The London Health Observatory: monitoring health and health care in the capital, supporting practitioners and informing decision-makers Disclosure control and confidentiality Allan Baker / Justine Fitzpatrick

To be covered: What is disclosure control? Why do we need to disclosure control? How do we disclosure control? Which datasets need disclosure control? Official guidance Examples

Discussion What is disclosure control? Why do we need disclosure control?

What is disclosure control and why do we need it? Modification of the data, the statistic/measure or a combination of both to ensure that information about an individual or organisation is not disclosed from a public source. Disclosure control methods are usually applied if the possibility of identification exists. Often ethical, practical or legal considerations require the data to be protected. Disclosure control methods attempt to find an optimal balance between confidentiality protection and the reduction in data provision.

Possible methods of disclosure control Removing information (restriction e.g. broad-banding variables, suppression) Damaging the data (perturbation e.g. rounding, randomisation, small cell adjustment)

Disclosive statistics What indicators could be potentially disclosive? – Numbers of events/people – Percentages – Rates where the denominators are available, e.g. age-specific rates – SMRs with confidence intervals – Years of life lost – ? Maps and charts based on the data Non-disclosive statistics: – Life expectancy at birth results – Directly-age standardised rates (DASRs)

Common datasets - examples Census data – already disclosure controlled by small cell adjustment when passed to users Need to follow guidelines for other data e.g.: –HES –ONS Births and Deaths –National Child Measurement Programme –HPA data –Survey data

Dissemination of Health Statistics Data providers are expected to: Determine user requirements Understand characteristics of data and outputs Assess disclosure risk (including issues of legality in releasing data) High risk data – cells under 5 potentially unsafe

HES protocol for disclosure control Designed to protect the confidentiality of patients, GPs, consultants, and other clinicians Small numbers - suppression of cells with counts between 1 and 5, for data by: –Treatment – SHA / PCT / Ward –Residence – PCT / Ward / Postcode Disclosure control is not necessary for data by: –Country / Region / SHA of residence Sensitive information can not usually be released – advice from the Information Centre

HES – Sensitive information The following must not be passed on: –Abortions –AIDS/HIV and STIs –IVF, maternity data –ECT and neurosurgery for mental disorders –Deaths –Consultant, GP, GP practice, referrer –Potential identifiers: postcode, date of birth, NHS number

HES protocol for disclosure control Data sharing by PHOs: –PHOs may provide tabulations of local data for local NHS organisations. –Tables may contain cells with small numbers –Record-level extracts of regional data can be provided –Non-sensitive data only –Non-disclosure agreements needed

Death register information - discoverable Date of death Place of death Sex Date of birth (from which age is derived) Place of birth Occupation Usual address (excluding postcode) Original cause of death

Birth register information - discoverable Date of birth Place of birth Sex Father’s place of birth Father’s occupation Mother’s place of birth Mother’s occupation Mother’s usual address (excluding postcode)

ONS disclosure control for discoverable information Not needed for aggregate statistics at national or regional level Cannot release individual records Sub-regional data: –Disclosure control may be necessary where tables are mainly 1s & 0s –Numbers in row or column fewer than number of cells

Mortality fields that require disclosure control Non-discoverable data Postcode Marital status of deceased Final cause of death NS-SEC Employment status

Birth fields that need disclosure control Non-discoverable information: Postcode of usual residence Birthweight Birth in marriage indicator e.g. registration type Fact of and multiple birth type Fact of stillbirth and stillbirth indicator ICD-10 and Wigglesworth codes Age of mother at birth Mother’s parity NS-SEC of mother and father Employment status of mother and father

ONS disclosure control for non-discoverable data at sub-regional level Suppression of cells with counts under 3 Including 0s Secondary suppression to avoid potential for disclosure by subtraction Applies to counts, rates, percentages Applies to all charts and maps based on these data

Stillbirths Fact of stillbirth is confidential Perinatal deaths potentially disclosive Total birth figures disclosive if live birth figure would reveal disclosive figure for stillbirths Counts under 5 are disclosive

Weblinks ONS policy for births and deaths: HES protocol: Dissemination of Health Statistics – Confidentiality Guidance: statistics---consultation-on-guidance/disclosure-review-for-health-statistics--- consultation-on-guidance.html Guidance for abortion statistics:

Examples