Natalie Shlomo

Assessing Identification Risk in Survey Microdata Using Log-Linear Models

This article considers the assessment of the risk of identification of respondents in survey microdata, in the context of applications at the United Kingdom (UK) Office for National Statistics (ONS). The threat comes from the matching of categorical “key“ variables between microdata records and external data sources and from the use of log-linear models to facilitate matching. While the potential use of such statistical models is well established in the literature, little consideration has been given to model specification or to the sensitivity of risk assessment to this specification. In numerical work not reported here, we have found that standard techniques for selecting log-linear models, such as chi-squared goodness-of-fit tests, provide little guidance regarding the accuracy of risk estimation for the very sparse tables generated by typical applications at ONS, for example, tables with millions of cells formed by cross-classifying six key variables, with sample sizes of 10 or 100,000. In this article we develop new criteria for assessing the specification of a log-linear model in relation to the accuracy of risk estimates. We find that, within a class of “reasonable“ models, risk estimates tend to decrease as the complexity of the model increases. We develop criteria that detect “underfitting“ (associated with overestimation of the risk). The criteria may also reveal “overfitting“ (associated with underestimation) although not so clearly, so we suggest employing a forward model selection approach. Our criteria turn out to be related to established methods of testing for overdispersion in Poisson log-linear models. We show how our approach may be used for both file-level and record-level measures of risk. We evaluate the proposed procedures using samples drawn from the 2001 UK Census where the true risks can be determined and show that a forward selection approach leads to good risk estimates. There are several “good“ models between which our approach provides little discrimination. The risk estimates are found to be stable across these models, implying a form of robustness. We also apply our approach to a large survey dataset. There is no indication that increasing the sample size necessarily leads to the selection of a more complex model. The risk estimates for this application display more variation but suggest a suitable upper bound.

End-of-life care and achieving preferences for place of death in England: Results of a population-based survey using the VOICES-SF questionnaire

Background/aim: Health policy places emphasis on enabling patients to die in their place of choice, and increasing the proportion of home deaths. In this article, we seek to explore reported preferences for place of death and experiences of care in a population-based sample of deaths from all causes. Design: Self-completion post-bereavement survey. Setting/Participants: Census of deaths registered in two health districts between October 2009 and April 2010. Views of Informal Carers – Evaluation of Services Short Form was sent to each informant (n = 1422; usually bereaved relative) 6–12 months post-bereavement. Results: Response was 33%. In all, 35.7% of respondents reported that the deceased said where they wanted to die, and 49.3% of these were reported to achieve this. Whilist 73.9% of those who were reported to have a preference cited home as the preferred place, only 13.3% of the sample died at home. Cancer patients were more likely to be reported to achieve preferences than patients with other conditions (p < .01). Being reported to have a record of preferences for place of death increased the likelihood of dying at home (odds ratio = 22.10). When rating care in the last 2 days, respondents were more likely to rate ‘excellent’ or ‘good’ for nursing care (p < .01), relief of pain (p < .01) and other symptoms (p < .01), emotional support (p < .01) and privacy of patient’s environment (p < .01) if their relative died in their preferred place. Conclusions: More work is needed to encourage people to talk about their preferences at the end of life: this should not be restricted to those known to be dying. Increasing knowledge and achievement of preferences for place of death may also improve end-of-life care.

Participant recruitment in sensitive surveys: a comparative trial of ‘opt in’ versus ‘opt out’ approaches

BackgroundAlthough in health services survey research we strive for a high response rate, this must be balanced against the need to recruit participants ethically and considerately, particularly in surveys with a sensitive nature. In survey research there are no established recommendations to guide recruitment approach and an ‘opt-in’ system that requires potential participants to request a copy of the questionnaire by returning a reply slip is frequently adopted. However, in observational research the risk to participants is lower than in clinical research and so some surveys have used an ‘opt-out’ system. The effect of this approach on response and distress is unknown. We sought to investigate this in a survey of end of life care completed by bereaved relatives.MethodsOut of a sample of 1422 bereaved relatives we assigned potential participants to one of two study groups: an ‘opt in’ group (n=711) where a letter of invitation was issued with a reply slip to request a copy of the questionnaire; or an ‘opt out’ group (n=711) where the survey questionnaire was provided alongside the invitation letter. We assessed response and distress between groups.ResultsFrom a sample of 1422, 473 participants returned questionnaires. Response was higher in the ‘opt out’ group than in the ‘opt in’ group (40% compared to 26.4%: χ2 =29.79, p-value<.01), there were no differences in distress or complaints about the survey between groups, and assignment to the ‘opt out’ group was an independent predictor of response (OR=1.84, 95% CI: 1.45-2.34). Moreover, the ‘opt in’ group were more likely to decline to participate (χ2=28.60, p-value<.01) and there was a difference in the pattern of questionnaire responses between study groups.ConclusionGiven that the ‘opt out’ method of recruitment is associated with a higher response than the ‘opt in’ method, seems to have no impact on complaints or distress about the survey, and there are differences in the patterns of responses between groups, the ‘opt out’ method could be recommended as the most efficient way to recruit into surveys, even in those with a sensitive nature.

Assessing the protection provided by misclassification-based disclosure limitation methods for survey microdata.

Government statistical agencies often apply statistical disclosure limitation techniques to survey microdata to protect the confidentiality of respondents. There is a need for valid and practical ways to assess the protection provided. This paper develops some simple methods for disclosure limitation techniques which perturb the values of categorical identifying variables. The methods are applied in numerical experiments based upon census data from the United Kingdom which are subject to two perturbation techniques: data swapping (random and targeted) and the post randomization method. Some simplifying approximations to the measure of risk are found to work well in capturing the impacts of these techniques. These approximations provide simple extensions of existing risk assessment methods based upon Poisson log-linear models. A numerical experiment is also undertaken to assess the impact of multivariate misclassification with an increasing number of identifying variables. It is found that the misclassification dominates the usual monotone increasing relationship between this number and risk so that the risk eventually declines, implying less sensitivity of risk to choice of identifying variables. The methods developed in this paper may also be used to obtain more realistic assessments of risk which take account of the kinds of measurement and other nonsampling errors commonly arising in surveys.

End-of-Life Care and Preferences for Place of Death among the Oldest Old: Results of a Population-Based Survey Using VOICES–Short Form

BACKGROUND End-of-life care (EOLC) is a key component in care of older people. However, evidence suggests that the oldest old (>85 years) are less likely to access specialist EOLC. OBJECTIVE The studys objective was to explore experiences of EOLC among the oldest old and determine their reported preference for place of death. DESIGN The study involved a self-completion postbereavement survey. METHODS A census was taken of deaths registered between October 2009 and April 2010 in two health districts, identified from death certificates. Views of Informal Carers-Evalution of Service (VOICES)-Short Form was sent to each informant (n=1422, usually bereaved relative) 6 to 12 months after the death. RESULTS Of 473 (33%) who responded, 48% of decedents were age 85 or over. There were no age differences in reported care quality in the last three months, but in the last two days the oldest old were reported to receive poorer relief of nonpain symptoms and less emotional and spiritual support. Compared to people under age 85, the over 85s were less likely to be reported to know they were dying, to have a record of their preferences for place of death, to die in their preferred place, to have enough choice about place of death-and more likely to be reported to have had unwanted treatment decisions. Being over 85 years was associated with a reduction in the odds of home death (OR=0.36); failure to ascertain and record preference for place of death contributed to this. CONCLUSIONS Age-associated disparity exists in care provided in the last two days and the realization of preferences.

Invariant Post-tabular Protection of Census Frequency Counts

Some countries use forms of random rounding as a post-tabular method to protect Census frequency counts disseminated in tables. These methods typically result in inconsistencies between aggregated internal cells to marginal totals and across same cells in different tables. A post-tabular method for perturbing frequency counts is proposed which preserves totals and corrects to a large extent inconsistencies. The perturbation is based on invariant probability transition matrices and the use of microdata keys. This method will be compared to common pre and post-tabular methods for protecting Census frequency counts.

Data swapping for protecting census tables

The pre-tabular statistical disclosure control (SDC) method of data swapping is the preferred method for protecting Census tabular data in some National Statistical Institutes, including the United States and Great Britain. A pre-tabular SDC method has the advantage that it only needs to be carried out once on the microdata and all tables released (under the conditions of the output strategies, eg. fixed categories of variables, minimum cell size and population thresholds) are considered protected. In this paper, we propose a method for targeted data swapping. The method involves a probability proportional to size selection strategy of high risk households for data swapping. The selected households are then paired with other households having the same control variables. In addition, the distance between paired households is determined by the level of risk with respect to the geographical hierarchies. The strategy is compared to a random data swapping strategy in terms of the disclosure risk and data utility.

Calibrated imputation of numerical data under linear edit restrictions

A common problem faced by statistical offices is that data may be missing from collected data sets. The typical way to overcome this problem is to impute the missing data. The problem of imputing missing data is complicated by the fact that statistical data often have to satisfy certain edit rules and that values of variables sometimes have to sum up to known totals. Standard imputation methods for numerical data as described in the literature generally do not take such edit rules and totals into account. In the paper we describe algorithms for imputation of missing numerical data that do take edit restrictions into account and that ensure that sums are calibrated to known totals. The methods sequentially impute the missing data, i.e. the variables with missing values are imputed one by one. To assess the performance of the imputation methods a simulation study is carried out as well as an evaluation study based on a real dataset.

Statistical disclosure control methods through a risk-utility framework

This paper discusses a disclosure risk – data utility framework for assessing statistical disclosure control (SDC) methods on statistical data. Disclosure risk is defined in terms of identifying individuals in small cells in the data which then leads to attribute disclosure of other sensitive variables. Information Loss measures are defined for assessing the impact of the SDC method on the utility of the data and its effects when carrying out standard statistical analysis tools. The quantitative disclosure risk and information loss measures can be plotted onto an R-U confidentiality map for determining optimal SDC methods. A user-friendly software application has been developed and implemented at the UK Office for National Statistics (ONS) to enable data suppliers to compare original and disclosure controlled statistical data and to make informed decisions on best methods for protecting their statistical data.

Measuring Disclosure Risk and Data Utility for Flexible Table Generators

Abstract Statistical agencies are making increased use of the internet to disseminate census tabular outputs through web-based flexible table-generating servers that allow users to define and generate their own tables. The key questions in the development of these servers are: (1) what data should be used to generate the tables, and (2) what statistical disclosure control (SDC) method should be applied. To generate flexible tables, the server has to be able to measure the disclosure risk in the final output table, apply the SDC method and then iteratively reassess the disclosure risk. SDC methods may be applied either to the underlying data used to generate the tables and/or to the final output table that is generated from original data. Besides assessing disclosure risk, the server should provide a measure of data utility by comparing the perturbed table to the original table. In this article, we examine aspects of the design and development of a flexible table-generating server for census tables and demonstrate a disclosure risk-data utility analysis for comparing SDC methods. We propose measures for disclosure risk and data utility that are based on information theory.