Why De-identifying PHI Isn't Enough — Differential Privacy & Secure Aggregation
— by Vivax
Stripping names and dates from medical records feels safe — but re-identification and model-memorization attacks show it often isn't.
Removing the eighteen HIPAA Safe Harbor identifiers — names, dates, record numbers — is the baseline for sharing health data. But de-identification is not the same as anonymity. Researchers have repeatedly shown that 'anonymized' datasets can be re-identified by linking them to outside information, and machine-learning models trained on patient data can memorize and leak individual records through membership-inference and reconstruction attacks. Masking fields protects against casual viewing; it does not provide a guarantee.
Differential privacy, introduced by Cynthia Dwork and colleagues in 2006, offers something stronger: a mathematical promise. A computation is differentially private if its output is almost unchanged whether or not any single person's data was included — controlled by a privacy budget written as epsilon (ε), where smaller ε means stronger privacy. The practical tool for training neural networks this way is DP-SGD, which clips each example's gradient and adds calibrated noise so the final model cannot reveal whether any one patient was in the training set.
Privacy of the final model is only half the problem; the updates exchanged during training can leak data too. Secure aggregation, pioneered by Bonawitz and colleagues at Google in 2017, solves this with cryptography: each participant masks its model update so that only the sum across many participants can be decrypted, never any single contribution. Combined with differential privacy, a coordinating server learns the aggregate improvement without ever seeing one hospital's — let alone one patient's — data.
For Vivax, these are not academic curiosities — they are the building blocks of how we plan to improve our clinical world model across partner hospitals without centralizing protected health information. Differential privacy bounds what any model can remember; secure aggregation keeps individual updates private in transit. Together they let many institutions contribute to a better shared model while each one's data stays exactly where it belongs.