Double Anonymization

Defense in Depth

Two layers of protection ensure that if one layer fails, the other still protects patient privacy. Different anonymization strategies at each stage provide comprehensive coverage.

Different Purposes

Storage anonymization is optimized for research queries (preserves detail), while chain anonymization is optimized for privacy on immutable blockchain storage (maximum generalization).

Provenance Tracking

Both hashes stored together on Hedera with a provenance proof allows anyone to verify that the chain hash was derived from the storage hash, providing complete audit trail and transformation verification.

Compliance Ready

Meets strict regulatory requirements including GDPR and HIPAA. Demonstrates layered privacy protection and exceeds Safe Harbor de-identification standards.

What Gets Removed

• Patient names
• Patient IDs (original)
• Specific addresses (street, city)
• Phone numbers
• Exact dates of birth
• Exact age (replaced with age range)

What Gets Preserved

• Age Range: 5-year ranges (e.g., "35-39")
• Location: Country, region, district
• Dates: Exact dates (YYYY-MM-DD)
• Gender: Male, Female, Other, Unknown
• Occupation: Specific categories (e.g., "Healthcare Worker")
• Medical Data: All clinical information intact

Example

1{
2  "anonymousPatientId": "PID-001",
3  "ageRange": "35-39",
4  "country": "Uganda",
5  "region": "Central",
6  "gender": "Male",
7  "occupationCategory": "Healthcare Worker",
8  "effectiveDate": "2024-03-15",
9  "observationCodeLoinc": "4548-4",
10  "valueQuantity": "8.1"
11}

Additional Generalizations

• Age Ranges: 5-year → 10-year (e.g., "35-39" → "30-39")
• Dates: Exact → Month/Year (e.g., "2024-03-15" → "2024-03")
• Location: Remove region/district (keep only country)
• Occupation: Further generalize (e.g., "Healthcare Worker" → "Healthcare")
• Rare Values: Suppress values that could identify individuals

Example

1{
2  "anonymousPatientId": "PID-001",
3  "ageRange": "30-39",
4  "country": "Uganda",
5  "gender": "Male",
6  "occupationCategory": "Healthcare",
7  "effectiveDate": "2024-03",
8  "observationCodeLoinc": "4548-4",
9  "valueQuantity": "8.1"
10}

Note: Region/district removed, age range expanded, date rounded to month, occupation generalized.

1. Origin Verification

Verify both hashes exist and match expected values:

1assert(provenanceRecord.storage.hash === expectedStorageHash);
2assert(provenanceRecord.chain.hash === expectedChainHash);

2. Transformation Verification

Verify chain hash was derived from storage hash:

1assert(provenanceRecord.chain.derivedFrom === provenanceRecord.storage.hash);

3. Provenance Proof Verification

Verify the provenance proof links both hashes:

1const expectedProof = generateProvenanceProof(
2  provenanceRecord.storage.hash,
3  provenanceRecord.chain.hash,
4  provenanceRecord.anonymousPatientId,
5  provenanceRecord.resourceType
6);
7assert(provenanceRecord.provenanceProof === expectedProof);