizationsteps(regardlessofthehierarchiesonwhichtheyhave thatminimizesthetotalnumberofrelativesteps,thatis,consideredwithrespecttotheheightofthe beentaken). Maximumdistributionprefersthegeneralization(s)thatcontainsthegreatestnumberofdistincttuples. Minimumsuppressionprefersthegeneralization(s)thatsuppressesless,thatis,thatcontainsthegreater hierarchyonwhichtheyaretaken. Underminimumabsolutedistance,GT[1;0]ispreferred.Underminimumrelativedistance,maximumdistribution,andminimumsuppressionpolicies,thetwogeneralizationsareequallypreferable.SupposeMaxSup=2. numberoftuples. Example5.1ConsiderExample4.2.SupposeMaxSup=1.MinimalgeneralizationsareGT[1;0]andGT[0;2]. eralizationsareequallypreferable.undertheminimumsuppressionpolicy,gt[1;0]ispreferred.underthe minimumrelativedistanceandthemaximumdistributionpolicies,gt[0;1]ispreferred. MinimalgeneralizationsareGT[1;0]andGT[0;1].Undertheminimumabsolutedistancepolicy,thetwogen- applied;thebestonetouse,ofcourse,dependsonthespecicuseforthereleaseddata.examinationofan exhaustivesetofpossiblepoliciesisoutsidethescopeofthispaper.thechoiceofaspecicpreferencepolicy isdonebytherequesteratthetimeofaccess[18].dierentpreferencepoliciescanbeappliedtodierent quasi-identiersinthesamereleaseddata. Thelistaboveisobviouslynotcompleteandthereremainadditionalpreferencepoliciesthatcouldbe someobservationsclarifyingtheproblemofndingaminimalgeneralizationanditscomplexity.weusethe Here,weillustrateanapproachtocomputingsuchageneralization.Beforediscussingthealgorithmwemake Wehavedenedtheconceptofpreferredk-minimalgeneralizationcorrespondingtoagivenprivatetable. 6 Computingapreferredgeneralization consideringthewholetablepttobegeneralized,weconsideritsprojectionpt[qi],keepingduplicates,on weconsiderthegeneralizationofeachspecicquasi-identierwithintableptindependently.insteadof theattributesofaquasi-identierqi.thegeneralizedtableptisobtainedbyenforcinggeneralizationfor termoutliertorefertoatuplewithfewerthankoccurrences,wherekistheanonymityconstraintrequired. eachquasi-identierqi2qipt.thecorrectnessofthecombinationofthegeneralizationsindependently Firstofall,giventhatthek-anonymitypropertyisrequiredonlyforattributesinquasi-identiers, correspondenceofvaluesacrosswholetuplesandbythefactthatthequasi-identiersofatablearedisjoint.4 producedforeachquasi-identierisensuredbythefactthatthedenitionofageneralizedtablerequires picturesallthepossiblegeneralizationsandtheirrelationships.eachpath(strategy)initdenesadierent Givenaquasi-identierQI=(A1;:::;An),thecorrespondingdomainhierarchyonDT=hD1;:::;Dni wayinwhichgeneralizationcanbeapplied.withrespecttoastrategy,wecoulddenetheconceptof localminimalgeneralizationasthegeneralizationthatisminimalwithrespecttothesetofgeneralizations InSection3weillustratedtheconceptsofageneralizationhierarchyandstrategiesforadomaintuple. inthestrategy(intuitivelytherstfoundinthepathfromthebottomelementdttothetopelement). serially. Eachk-minimalgeneralizationislocallyminimalwithrespecttosomestrategy,asstatedbythefollowing theorem. 4Thislastconstraintcanberemovedprovidedthatgeneralizationofnon-disjointquasi-identiersbeexecuted 13
14 Theorem6.1LetT(A1;:::;An)=PT[QI]bethetabletobegeneralizedandletDT=hD1;:::;Dnibethe tuplewheredz=dom(az;t),z=1;:::;n,beatabletobegeneralized.everyk-minimalgeneralizationof TiisalocalminimalgeneralizationforsomestrategyofDGHDT. Proof.(sketch)Bycontradiction.SupposeTjisk-minimalbutisnotlocallyminimalwithrespectto anystrategy.then,thereexistsastrategycontainingtjsuchthatthereexistsanothergeneralizationtz dominatedbytjinthisstrategywhichsatisesk-anonymitybysuppressingnomoretuplesthanwhatis allowed.hence,tzsatisesconditions1and2ofdenition4.3.moreover,sincetzisdominatedbytj, DVi;z<DVi;j.Hence,Tjcannotbeminimal,whichcontradictstheassumption. 2 Sincestrategiesarenotdisjoint,theconverseisnotnecessarilytrue,thatis,alocalminimalgeneralization withrespecttoastrategymaynotcorrespondtoak-minimalgeneralization. FromTheorem6.1,followingeachgeneralizationstrategyfromthedomaintupletothemaximalelement ofthehierarchywouldthenrevealallthelocalminimalgeneralizationsfromwhichthek-minimalgeneralizationscanbeselectedandaneventualpreferredgeneralizationchosen.(theconsiderationofpreferences impliesthatwecannotstopthesearchattherstgeneralizationfoundthatisknowntobek-minimal.) However,thisprocessismuchtoocostlybecauseofthehighnumberofstrategieswhichshouldbefollowed. ItcanbeprovedthatthenumberofdierentstrategiesforadomaintupleDT=hD1;:::;Dniis(h1+:::+hn)! h1!:::hn!, whereeachhiisthelengthofthepathfromditothetopdomainindghdi. Intheimplementationofourapproachwehaverealizedanalgorithmthatcomputesapreferredgeneralizationwithoutneedingtofollowallthestrategiesandcomputingthegeneralizations.Thealgorithm makesuseoftheconceptofdistancevectorbetweentuples.lettbeatableandx;y2ttwotuplessuch thatx=hv01;:::;v0niandy=hv00 1;:::;v00 niwhereeachv0i;v00 iisavalueindomaindi.thedistancevector betweenxandyisthevectorvx;y=[d1;:::;dn]wherediisthelengthofthepathsfromv0iandv00 itotheir closestcommonancestorinthevaluegeneralizationhierarchyvghdi.forinstance,withreferencetothe PTillustratedinFigure4,thedistancebetweenhasian,02139iandhblack,02139iis[1,0].Intuitively,the distancebetweentwotuplesxandyintabletiisthedistancevectorbetweentiandthetabletj,with TiTjwherethedomainsoftheattributeinTjarethemostspecicdomainsforwhichxandygeneralize tothesametuplet. Thefollowingtheoremstatestherelationshipbetweendistancevectorsbetweentuplesinatableanda minimalgeneralizationforthetable. Theorem6.2LetTi(A1;:::;An)=PT[QI]andTjbetwotablessuchthatTiTj.IfTjisk-minimalthen DVi;j=Vx;yforsometuplesx;yinTisuchthateitherxoryhasanumberofoccurrencessmallerthank. Proof.(sketch)Bycontradiction.Supposethatak-minimalgeneralizationTjexistssuchthatDVi;j doesnotsatisfytheconditionabove.letdvi;j=[d1;:::;dn].considerastrategycontainingageneralization withthatdistancevector(therewillbemorethanoneofsuchstrategies,andwhichoneisconsideredisnot important).considerthedierentgeneralizationstepsexecutedaccordingtothestrategy,fromthebottom goingup,arrivingatthegeneralizationcorrespondingtotj.sincenooutlierisatexactdistance[d1;:::;dn] fromanytuple,nooutlierismergedwithanytupleatthelaststepofgeneralizationconsidered.thenthe generalizationdirectlybelowtjinthestrategysatisesthesamek-anonymityconstraintastiwiththesame amountofsuppression.also,bydenitionofstrategy,dvi;z<dvi;j.then,bydenition4.3,tjcannotbe minimal,whichcontradictstheassumption. 2 AccordingtoTheorem6.2thedistancevectorofaminimalgeneralizationfallswithinthesetofthe vectorsbetweentheoutliersandothertuplesinthetable.thispropertyisexploitedbythegeneralization algorithmtoreducethenumberofgeneralizationstobeconsidered. Thealgorithmworksasfollows.LetPT[QI]betheprojectionofPToverquasi-identierQI.First,all distincttuplesinpt[qi]aredeterminedtogetherwiththenumberoftheiroccurrences.then,thedistance 14
15 vectorsbetweeneachoutlierandeverytupleinthetableiscomputed.then,adagwith,asnodes,all distancevectorsfoundisconstructed.thereisanarcfromeachvectortoallthesmallestvectordominating itintheset.intuitively,thedagcorrespondstoa\summary"ofthestrategiestobeconsidered(not allstrategiesmayberepresented,andnotallgeneralizationsofastrategymaybepresent).eachpathin thedagisthenfollowedfromthebottomupuntilaminimallocalgeneralizationisfound.thealgorithm determinesifageneralizationislocallyminimalsimplybycontrollinghowtheoccurrencesofthetupleswould combine(onthebasisofthedistancetableconstructedatthebeginning),withoutactuallyperformingthe thealgorithmkeepstrackofgeneralizationsthathavebeenconsideredsoastostoponapathwhenitruns generalization.whenalocalgeneralizationisfound,anotherpathisfollowed.aspathsmaybenotdisjoint, intoanotherpathonwhichalocalminimumhasalreadybeenfound.onceallpossiblepathshavebeen examined,theevaluationofthedistancevectorsallowsthedeterminationofthegeneralizations,amongthose thebasisofthedistancevectorsandofhowtheoccurrencesoftupleswouldcombine. found,whicharek-minimal.amongthem,apreferredgeneralizationtobecomputedisthendeterminedon distancevectorsbetweentuplesgreatlyreducesthenumberofgeneralizationstobeconsidered;(2)generalizationsarenotactuallycomputedbutforeseenbylookingathowtheoccurrencesofthetupleswould combine;(3)thefactthatthealgorithmkeepstrackofevaluatedgeneralizationsallowsittostopevaluation Thecharacteristicsthatreducethecomputationcostarethereforethat(1)thecomputationofthe onapathwheneveritcrossesapathalreadyevaluated. tablebeatleastk,andonlyinthiscase,therefore,isthealgorithmapplied.thisisstatedbythefollowing theorem. ThecorrectnessofthealgorithmdescendsdirectlyfromTheorems6.1and6.2. Theorem6.3LetTbeatable,MaxSupjTjbetheacceptablesuppressionthreshold,andkbeanatural ThenecessaryandsucientconditionforatableTtosatisfyk-anonymityisthatthecardinalityofthe value.hence,thegeneralizationwillcontainjtjoccurrencesofthesametuple.sincejtjk,itsatises number.ifjtjk,thenthereexistsatleastak-minimalgeneralizationfort.ifjtj<kthereareno possibledomain.sincemaximalelementsofdomaresingleton,allvaluesofanattributecollapsetothesame non-emptyk-minimalgeneralizationsfort. suppressingallthetuplesint. k-anonymity.supposejtj<k,nogeneralizationcansatisfyk-anonymity,whichcanbereachedonlyby Proof.(sketch)SupposejTjk.Considerthegeneralizationgeneralizingeachtupletothetopmost 7 Applicationoftheapproach:someexperimentalresults 2 whichinturnaccessedamedicaldatabase.ourgoalwastomodelanactualreleaseandtomeasurethequality thresholdsofsuppression.theprogramwaswritteninc++,usingodbctointerfacewithansqlserver, ofthereleaseddata.moststateshavelegislativemandatestocollectmedicaldatafromhospitals,sowe Weconstructedacomputerprogramthatproducestablesadheringtok-minimalgeneralizationsgivenspecic Figure10itemizestheattributesused;thetableisconsideredde-identiedbecauseitcontainsnoexplicit tuplerepresentsonepatient,andeachpatientisunique.thedatacontainedmedicalrecordsfor265patients. identifyinginformationsuchasnameoraddress.asdiscussedearlier,zipcode,dateofbirth,andgendercan thenationalassociationofhealthdataorganizationsrecommendsthatstateagenciescollect[14].each collapsedtheoriginalmedicaldatabaseintoasingletableconsistentwiththeformatandprimaryattributes belinkedtopopulationregistersthatarepubliclyavailableinordertore-identifypatients[18].therefore, foundtobeunique. thequasi-identierqifzip,birthdate,gender,ethnicitygwasconsidered.eachtuplewithinqiwas generalizationofthattablegivenathresholdofsuppression.thezipeldhasbeengeneralizedtothe ThetoptableinFigure10isasampleoftheoriginaldata,andthelowertableillustratesak-minimal 15
16 Attribute ZIP Birthyear Gender #distinctvaluesminfrequencymaxfrequencymedianfrequencycomments Ethnicity Table1:Distributionofvaluesinthetableconsideredintheexperiment yrrange rst3digits,anddateofbirthtotheyear.thetuplewiththeunusualzipcodeof hasbeen suppressed.(note:thedefaultvalueformonthisjanuaryandfordayisthe1stwhendatesaregeneralized. suppressed.therecipientofthedataisinformedofthelevelsofgeneralizationsandhowmanytupleswere Thisisdoneforpracticalconsiderationsthatpreservethedatatypeoriginallyassignedtotheattribute(see weregeneralizedrsttothemonth,then1-year,5-year,10-year,20-year,and100-yearperiods.atwo-level full9-digitform,withageneralizationhierarchyreplacingrightmostdigitswith0,of10levels.birthdates Section3).) hierarchywasconsideredforgenderandethnicity(seefigure2).theproductofthenumberofpossible domainsforeachattributegivesthetotalnumberofpossiblegeneralizations,whichis280. Table1itemizesthebasicdistributionofvalueswithintheattributes.ZIPcodeswerestoredinthe vectorsbetweenadjacenttuples.readingthesevectorsfromtheclique,theprogramgeneratedasetof generalizationstoconsider.therewere141generalizationsreadfromtheclique,discarding139or50%.for ourtests,weusedvaluesofktobe3,6,9,...,30andamaximumsuppressionthresholdof10%or27tuples. Theprogramconstructedacliquewhereeachnodewasatupleandtheedgeswereweightedbydistance andrealisticapplication.wemeasurethelossofdataqualityduetosuppressionastheratioofthenumberof tuplessuppresseddividedbythetotalnumberoftuplesintheoriginaldata.wedenetheinversemeasure suppression.generalizationalsoreducesthequalityofthedatasincegeneralizedvaluesarelessprecise.we of\completeness",todeterminehowmuchofthedataremains,computedasoneminusthelossdueto Figure11showstherelationshipbetweensuppressionandgeneralizationwithintheprograminapractical measurethelossduetogeneralizationastheratioofthelevelofgeneralizationdividedbythetotalheight computedasoneminusthelossduetogeneralization. ofthegeneralizationhierarchy.weterm\precision"astheamountofspecicityremaininginthedata, increases.lossesarereportedforbothgeneralizationandsuppressionforeachattributeasifitweresolely natureofvaluesfoundintheseattributes.giventhedistributionofmales(96)andfemales(169)inthedata, responsibleforachievingthek-anonymityrequirement.bydoingso,wecharacterizethedistributionand thegenderattributeitselfcanachievethesevaluesofksoweseenolossduetogeneralizationorsuppression. InCharts(A)and(B)ofFigure11wecomparethedataqualitylossasthek-anonymityrequirement generalizationsfound.basically,generalizationsthatsatisfysmallervaluesofkappearfurthertotheright Theatlinesonthesecurvesindicatevaluesbeingsomewhatclustered mostdiscriminatingvalues,soitisnotsurprisingthattheymustbegeneralizedmorethanotherattributes. Ontheotherhand,therewere258of265distinctbirthdates.Clearly,dateofbirthandZIPcodearethe inchart(c),andthosegeneralizationsthatachievelargervaluesofkareleftmost.thisresultsfromthe observationthatthelargerthevaluefork,themoregeneralizationmayberequired,resulting,ofcourse,in alossofprecision.itisalsonotsurprisingthatcompletenessremainsabove0.90becauseoursuppression Charts(C)and(D)ofFigure11reportcompletenessandprecisionmeasurementsforthe44minimal thresholdduringthesetestswas10%.thoughnotshowninthecharts,itcaneasilybeunderstoodthat raisingthesuppressionthresholdtypicallyimprovesprecisionsincemorevaluescanbesuppressedtoachieve k.clearly,generalizationisexpensivetothequalityofthedatasinceitisperformedacrosstheentire attribute;everytupleisaected.ontheotherhand,itremainssemanticallymoreusefultohaveavalue 16
17 Figure10:Exampleofcurrentreleasepracticeandminimallygeneralizedequivalent Figure11:Experimentalresultsbasedon265medicalrecords 17
18 present,evenifitisalesspreciseone,thannothavinganyvalueatall,asistheresultofsuppression. practicalapplications.ofcourse,protectingagainstlinkinginvolvesalossofdataqualityintheattributes thatcomprisethequasi-identier,thoughwehaveshownthatthelossisnotsevere.thesetechniquesare identierthatcanbeusedforlinking.inthesamplemedicaldatashownearlier,researchers,computer clearlymosteectivewhentheprimaryattributesrequiredbytherecipientarenotthesameasthequasi- Fromtheseexperimentsitisclearthatthetechniquesofgeneralizationandsuppressioncanbeusedin scientists,healtheconomistsandothersvaluetheinformationthatisnotincludedinthequasi-identierin ordertodevelopdiagnostictools,performretrospectiveresearch,andassesshospitalcosts[18]. 8Wehavepresentedanapproachtodisclosingentity-specicinformationsuchthatthereleasedtablecannot bereliablylinkedtoexternaltables.theanonymityrequirementisexpressedbyspecifyingaquasi-identier andaminimumnumberkofduplicatesofeachreleasedtuplewithrespecttotheattributesofthequasiidentier.theanonymityrequirementisachievedbygeneralizing,andpossiblysuppressing,informatiotionisnotgeneralizedmorethanitisneededtoachievetheanonymityrequirement.wehavediscussed uponrelease.wehavegiventhenotionofminimalgeneralizationcapturingthepropertythatinforma- possiblepreferencepoliciestochoosebetweendierentminimalgeneralizationsandanalgorithmtocom- theapplicationofourapproachtothereleaseofamedicaldatabasecontaininginformationregarding265 puteapreferredminimalgeneralization.finally,wehaveillustratedtheresultsofsomeexperimentsfrom patients. disclosurecontrol.manyproblemsarestillopen.fromamodelingpointofview,thedenitionofquasiidentiersandofanappropriatesizeofkmustbeaddressed.thequalityofgeneralizeddataisbestwhen theattributesmostimportanttotherecipientdonotbelongtoanyquasi-identier.forpublic-uselesthis maybeacceptable,butdeterminingthequalityandusefulnessinothersettingsmustbefurtherresearched. Thisworkrepresentsonlyarststeptowardthedenitionofacompleteframeworkforinformation Conclusions andofdataupdating,whichmayallowinferenceattacks[10,13]. toenforcetheproposedtechniquesandtheconsiderationofspecicqueries,ofmultiplereleasesovertime, Fromthetechnicalpointofview,futureworkshouldincludetheinvestigationofanecientalgorithm[15] Acknowledgments WethankSteveDawson,atSRI,fordiscussionsandsupport;RemaPadmanatCMUfordiscussionson metrics;and,dr.leemannofinovahealthsystems,lexicaltechnology,inc.,anddr.fredchufor makingmedicaldataavailabletovalidateourapproaches.wealsothanksylviabarrettandhenryleitner ofharvarduniversityfortheirsupport. References [1]N.R.AdamandJ.C.Wortman.Security-controlmethodsforstatisticaldatabases:Acomparative [2]RossAnderson.Asecuritypolicymodelforclinicalinformationsystems.InProc.ofthe1996IEEE [3]SilvanaCastano,MariaGraziaFugini,GiancarloMartella,andPierangelaSamarati.DatabaseSecurity. study.acmcomputingsurveys,21:515{556,1989. AddisonWesley,1995. SymposiumonSecurityandPrivacy,pages30{43,Oakland,CA,May
19 [4]P.C.Chu.Cellsuppressionmethodology:Theimportanceofsuppressingmarginaltotals.IEEETrans. [6]ToreDalenius.Findinganeedleinahaystack-oridentifyinganonymouscensusrecord.Journalof [5]L.H.Cox.Suppressionmethodologyinstatisticaldisclosureanalysis.InASAProceedingsofSocial StatisticsSection,pages750{755,199. onknowledgedatasystems,4(9):513{523,july/august1997. [7]B.A.DaveyandH.A.Priestley.IntroductiontoLatticesandOrder.CambridgeUniversityPress,1990. [8]DorothyE.Denning.CryptographyandDataSecurity.Addison-Wesley,1982. OcialStatistics,2(3):329{336,1986. [10]J.HaleandS.Shenoi.Catalyticinferenceanalysis:Detectinginferencethreatsduetoknowledge [9]DanGuseld.Alittleknowledgegoesalongway:Fasterdetectionofcompromiseddatain2-Dtables. discovery.inproc.ofthe1997ieeesymposiumonsecurityandprivacy,pages188{199,oakland, InProc.oftheIEEESymposiumonSecurityandPrivacy,pages86{94,Oakland,CA,May1990. [11]A.HundepoolandL.Willenborg.-and-Argus:Softwareforstatisticaldisclosurecontrol.InThird [12]RamKumar.Ensuringdatasecurityininterrelatedtabulardata.InProc.oftheIEEESymposiumon CA,May1997. [13]TeresaLunt.Aggregationandinference:Factsandfallacies.InProc.oftheIEEESymposiumon InternationalSeminaronStatisticalCondentiality,Bled,1996. [14]NationalAssociationofHealthDataOrganizations,FallsChurch.AGuidetoState-LevelAmbulatory SecurityandPrivacy,pages96{105,Oakland,CA,May1994. [15]P.SamaratiandL.Sweeney.Generalizingdatatoprovideanonymitywhendislosinginformation.In SecurityandPrivacy,pages102{109,Oakland,CA,May1989. Proc.oftheACMSIGACT-SIGMOD-SIGART1998SymposiumonPrinciplesofDatabaseSystems CareDataCollectionActivities,October1996. [17]LatanyaSweeney.Guaranteeinganonymitywhensharingmedicaldata,theDataysystem.InProc. [16]LatanyaSweeney.Computationaldisclosurecontrolformedicalmicrodata.InRecordLinkageWorkshop (PODS98),Seattle,USA,June1998. BureauoftheCensus,Washington,DC,1997. [18]LatanyaSweeney.Weavingtechnologyandpolicytogethertomaintaincondentiality.JournalofLaw, JournaloftheAmericanMedicalInformaticsAssociation,Washington,DC:Hanley&Belfus,Inc., [19]ReinTurn.Informationprivacyissuesforthe1990s.InProc.oftheIEEESymposiumonSecurityand Medicine,&Ethics,25(2{3):98{110, [20]JereyD.Ullman.PrinciplesofDatabasesandKnowledge-BaseSystems,volumeI.ComputerScience Privacy,pages394{400,Oakland,CA,May1990. [22]L.WillenborgandT.DeWaal.StatisticalDisclosureControlinPractice.Springer-Verlag,1996. [21]L.WillenborgandT.DeWaal.Statisticaldisclosurecontrolinpractice.NewYork:Springer-Verlag, Press,1989. [23]BeverlyWoodward.Thecomputer-basedpatientrecordcondentiality.TheNewEnglandJournalof Medicine,333(21):1419{1422,
College of Medicine Enrollment MD and MD/MPH Fall 2002 to Fall 2006
1 1 College of Medicine Enrollment MD and MD/MPH 8 6 4 2 College of Medicine MD and MD/MPH New students 184 18 172 185 184 Continuing students 592 595 67 585 589 Total 775 775 779 77 773 Change from previous
Reprintofapaperpresentedatthe8thACMSymposiumonOperatingSystem Principles,PacicGrove,California,14{16December1981.(ACMOperating DesignandVericationofSecureSystems SystemsReviewVol.15No.5pp.12-21) ComputerScienceLaboratory
PATIENT INFORMATION INTAKE F O R M BESSMER CHIROPRACTIC P. C.
PATIENT INFORMATION INTAKE F O R M BESSMER CHIROPRACTIC P. C. Date today: _ PERSONAL INFORMATION Full Name: SS#: Address: City: State: Home Phone: Cell Phone: W o r k Phone: Email: Birthdate: Age: Sex:
Is it statistically significant? The chi-square test
UAS Conference Series 2013/14 Is it statistically significant? The chi-square test Dr Gosia Turner Student Data Management and Analysis 14 September 2010 Page 1 Why chi-square? Tests whether two categorical
Enrollment Data Undergraduate Programs by Race/ethnicity and Gender (Fall 2008) Summary Data Undergraduate Programs by Race/ethnicity
Enrollment Data Undergraduate Programs by Race/ethnicity and Gender (Fall 8) Summary Data Undergraduate Programs by Race/ethnicity The following tables and figures depict 8, 7, and 6 enrollment data for
Nephrology Consultants of Georgia, P.C.
New Patient O (Check One) Established Patient O Name: (Last) _ (First) (MI) Address: City State Zip D.O.B. SSNO Email Address Ethnicity: O Hispanic or Latino O Not Hispanic or Latino O Patient Refused
FOOTHILLS BAPTIST BIBLE COLLEGE APPLICATION FOR ADMISSION
FOOTHILLS BAPTIST BIBLE COLLEGE APPLICATION FOR ADMISSION Print legibly in ink or type your response to each item and sign the application in all proper areas. Please include your $25.00 non-refundable
Survey of Team Attitudes and Relationships (STAR)
F 0 6 Survey of Team Attitudes and Relationships (STAR) The purpose of this survey is to find out how you feel about your work in hospice. Please read each item carefully, then select the response that
Total Enrollment Fall 2007 to Fall 2011
STATISTICAL PORTRAIT FALL 211 Total Enrollment 1 College or School 1 8 7 8 9 21 211 Medicine Masters of Public Health Graduate Studies Health Related Professions Nursing School Medicine 776 762 772 791
SAMPLE QUESTIONNAIRE
Stanford Patient Education Research Center Stanford University School of Medicine SAMPLE QUESTIONNAIRE CHRONIC DISEASE August 2007 You may use all or parts of the questionnaire at no charge without permission
Childcare: Eldercare: Not a Concern Somewhat Important Important Very Important. Additional Comments:
The President s Advisory Council on Women s Issues (PACWI) represents all women at our institution, including frontline workers, residents, students, staff, faculty, alumnae, and administrators. Several
Motivational Interviewing
Motivational Interviewing Motivational Interviewing: Facilitating Behavior Change Sponsored by: Mayo Clinic Nicotine Education Program Are you frustrated at your attempts to motivate people to change harmful
School of Health Sciences Diagnostic Medical Sonography Program. Acceptance Form. I (print name), ACCEPT the position as a student in the Diagnostic
Acceptance Form I (print name), ACCEPT the position as a student in the Diagnostic Medical Sonography Program. I understand that final acceptance depends upon successful completion of the final steps of
PPG & Survey Results Report 2014/15
PPG & Survey Results Report 2014/15 Patient Reference Group The patient group comprises 25 members Distribution Details Attendance Gender Ethnicity Age Survey Results Patient Satisfaction Survey 2014/15
FULL COVERAGE FOR PREVENTIVE MEDICATIONS AFTER MYOCARDIAL INFARCTION IMPACT ON RACIAL AND ETHNIC DISPARITIES
FULL COVERAGE FOR PREVENTIVE MEDICATIONS AFTER MYOCARDIAL INFARCTION IMPACT ON RACIAL AND ETHNIC DISPARITIES Niteesh K. Choudhry, MD, PhD Harvard Medical School Division of Pharmacoepidemiology and Pharmacoeconomics
Application for Admission Master of Health Sciences in Clinical Leadership Program Duke University School of Medicine
Application for Admission Master of Health Sciences in Clinical Leadership Program Duke University School of Medicine Duke University is an Equal Opportunity institution. Duke University offers equal opportunity
Drexel University College of Medicine
Drexel University College of Medicine In the Tradition of Woman s Medical College of Pennsylvania and Hahnemann Medical College College of Medicine Transfer Application I am applying for the Second Year
CERTIFIED NURSING ASSISTANT PROGRAM
P.O. Box 2000 709 S. Old Missouri Rd. Springdale, AR 72765-2000 (479) 751-8824 Ext 116 (479) 750-7272 (FAX) www.nwti.edu CERTIFIED NURSING ASSISTANT PROGRAM APPLICATION PROCESS CNA Application ($10.00
Preferred Pharmacy: Phone: Fax:
PATIENT INFORMATION: TODAY S DATE Last Name: Date of Birth: Sex: Male Female First Name: SS#: Middle Initial: Marital Status: Street Address: City: State: Home Phone: Work Phone: Mobile Phone: Email: Contact
Health Information Technology (HIT) Program Application
Health Information Technology (HIT) Program Application Capital Community College Division of Continuing Education, Economic & Community Development Today s Date Last Name First Name Middle Initial Home
YCH New Customer Survey report - 2007/08
Page:1 YCH New Customer Survey report 2007/08 Absolute Analysis % Respondents Base Do you want us to contact you to follow up any issues from this survey? Yes No 506 100.0% 226 44.7% 280 55.3% Page:2 YCH
Routes to diagnosis 2015 update: head and neck thyroid cancer. National Cancer Intelligence Network Short Report. Key messages.
Routes to diagnosis 2015 update: head and neck thyroid cancer National Cancer Intelligence Network Short Report Key messages New data published for head and neck thyroid cancer. Introduction The routes
Patient Participation Enhanced Service 2014/15 Annex D: Standard Reporting Template
Practice Name: Harley Grove Medical Centre Practice Code: F84044 London Region North Central & East Area Team Complete and return to: england.lon-ne-claims@nhs.net no later than 31 March 2015 Signed on
Standard Reporting Template
Standard Reporting Template Practice Name: Dr Perkins & Partners Practice Code: L82044 Devon, Cornwall and Isles of Scilly Area Team 2014/15 Patient Participation Enhanced Service Reporting Template Signed
Pharmaceutical Needs Assessment (PNA) Consultation Response Form
Pharmaceutical Needs Assessment (PNA) Consultation Response Form Hertfordshire Health and Wellbeing Board is consulting on the draft Hertfordshire PNA and welcome all views and comments. The consultation
Demographic Profile of Wichita Unemployment Insurance Beneficiaries Q3 2015
Demographic Profile of Wichita Unemployment Insurance Beneficiaries Q3 2015 The Bureau of Labor Statistics defines an unemployed person as one 16 years and older having no employment and having made specific
RICE COUNTY ENVIRONMENTAL SERVICES RICE COUNTY SUBSURFACE SEWAGE TREATMENT SYSTEM LOW INCOME FIXUP GRANT PROGRAM
(507) 332-6113 RICE COUNTY ENVIRONMENTAL SERVICES 320 Northwest Third Street Suite 9 Faribault, Minnesota 55021-6145 Toll free from Northfield (507) 645-9576 Toll free from Lonsdale (507) 744-5185 TDD
Tonya Rutherford-Hemming, RN, EdD, ANP-BC University of Pittsburgh School of Nursing
Tonya Rutherford-Hemming, RN, EdD, ANP-BC University of Pittsburgh School of Nursing University of Pittsburgh School of Nursing Competency X O1 X O2 Open-ended Questions X O1 X O2 Notes.
Diversity Data Report Department of Educational Leadership and Research Methodology. EDLRM Faculty Retreat- Fall 2011
Diversity Data Report Department of Educational Leadership and Research Methodology EDLRM Faculty Retreat- Fall 2011 FAU Ethnicity Enrollment Trend Data Year %Asian %Black %Hispanic %Native Am. %White
Opioid Treatment Program Participant Satisfaction Survey
Opioid Treatment Program Participant Satisfaction Survey Please complete the following information prior to completing the survey. Gender: Male Female Transgender Race: African American Caucasian Hispanic
Small Business Administration Loan Application
BUSINESS INFORMATION Small Business Administration Loan Application Business Name Structure (Corporation, Partnership, Sole P., LLC) Address Type of Business City, State, Zip No. of Employees: Before After
Privacy Challenges of Telco Big Data
Dr. Günter Karjoth June 17, 2014 ITU telco big data workshop Privacy Challenges of Telco Big Data Mobile phones are great sources of data but we must be careful about privacy 1 / 15 Sources of Big Data
Patient Registration Form (ecw) (First) (MI) Previous Name. Address
Patient Registration Form (ecw) PATIENT INFORMATION (Please Print) Dr. Miss Mr. Mrs. Ms. Patient's Name (Last) (First) (MI) Previous Name Address City, State ZIP Check the best contact number q Home Phone
Faculty Group Practice Patient Demographic Form
Name (Last, First, MI) Faculty Group Practice Patient Demographic Form Today s Patient Information Street Address City State Zip Home Phone SSN of Birth Gender Male Female Work Phone Cell Phone Marital
College of Health Related Professions Enrollment Fall 2002 to Fall 2006
36 College of Health Related Professions Enrollment Fall 2002 to Fall 2006 350 300 250 Number enrolled 200 150 100 50 0 Health-Related Professions Award Program Code CERT Health Information Management
PROGRAM APPLICATION FOR GATEWAY TO COLLEGE ADMISSION
PROGRAM APPLICATION FOR GATEWAY TO COLLEGE ADMISSION Please read the entire application carefully before completing. Print clearly. Use a black or blue ink pen. Only complete applications will be considered.
STREATHAM HIGH PRACTICE
STREATHAM HIGH PRACTICE PRG LOCAL PATIENT PARTICIPATION REPORT & ACTION PLAN (In agreement with Patient Representative Group - PRG) 2013-14 Page 1 of 24 Local Patient Participation Report Contents: Streatham
Total Males Females 34.4 36.7 (0.4) 12.7 17.5 (1.6) Didn't believe entitled or eligible 13.0 (0.3) Did not know how to apply for benefits 3.4 (0.
2001 National Survey of Veterans (NSV) - March, 2003 - Page 413 Table 7-10. Percent Distribution of Veterans by Reasons Veterans Don't Have VA Life Insurance and Gender Males Females Not Applicable 3,400,423
APPLICATION Detroit Grocery Incubator Grocery Leadership Fellowship
APPLICATION Detroit Grocery Incubator Grocery Leadership Fellowship The Grocery Leadership Fellowship is designed to assist individuals develop their management skills and industry knowledge in order to
BANKWEST MORTGAGE MANUFACTURED HOUSING CREDIT APPLICATION
BANKWEST MORTGAGE MANUFACTURED HOUSING CREDIT APPLICATION DATE OF APPLICATION: SALES PRICE: DOWN PAYMENT (10% Minimum)*: PURPOSE OF LOAN: PURCHASE CONSTRUCTION REFINANCE LOAN AMOUNT: HOME WILL BE: PRIMARY
Part Time. Part Time. Subtotal Time. Time. Criminal Justice 319 29 348 306 23 329 319 19 338 236 20 256
TOTAL enrollment Total - ALL Majors 473 37 510 466 26 492 483 24 507 469 28 497 319 29 348 306 23 329 319 19 338 236 20 256 Intent 154 8 162 160 3 163 164 5 169 233 8 241 TOTAL enrollment 319 29 348 306
for leaders who serve
for leaders who serve Educational Leadership Program Christian Brothers University m e m p h i s, tennessee A P P L I C AT I O N F O R M Christian Brothers University APPLICATION TO THE Educational Leadership
Higher Education Persistence and Completion. 2015 E 3 Alliance
Higher Education Persistence and Completion 1 Percent of Enrollees 10 Second Year Higher Ed Persistence Rates Not Improving Percent of Central Texas HS Grads Enrolled in Texas Higher Ed that Persist Into
Demographic Profile of Wichita Unemployment Insurance Beneficiaries Q2 2014
Demographic Profile of Wichita Unemployment Insurance Beneficiaries Q2 2014 The Bureau of Labor Statistics defines an unemployed person as one 16 years and older having no employment and having made specific
Survey of Advanced Practice Nurses 2010
Survey of Advanced Practice s 2010 INTRODUCTION AND METHODOLOGY In 2010, the Michigan Center for Nursing and Office of the Chief Executive asked Public Sector Consultants Inc. to conduct a survey of advanced
ACTG 121 Financial Accounting (4 Units), Online Mode Part I Summary: Enrollment and Student Outcomes
ACTG 121 Financial Accounting (4 Units), Online Mode Part I Summary: Enrollment and Student # Sections * * * * 1 5 1 5 #Enrollments * * * * 16 199 16 199 * * * * 42.9 57.4 42.9 57.4 * * * * 57.1 68.9 57.1
Annual Report of Life Insurance Examinations Calendar Year 2010
Annual Report of Life Insurance Examinations Calendar Year 2010 OVERVIEW This report was prepared according to the provisions of section 626.2415, Florida Statutes, and is published annually using data
Permanent Resident? yes no Visa #: Academic Information: Major: Double major: Major GPA Double major GPA Expected BS award date
UNIVERSITY OF CALIFORNIA, RIVERSIDE GRADUATE DIVISION 2015 UC LEADS APPLICATION Name: Last First Middle Current Mailing Address Permanent Mailing Address Street Street City, State, Zip Telephone Birthday:
Administrative Council July 28, 2010 Presented by Nancy McNerney Institutional Effectiveness Planning and Research
Administrative Council July 28, 2010 Presented by Nancy McNerney Institutional Effectiveness Planning and Research Developmental Students Today I will talk about 1. Who are they? 2. What are some facts
Colorado Association of Certified Veterinary Technicians Certification / Membership Renewal Application July 1, 2014 June 30, 2016
Colorado Association of Certified Veterinary Technicians Certification / Membership Renewal Application July 1, 2014 June 30, 2016 CACVT is the governing body and professional association for Certified
CREDENTIALING PROFILE
CREDENTIALING PROFILE Please type or print all of the information requested on this Profile. Incomplete profiles cannot be accepted and will be returned for completion. Faxed and photocopies of this form
HIV and AIDS in Alberta 2011 Annual Report
HIV and AIDS in Alberta 211 Annual Report November 212 212 Government of Alberta ISSN 1927-4157 November 212 Alberta Health, Surveillance and Assessment Send inquiries to: Health.Surveillance@gov.ab.ca
Currently Renting How long at this address? Own My Home How many in the household?
A. Client Information INTAKE FORM Last Name First Name Middle Initial Street Address City, State & Zip Best Phone Number(s) to Reach You Email Address Currently Renting How long at this address? Own My
Family Caregiver Assessment. Rosalynn Carter Institute for Caregiving
Family Caregiver Assessment Rosalynn Carter Institute for Caregiving Rosalynn Carter Institute for Caregiving Family Caregiver Assessment (RCI-FCA) Instructions for Use The Rosalynn Carter Institute Family
PURDUE UNIVERSITY - West Lafayette Campus
Associate Awards School of Veterinary Medicine Associate in Applied Science 23 23 23 23 Total 23 23 23 23 Awards: Students fullfilling multiple Associate award requirement from different programs will
Healthy Living Clinic, LLC Phone:(321) 549-2273/ FAX:(321) 549-2066
IDENTIFYING INFORMATION Patient Enrollment Form PATIENT NAME: SEX: MALE FEMALE DOB: / / SS# -- -- MO DAY YEAR CONTACT HOME PHONE: EMAIL: WORK PHONE: Preferred method of communication Email Mail Home Phone
PATIENT INFORMATION PATIENT FIRST NAME PATIENT LAST NAME D.O.B. SEX LANGUAGE ETHNICITY RACE
PATIENT INFORMATION 1. 2. 3. PATIENT FIRST NAME PATIENT LAST NAME D.O.B. SEX LANGUAGE ETHNICITY RACE MOTHER S FIRST NAME MOTHER S LAST NAME D.O.B PATIENT LIVE WITH? YES / NO SOCIAL SECURITY NUMBER: _-
Supplementary Online Content
Supplementary Online Content Arterburn DE, Olsen MK, Smith VA, Livingston EH, Van Scoyoc L, Yancy WS, Jr. Association Between Bariatric Surgery and Long-Term Survival. JAMA. doi:10.1001/jama.2014.16968.
Family Shared Cost Program
Family Shared Cost Program Thank you for your interest in the CCHC Family Shared Cost Program. The FSCP is designed to provide quality, compassionate health care regardless of an individual s financial
Community Health Programs Patient Registration
Community Health Programs Patient Registration Last Name: First Name: Preferred name: Middle Initial: Suffix: Gender: Male Female Former Last Name: Date of Birth: / / Social Security Number: SSN: Mailing
All questionnaire responses are due no later than December 1, 2011. Please direct all questions to alisestatistics@slis.ua.edu
Section II. Students All questionnaire responses are due no later than December 1, 2011. Please direct all questions alisestatistics@slis.ua.edu 0% 100% Group 1 II.1.A Full Time Students Enrollment by
SAMPLE QUESTIONNAIRE
Stanford Patient Education Research Center Stanford University School of Medicine SAMPLE QUESTIONNAIRE DIABETES You may use all or parts of the questionnaire at no charge without permission Stanford Patient
KIDNEY/PANCREAS REFERRAL PACKET Please attach the following information with each application.
KIDNEY/PANCREAS REFERRAL PACKET Please attach the following information with each application. 1. Patient s history and physical (less than one year old). 2. Recent labs, current medication list and radiology
New Patient Assessment Form Oncology
Today s : New Patient Assessment Form Oncology Personal Information Patient Social Security No.: DOB: Age: Phone #: City: Zip: Place of Birth: Significant Other: Do you speak/read/understand English? YES
Rocky Mountain Hyperbaric Association for Brain Injuries. Healing our Heroes Program Application
Rocky Mountain Hyperbaric Association for Brain Injuries Healing our Heroes Program Application The mission of the Rocky Mountain Hyperbaric Association for Brain Injuries is to improve the quality of
Education. Date of discharge (if applicable) [Required] Total number of service years. [Required] Total years and months active duty
Veteran Scholarships Application Basic Information [Required] Contact Information - must be 10-15 digits long and may include only numbers, hyphens, and spaces. - name@myschool.edu First name: Middle initial:
The University of Memphis Department of Social Work Social Work Information Form
The University of Memphis Department of Social Work Social Work Information Form The Department of Social Work wants to know something about each of the students who is selecting Social Work to be her/his
Disease or Condition-Specific Information (Please complete if appropriate)
Arkansas Department of Health 4815 West Markham Street, Communicable Disease Reporting Form Slot #32 Fax Reports to (501) 661-2428 Little Rock, AR 72205 Please Print Legibly Reporting facility: Address:
MISSION STATEMENT. INFORMATION and APPLICATION Eligibility
MISSION STATEMENT The Maryland School Psychologist s Association, (MSPA), became aware of the need for a more aggressive approach in relieving some of the financial pressures that are faced by our minority
Metro Interfaith Housing Counseling. Tell Us About Yourself. General Information Primary
Metro Interfaith Housing Counseling 21 New St, Binghamton, NY 13903 Phone: 607.723.0582 Fax: 607.722.8912 Tell Us About Yourself Print clearly. Use additional sheets if necessary. Information provided
Annex D: Standard Reporting Template
Annex D: Standard Reporting Template Thames Valley Area Team 2014/15 Patient Participation Enhanced Service Reporting Template Practice Name: Forest Health Group (previously known as Balfron Practice &
COLLEGE PREPARATION QUESTIONNAIRE
COLLEGE PREPARATION QUESTIONNAIRE A. High School Attended: B. Month and year graduated from high school: C. I was enrolled in college track classes during high school (select one): Yes: No: D. Gender:
APPLICATION FOR ADMISSION PHARMACY TECHNICIAN PROGRAM DIXIE APPLIED TECHNOLOGY COLLEGE
APPLICATION FOR ADMISSION PHARMACY TECHNICIAN PROGRAM DIXIE APPLIED TECHNOLOGY COLLEGE You must apply for formal admission to the Pharmacy Technician Program at the Dixie Applied Technology College (DXATC).
Community Health Programs Patient Registration. Last Name: First Name: Preferred Name: Zip Code: City: State:
Community Health Programs Patient Registration Last Name: First Name: Preferred Name: Middle Initial: Suffix: Former Last Name: Gender: Male Female Date of Birth: / / Social Security Number: Mailing Address:
TELEPHONE: (225) 771-5390 TOLL FREE 1(888) 223-1460 FAX: (225) 771-5723 Download applications at http://www.subr.edu/gradschool
APPLICATION FOR ADMISSION TO A GRADUATE DEGREE PROGRAM INSTRUCTIONS THE GRADUATE SCHOOL SOUTHERN UNIVERSITY AND A & M COLLEGE P. O. BOX 9860 BATON ROUGE, LA 70813 TELEPHONE: (225) 771-5390 TOLL FREE 1(888)
MEDICARE DOCTOR-PATIENT SURVEY TENNESSEE Survey Summary
MEDICARE DOCTOR-PATIENT SURVEY TENNESSEE Survey Summary More than 10 years ago, Congress created a flawed system to pay doctors who treat Medicare patients. Because lawmakers have been unable to fix this
LEARNING DISABILITIES
LEARNING DISABILITIES A fact sheet on in the London Borough of Hounslow. Table 1: Summary of primary care learning disability register. Data taken from the 5 practices currently on SystmOne, extracted
Psychiatric Emergency Department Visits in California, 2005-2011. Session: Spatial Analysis, Paper # 1245
Psychiatric Emergency Department Visits in California, 2005-2011 Session: Spatial Analysis, Paper # 1245 Esri User s Conference San Diego, CA July 15, 2014 Participants»Jim E. Banta, PhD, MPH»Mark G. Haviland,
1. Workforce Profile
1. Workforce Profile At the end of March 2015 there were 5,393 staff employed by the Trust, an increase of 79 employees compared to March 2014 (5,314). Although there is only a slight increase, this differs
Summary presentation for senior leaders
Summary presentation for senior leaders In case of enquiries please contact GL Assessment by emailing info@gl-assessment.co.uk. Copyright 2012 GL Assessment Limited. GL Assessment is part of the GL Education
General Membership Handbook
General Membership Handbook Revised: December 22, 2010 Table of Contents 1. Membership as a Research Scientist A. Membership Requirements B. Eligibility C. Application Process D. Fees E. Renewal Process
CITY OF BAKERSFIELD EMPLOYMENT APPLICATION
CITY OF BAKERSFIELD EMPLOYMENT APPLICATION CITY OF BAKERSFIELD HUMAN RESOURCES OFFICE Office Address: 1600 Truxtun Ave., 1 st Floor Mailing Address 1600 Truxtun Ave. Bakersfield, CA 93301 APPLICATION FOR
WORKERS= COMPENSATION INCIDENT CHECKLIST
WORKERS= COMPENSATION INCIDENT CHECKLIST This checklist is to be completed by the IMMEDIATE SUPERVISOR of the injured employee. This packet is VERY TIME-SENSITIVE. All forms in the packet should be completed
Estimated Population Responding on Item 25,196,036 2,288,572 3,030,297 5,415,134 4,945,979 5,256,419 4,116,133 Medicare 39.3 (0.2)
Table 3-15. Percent Distribution of Veterans by Type of Health Insurance and Age 35 Years 35-44 Years 2001 National Survey of Veterans (NSV) - March, 2003 - Page 140 45-54 Years 55-64 Years 65-74 Years
Last Name First Name MI. Sex (circle): Male Female Date of Birth SS# Marital Status (circle): Married Single Divorced Widowed Separated
Patient Information Last Name First Name MI Sex (circle): Male Female Date of Birth SS# Marital Status (circle): Married Single Divorced Widowed Separated Race (circle): Black White Asian Other Ethnicity
RESEARCH APPRENTICESHIP PROGRAM FOR HIGH SCHOOL STUDENTS (RAP)
RESEARCH APPRENTICESHIP PROGRAM FOR HIGH SCHOOL STUDENTS (RAP) Please key or type all answers. Hand written applications will not be accepted. Once your part of the application is complete, print form,
Consultant Application
Consultant Application Education Service Center Region 12 2101 W. Loop 340 Waco, Texas 76712 254-297-1212 254-666-0625 The Education Service Center Region 12 does not discriminate on the basis of race,
Annex C Arden, Herefordshire and Worcestershire Area Team Patient Participation Enhanced Service 2014/15 Reporting Template
Practice Name: Practice Code: Arden, Herefordshire and Worcestershire Area Team Patient Participation Enhanced Service 2014/15 Reporting Template Grey Gable Surgery Y03602 Signed on behalf of practice:
HOME STRETCH WORKSHOP REGISTRATION
HOME STRETCH WORKSHOP REGISTRATION Organization: Workshop location: Workshop (s): Instructions: Please fill out as completely as possible. If you need additional space, please feel free to use the back
Patient Participation Enhanced Service 2014/15 Annex D: Standard Reporting Template
Practice Name: The Barkantine Practice Practice Code: F84747 London Region North Central & East Area Team Complete and return to: england.lon-ne-claims@nhs.net no later than 31 March 2015 Signed on behalf
2. List at least three (3) of the most important things you learned during your time in the program
Section 1. NIU s Sport Management MS Student Exit Interview -- Student Questions Please answer the following questions offered below regarding your experiences within the program. 1. General Reflections
NEUROSURGERY SERVICES AT APD LOCATED AT UPPER VALLEY MEDICAL GROUP 106 Hanover Street, Lebanon, NH 03766 Phone: 603.448.0447 Fax: 603.448.
DATE NEUROSURGERY SERVICES AT APD LOCATED AT UPPER VALLEY MEDICAL GROUP 106 Hanover Street, Lebanon, NH 03766 Phone: 603.448.0447 Fax: 603.448.0019 Joseph M. Phillips, M.D., Ph.D. Board Certified in Pain
2014-2015 FACT BOOK DEGREES CONFERRED. Table 5.1 Degrees Conferred by Schools/ Colleges and Campus Fall 2014 - Spring 2015
Table 5.1 Degrees Conferred by Schools/ Colleges and Campus Schools/ Colleges Associates Bachelors Masters All Degrees UVI (ALL) School of Business 19 65 7 91 School of Education 11 23 13 47 CLASS 3 51
Monterey County Behavioral Health 2013 Satisfaction Survey Outcomes
SERVICE AREA - DUAL DIAGNOSIS TREATMENT DTH Co-occuring Disorder SD (BVCSOCSDV) DTH Santa Lucia (CDCSOC) Youth Surveys High Performing Indicators (75% and above) Low Performing Indicators (below 75%) Positive
Advanced Women's HealthCare, SC Registration Form
Patient Full Name Address Advanced Women's HealthCare, SC Registration Form Street Account # Provider Last First Middle Maiden(0ther) Apt/Suite# City State Zip Code Phone # (Please circle preferred contact
PROSPERITY WORKS * CNM INDIVIDUAL DEVELOPMENT ACCOUNT APPLICATION
Applicant First Name: Initial: Last Name: CNM Student ID#: Date of Birth: Street/Mailing Address: City: State: Zip Code: County: Phone: Cell: Email: Preferred method of contact? Please circle one: Phone
Millers College of Nursing 2151 Consulate Drive Suite, 10 & 11 Orlando, FL 32837
Congratulations on your decision to pursue your degree in nursing. The Millers College of Nursing offers a career pathway to the Bachelor of Science in Nursing. The pathway provides learning activities
Personal Details Surname Surname at birth, if different Any other names by which you have been known
Post applied for: Office Use Only 1 2 3 4 Personal Details Surname Surname at birth, if different Any other names by which you have been known Forenames (in full) Nationality Title (Mr, Mrs, Miss, Ms,