Traces of Identity in Swedish Health Data

Prior to the distribution of electronic patient records beyond direct patient care, data that directly contributes to the risk of patient re-identification must be anonymised or pseudonymised. However, even when direct identifiers have been removed, clinical free text may still contain information that can indirectly identify individuals. Such information, commonly referred to as indirect identifiers or quasi-identifiers, does not uniquely identify an individual in isolation but may contribute to re-identification risk when combined with other indirect identifiers. Imperfect de-identification therefore raises concerns regarding patient data privacy. Despite their contribution to re-identification risk, indirect identifiers are often not systematically addressed in the de-identification of patient records. Although removal of indirect identifiers is essential for safeguarding patient integrity in accordance with regulatory compliance, it may degrade the data utility by removing potentially important information required for medical research. The research questions addressed in this study is: Research Question 1: What indirect identifiers are present in Swedish patient record text? Research Question 2: What factors make an indirect identifier pose a risk for re-identification of a person according to Swedish experts within health data? To address this question, Direct Content Analysis was applied to 98 patient records, identifying 20 categories and 23 sub-categories of indirect identifiers. In addition, thematic analysis of semi-structured interviews with seven domain experts was conducted to examine how these identifiers were assessed in reality. The results show that the experts deem re-identification through indirect identifiers as context-dependent and contextual, while risk of re-identification rises when identifiers are distinct or allows for linkage with external datasets. Out of 43 indirect identifiers, place of work, occupation, leisure activities, ethnicity and education were considered to be of highest risk for re-identification of a person in a patient record.