# US 10,454,901 B2 · Systems and methods for enabling data de-identification and anonymous data linkage

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,454,901 B2
- Document ID: US10454901B2
- Status: Granted
- Kind: B2
- Application number: 15/000,905
- Filed: 2016-01-19
- Published: 2017-07-20
- Granted: 2019-10-22
- Earliest claimed: 2016-01-19
- Assignees: Datavant, Inc.
- Applicants: Health Data, Link Inc.
- Inventors: Abel Ngo Kho; Satyender Goel
- Web page: https://patentgrep.com/patent/US10454901B2

## CPC

- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- G06F 21/6254: {by anonymising data, e.g. decorrelating personal data from the owner's identification}
- G16H 10/60: for patient-specific data, e.g. for electronic patient records
- H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC}
- H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD}
- H04W 12/02: Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
- H04L 2209/42: Anonymization, e.g. involving pseudonyms
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G16H: HEALTHCARE INFORMATICS, i.e. INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR THE HANDLING OR PROCESSING OF MEDICAL OR HEALTHCARE DATA
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

Aspects of the present disclosure describe systems and methods that dynamically de-identifies confidential and/or sensitive patient health data maintained at computing devices deployed within a communications network. A key value is securely transmitted from a remote device included in a first security domain to a first server included in a second security domain. Based on the key value, the first server accesses a dataset containing health records identifying individual patients and de-identifies all or part of the dataset. A second server included in a security domain different from the remote device and the first server matches the de-identified data to previously de-identified data and generates a unique alias identifier for the matched de-identified data.

## Claims

### Claim 1

A system for dynamically de-identifying data from a data source comprising:
a remote device deployed in a first security domain of a communications network, the remote device for generating a key value corresponding to a project requiring de-identification of data;
a first server located in a second security domain of the communications network different than the first security domain, the first server to:
securely receive the key value from the remote device; and
in response to receiving the key value:
access a dataset maintained at the first server, the dataset including a record including data that uniquely identifies an individual;
generate a de-identified dataset from the dataset by removing the data that uniquely identifies the individual from the record; and
generate a hash based on the removed data; and
a second server located in a third security domain of the communications network different than each of the first security domain and the second security domain, the second server to:
securely receive the hash from the first server;
automatically match the de-identified dataset with a previously de-identified dataset by comparing the hash based on the removed data to a hash associated with the previously de-identified data; and
in response to automatically matching the de-identified dataset with a previously de-identified dataset, automatically generate a universal de-identified data set by providing a unique identifier for the universal de-identified dataset to each of the de-identified dataset and the previously de-identified dataset,
wherein the remote device requires proper authentication or encryption to access the first server.

### Claim 2 (depends on 1)

The system of claim 1, wherein to generate the de-identified dataset includes:
generating a first set of hashes including multiple hashes corresponding to the dataset based on characteristics of the individual, the multiple hashes including the hash based on the removed data.

### Claim 3 (depends on 2)

The system of claim 2, wherein to automatically match the de-identified dataset includes:
generating a weight value for respective hashes of the multiple hashes;
calculating a total weight by comparing the first set of hashes to a second set of hashes associated with the previously de-identified dataset and summing the weight value for each hash of the first set of hashes that matches a hash of the second set of hashes; and
identifying the match in response to the total weight being more than a threshold.

### Claim 4 (depends on 2)

The system of claim 2, wherein to generate the de-identified dataset further includes generating a unique hash identifier that identifies the multiple hashes as the first set of hashes.

### Claim 5 (depends on 1)

The system of claim 1, wherein the remote device is further configured to encrypt the key value and transmit the encrypted key value to the first server, in response to user input, at the remote device, requesting access to the project requiring the de-identification of data.

### Claim 6 (depends on 1)

The system of claim 1, wherein the dataset includes health data, wherein the record is a protected health information record, and wherein the individual is a health patient.

### Claim 7

A method for dynamically de-identifying data from a data source comprising:
at a first server within a first security domain:
securely receiving, at the first server and from a remote device in a second security domain different than the first security domain, a key value from the remote device;
in response to receiving the key value at the first server:
accessing a dataset maintained at the first server, the dataset including a record that uniquely identifies an individual;
generating a de-identified dataset from the dataset by removing the data that uniquely identified the individual from the record; and
generating a hash based on the removed data; and
at a second server within a third security domain different than each of the first security domain and the second security domain:
securely receiving the hash from the first server;
automatically matching the de-identified dataset with a previously de-identified dataset by comparing the hash based on the removed data to a hash associated with the previously de-identified data; and
in response to automatically matching the de-identified dataset with the previously de-identified dataset, automatically generating a universal de-identified data set by providing a unique identifier for the universal de-identified dataset to each of the de-identified dataset and the previously de-identified dataset,
wherein the first server requires proper authentication or encryption to access the second server.

### Claim 8 (depends on 7)

The method of claim 7, wherein de-identifying the dataset comprises:
generating a first set of hashes including multiple hashes corresponding to the dataset based on characteristics of the individual, the multiple hashes including the hash based on the removed data.

### Claim 9 (depends on 8)

The method of claim 8, wherein automatically matching the de-identified dataset comprises:
generating a weight value for respective hashes of the multiple hashes;
calculating a total weight by comparing the first set of hashes to a second set of hashes associated with the previously de-identified dataset and summing the weight value for each hash of the first set of hashes that matches a hash of the second set of hashes; and
identifying the match when the total weight is more than a threshold.

### Claim 10 (depends on 8)

The method of claim 8, further comprising generating a unique hash identifier that identifies the multiple hashes as the first set of hashes.

### Claim 11 (depends on 7)

The method of claim 7 further comprising encrypting the key value at the remote device and transmitting the encrypted key value to the first server in response to receiving user input at the remote device, requesting access to a project requiring the de-identification of data.

### Claim 12 (depends on 7)

The method of claim 7, wherein the dataset includes health data, wherein the record is a protected health information record, and wherein the individual is a health patient.

### Claim 13

A non-transitory computer readable medium including executable instructions for dynamically de-identifying data from a data source, the instructions comprising:
first instructions executable by a processor of a first server, such that, when executed by the processor of the first server, the instructions cause the processor of the first server to:
securely receive a key value from the remote device;
in response to receiving the key value:
access a dataset maintained by the first server, the dataset including a record that uniquely identifies an individual;
generate a de-identified dataset from the dataset by removing the data that uniquely identified the individual from the record; and
generate a hash based on the removed data; and
second instructions executable by a processor of a second server, such that, when executed by the processor of the second server, the instructions cause the processor of the second server to:
securely receive the hash from the first server;
automatically match the de-identified dataset with a previously de-identified dataset by comparing the hash based on the removed data to a hash associated with the previously de-identified data; and
when a match occurs, automatically generate a universal de-identified data set by providing a unique identifier for the universal de-identified dataset to each of the de-identified dataset and the previously de-identified dataset
wherein the first server requires proper authentication or encryption to access the second server.

### Claim 14 (depends on 13)

The non-transitory computer readable medium of claim 13, wherein the first instructions further cause the processor of the first server to de-identify the dataset by:
generating a first set of hashes including multiple hashes corresponding to the dataset based on characteristics of the individual, the multiple hashes including the hash based on the removed data.

### Claim 15 (depends on 14)

The non-transitory computer readable medium of claim 14, wherein the second instructions further cause the processor of the second server to automatically match the de-identified dataset by executing a weighting algorithm by:
generating a weight value for respective hashes of the multiple hashes;
calculating a total weight by comparing the first set of hashes to a second set of hashes associated with the previously de-identified dataset and summing the weight value for each hash of the first set of hashes that matches a hash of the second set of hashes; and
identifying the match when the total weight is more than a threshold.

### Claim 16 (depends on 14)

The non-transitory computer readable medium of claim 14, wherein to generate the de-identified dataset further includes generating a unique hash identifier that identifies the multiple hashes as the first set of hashes.

### Claim 17 (depends on 13)

The non-transitory computer readable medium of claim 13, wherein the key value is encrypted by the remote device and transmitted to the first server by the remote device in response to user input at the remote device requesting access to a project requiring the de-identification of data.

### Claim 18 (depends on 13)

The non-transitory computer readable medium of claim 13, wherein the dataset includes health data, wherein the record is a protected health information record, and wherein the individual is a health patient.