Smart de-identification using date jittering

1. A method to produce an anonymized cohort that includes members having less than a predetermined risk of re-identification, comprising:

receiving a data query via a user-facing communication channel to request an anonymized cohort, the data query comprising requested traits to include in the members of the anonymized cohort;

querying a data source having data records describing the members, using a data query transmitted via a data source-facing communication channel, to find the data records that possess at least some of the requested traits;

forming a dataset from at least some of the data records;

grouping the data records in time, by a processor coupled to the user-facing communication channel and the data source-facing communication channel, into a first boundary group, a second boundary group, and one or more non-boundary groups temporally between the first boundary group and second boundary group;

for each non-boundary group within the dataset, performing the steps of:

calculating, by the processor, maximum positive and negative time limits said non-boundary group can be time-shifted without overlapping an adjacent group;

calculating, by the processor, a group jitter amount;

capping, by the processor, the group jitter amount by the maximum positive and negative time limits; and

jittering, by the processor, said non-boundary group by the capped group jitter; and

providing, via the user-facing communication channel, the dataset.

2. The method of claim 1 , further comprising capping the group jitter by respective predetermined forward and backward jitter limits.

3. The method of claim 2 , wherein the predetermined forward and backward jitter limits are user-configurable.

4. The method of claim 2 , wherein the predetermined forward and backward jitter limits are dependent upon a characteristic of the data.

5. The method of claim 2 , wherein the predetermined forward and backward jitter limits are dependent upon how the data will be used.

6. The method of claim 2 , wherein the predetermined forward and backward jitter limits comprise a first set of limits for a first non-boundary group and a second set of limits for a second non-boundary group, wherein the first set of limits is different than the second set of limits.

7. The method of claim 1 , wherein calculating a group jitter amount comprises using a deterministic function.

8. The method of claim 1 , wherein calculating a group jitter amount comprises using a hash function.

9. The method of claim 8 , wherein the hash function output is scaled to the capped group jitter.

10. The method of claim 8 , wherein the hash function hashes a date value from each respective non-boundary group by use of a secret key.

11. The method of claim 1 , wherein the maximum positive and negative time limits is a function of a desired analytic value.

12. The method of claim 10 , wherein the secret key comprises a project sub-key specific to a project, and an entity sub-key specific to an entity whose data is being processed.

13. The method of claim 12 , wherein the project sub-key comprises a 128-bit randomly-generated universally unique identifier (UUID).

14. The method of claim 1 , further comprising shifting the first boundary group, the second boundary group, and the one or more non-boundary groups by a predetermined amount of time.

15. The method of claim 1 , wherein the dataset comprises medical data.

16. The method of claim 1 , wherein the dataset comprises confidential non-medical data.

17. A system to produce an anonymized cohort that includes members having less than a predetermined risk of re-identification, comprising:

a communication interface to a database of medical data;

a processor coupled to a memory and to the database, the memory storing instructions to be executed by the processor, the instructions causing the processor to perform the steps of:

receiving a data query via a user-facing communication channel to request an anonymized cohort, the data query comprising requested traits to include in the members of the anonymized cohort;

querying a data source having data records describing the members, using a data query transmitted via a data source-facing communication channel, to find the data records that possess at least some of the requested traits;

forming a dataset from at least some of the data records;

grouping the data records in time, by a processor coupled to the user-facing communication channel and the data source-facing communication channel, into a first boundary group, a second boundary group, and one or more non-boundary groups temporally between the first boundary group and second boundary group;

for each non-boundary group within the dataset, performing the steps of:

calculating maximum positive and negative time limits said non-boundary group can be time-shifted without overlapping an adjacent group;

calculating a group jitter amount;

capping the group jitter amount by the maximum positive and negative time limits; and

jittering said non-boundary group by the capped group jitter; and

providing, via the user-facing communication channel, the dataset.

18. The system of claim 17 , wherein calculating a group jitter amount comprises using a hash function.

19. The system of claim 18 , wherein the hash function hashes a date value from each respective non-boundary group by use of a secret key, wherein the secret key comprises a project sub-key specific to a project, and an entity sub-key specific to an entity whose data is being processed.

20. The system of claim 17 , further comprising shifting the first boundary group, the second boundary group, and the one or more non-boundary groups by a predetermined amount of time.