SET THEORY DEFINITION AND ALGORITHM
FOR MEDICAL DE-IDENTIFICATION.

G. William Moore, MD, PhD [1,2,3],
Lawrence A. Brown, MD [1,2],
Robert E. Miller, MD [3].
From: Pathology and Laboratory Medicine Service (113), Baltimore VA Maryland Health Care System [1], Baltimore, MD.
Department of Pathology, University of Maryland School of Medicine [2], Baltimore, MD.
Department of Pathology, The Johns Hopkins Medical Institutions [3], Baltimore, MD.

U. S. Government Work, published in:
the Johns Hopkins Autopsy Resource,
www.netautopsy.org



TABLE OF CONTENTS.


1. ABSTRACT.
2. INTRODUCTION.
3. DATABASE DEFINITION.
4. SET THEORY DEFINITION.
5. TRUTH TABLE.
6. n-POSTING.
7. ALGORITHM.
8. MATHEMATICAL DEFINITIONS.
9. MATHEMATICAL THEOREMS.
10. RESULTS.
11. DISCUSSION.
12. DISCUSSION.
13. REFERENCES.


1. ABSTRACT.

SET THEORY DEFINITION AND ALGORITHM
FOR MEDICAL DE-IDENTIFICATION.


NEXT PAGE.
RETURN TO TABLE OF CONTENTS.
G. William Moore, MD, PhD [1,2,3],
Lawrence A. Brown, MD [1,2],
Robert E. Miller, MD [3].
From: Pathology and Laboratory Medicine Service (113), Baltimore VA Maryland Health Care System [1], Baltimore, MD.
Department of Pathology, University of Maryland School of Medicine [2], Baltimore, MD.
Department of Pathology, The Johns Hopkins Medical Institutions [3], Baltimore, MD.



Background. There is increasing interest in distributing individually identifiable medical records over the Internet for tissue-archival and epidemiologic studies. However, a record containing sufficient medical detail to have value for these applications might also point unambiguously to a specific patient. We propose a set-theory definition and algorithm for medical de-identification, that would prevent even a person with complete knowledge of a particular medical record from positively identifying it on the public database.

Design. As a model, we employ a rectangular medical database with rows=patients and columns=features expressed as Unified Medical Language System (UMLS) codes, designated as positive, negative, or missing-value. Publicly-known features (age, gender, etc.) are numbered consecutively from 1 to q; private features from q+1 to q+r; and 'public set', Q = {-q,...,-1,1,...,q}. The `posting' for patient i is the set Pi, where k belongs to Pi if the kth feature is positive; -k belongs to Pi if the kth feature is negative; and neither belongs to Pi if the kth feature is missing-value. Posting Pi is 'weakly private' if and only if there exists another posting, Pj, such that (Pi^Q)=(Pj^Q) and Pi is a subset of Pj; 'strongly private' if Pi=Pj (^=set-intersection).

Results. This privacy definition motivates an algorithm for removing ('scrubbing') data-elements from the public posting, such that no posting can be matched to a specific patient. With the strong privacy condition, even the patient cannot know that a particular posting belongs to himself/herself.

Conclusion. The proposed algorithm produces a de-identified medical database. A theoretical issue highlighted by the algorithm is the inadequacy of many statistical tests for managing missing-values. Another important issue is the translation of existing medical records into UMLS-coded databases.


2. INTRODUCTION.


NEXT PAGE.
PREVIOUS PAGE.
RETURN TO TABLE OF CONTENTS.

     

  • INTEREST IN PUBLIC DISTRIBUTION OF INDIVIDUALLY IDENTIFIABLE MEDICAL RECORDS.

  • VALUABLE FOR TISSUE-ARCHIVAL AND EPIDEMIOLOGIC STUDIES.

  • ESTABLISHED METHODS FOR STRIPPING EXACT PATIENT IDENTIFIERS.

  • RECORDS CONTAINING EXHAUSTIVE MEDICAL DETAIL, MIGHT ALSO POINT TO A SPECIFIC PATIENT.

  • WEB-BROWSING AND INDEXING TOOLS, MAY TARGET SPECIFIC FACTS OR PERSONS.

  • SET THEORY DEFINITION FOR MEDICAL DE-IDENTIFICATION.


    3. DATABASE DEFINITION.


    NEXT PAGE.
    PREVIOUS PAGE.
    RETURN TO TABLE OF CONTENTS.

  • DATABASE DEFINITION: ROWS=PATIENTS; COLUMNS=FEATURES.

  • n > 2 PATIENTS.

  • (q+r) > 2 BINARY (POSITIVE/NEGATIVE) FEATURES.

  • SOME VARIABLES UNKNOWN OR EXCLUDED FOR CONFIDENTIALITY REASONS (MISSING-VALUES).

  • BINARY MEDICAL VARIABLES CONSECUTIVELY NUMBERED FROM 1 TO (q+r).

  • VARIABLES FROM 1 TO q ARE 'PUBLIC' (MNEMONIC: PUBLIQ).

  • VARIABLES FROM r+1 TO q+r ARE 'PRIVATE' (MNEMONIC: PRIVATE).

  • PUBLIC VARIABLES: FEATURES ORDINARILY ACCESSIBLE TO THE PUBLIC (GENDER, AGE, PHYSICAL STIGMATA, ETC.).

  • PRIVATE FEATURES OF PUBLIC PERSONS (e.g., U. S. PRESIDENT LYNDON B. JOHNSON'S CHOLECYSTECTOMY SCAR) CONCEALED AS MISSING VALUES ('MISSINGVALUIZED') ON A CASE-BY-CASE BASIS.


    4. SET THEORY DEFINITION.


    NEXT PAGE.
    PREVIOUS PAGE.
    RETURN TO TABLE OF CONTENTS.

  • SET THEORY DEFINITION: n > 2 PATIENTS;

  • VARIABLES FROM 1 TO q ARE 'PUBLIC'.

  • VARIABLES FROM r+1 TO q+r ARE 'PRIVATE'.

  • 'PUBLIC SET', Q = {1,-1,...,q,-q}.

  • 'PRIVATE SET', R = {q+1,-q-1,...,q+r,-q-r}.

  • 'TRUTH TABLE', T: SET OF ALL T c T , k c T OR -k c T, BUT NOT BOTH, FOR ALL NON-ZERO K.

  • SUBTRUTH TABLE, S: SET OF ALL SUBSETS OF TRUTH TABLE ELEMENTS.


    5. TRUTH TABLE.


    NEXT PAGE.
    PREVIOUS PAGE.
    RETURN TO TABLE OF CONTENTS.

  • 'TRUTH TABLE', T: SET OF ALL T c T , SUCH THAT k c T OR -k c T, BUT NOT BOTH,
    FOR ALL NON-ZERO k.

  • FOR EACH TRUTH-TABLE-ELEMENT, T, EACH FEATURE, k, IS EITHER
    'TRUE' (+k c T ) OR 'FALSE' (-k c T ).

  • TRUTH TABLE IS THE SET OF 'COMPLETE PATIENT DESCRIPTIONS'.

  • EVERY PATIENT IS, IN PRINCIPLE, COMPLETELY DESCRIBED BY
    EXACTLY ONE TRUTH-TABLE-ELEMENT, T.

  • SUBTRUTH TABLE, S: SET OF ALL SUBSETS OF TRUTH TABLE ELEMENTS.

  • FOR EXAMPLE, FOR q=2 AND r=1, 'TRUTH TABLE', T: 
     { 1, 2, 3} = f
 { 1, 2,-3} = g
 { 1,-2, 3} = e
 { 1,-2,-3} = b
 {-1, 2, 3} = g
 {-1, 2,-3} = d
 {-1,-2, 3} = h
 {-1,-2,-3} = a


  • Figure 1. Venn Diagram for a three-variable truth table. 
                           ________________2___________
               a       |                          |
                       |                          |
                       |                          |
       ________1_______|________                  |
       |               |       |                  |
       |               |       |                  |
       |       b       |   c   |       d          |
       |       ________|_______|______________    |
       |       |       |       |             |    |
       |       |       |       |             |    |
       |       |   e   |   f   |       g     |    |
       |       |       |       |             |    |
       |       |       |_______|_____________|____|
       |       |               |             |
       |       |               |             |
       |_______|_______________|             |
               |                       h     |
               |                             |
               |                             |
               |_______________3_____________|



    6. n-POSTING.


    NEXT PAGE.
    PREVIOUS PAGE.
    RETURN TO TABLE OF CONTENTS.

  • SUBTRUTH TABLE, S: SET OF ALL SUBSETS OF TRUTH TABLE ELEMENTS.

  • 'n-POSTING', P: ORDERED COLLECTION OF n > 2 'SINGLE-POSTINGS', ( P1 ,..., Ph ,..., Pn ).

  • SINGLE-POSTING, OR 'POSTING', EQUALS A MEMBER OF THE SUBTRUTH TABLE, S,
    AND REPRESENTS ONE PATIENT.

  • NOTATION: Ph \ P: Ph IS A POSTING IN P.

  • TWO POSTINGS, Ph AND Pi, WHERE h ¬= i, REPRESENT TWO DIFFERENT PATIENTS, BUT MAY HAVE THE SAME VALUE IN THE SUBTRUTH TABLE.

  • Ph \ P , IS 'WEAKLY PRIVATE' IF AND ONLY IF THERE EXISTS A DISTINCT POSTING, Pi \ P , ( Ph ^ Q ) = ( Ph ^ Q ) ( ^ = set intersection); AND Ph c Pi .

  • Ph \ P , IS 'STRONGLY PRIVATE' IF Ph = Pi .

  • ALGORITHM OPERATES BY TARGETING CERTAIN DATA-ELEMENTS AND 'MISSINGVALUIZING' THEM.

  • FOR WEAK PRIVACY: A PERSON IGNORANT OF A GIVEN PATIENT'S PRIVATE DATA-ELEMENTS CANNOT IDENTIFY THE PATIENT FROM INFORMATION AVAILABLE IN THE PUBLIC POSTING (THEOREM 3).

  • FOR STRONG PRIVACY: EVEN THE PATIENT HIMSELF/HERSELF CANNOT IDENTIFY HIS/HER OWN RECORD FROM THE PUBLIC POSTING (THEOREM 5).

  • SET THEORY PROOFS: CLAIM THAT A GIVEN PATIENT IS IDENTIFIED FOR A GIVEN POSTING; SHOW THAT ANTOHER POSTING COULD LIKEWISE REPRESENT THAT PATIENT.


    7. ALGORITHM.


    NEXT PAGE.
    PREVIOUS PAGE.
    RETURN TO TABLE OF CONTENTS.

  • FORM A RECTANGULAR MEDICAL DATABASE (PATIENTS=ROWS; VARIABLES=COLUMNS).

  • 1. ASSIGN PUBLIC/PRIVATE STATUS TO EACH VARIABLE.

  • 2. APPLY MEDICAL TAXONOMY TO THE DATABASE.

  • 3. INSTANTIATE MEDICALLY REDUNDANT VARIABLE VALUES.

  • 4. SORT PATIENTS IN DESCENDING ORDER OF NUMBER OF NONMISSING VALUES PER PATIENT; SORT VARIABLES IN DESCENDING ORDER OF NUMBER OF NONMISSING VALUES PER VARIABLE.

  • 5. ALL VARIABLES THAT ARE NONMISSING IN ONLY ONE PATIENT MUST BE MISSINGVALUIZED.

  • 6. START AT THE TOP (MOST VARIABLES NONMISSING) OF THE PATIENT-LIST; FOR EACH PATIENT, FIND SUBSET-PATIENT (LATER ON THE LIST). FOR STRONG PRIVACY, LOOK FOR AN EQUAL-PATIENT RATHER THAN SUBSET-PATIENT.

  • 7. MISSINGVALUIZE ADDITIONAL DATA-ELEMENTS, TO SATISFY SUBSET OR EQUALITY RELATION REQUIRED BY STEP 5.

  • 8. GO TO 3. CONTINUE TO EXHAUSTION.


    8. MATHEMATICAL DEFINITIONS.


    NEXT PAGE.
    PREVIOUS PAGE.
    RETURN TO TABLE OF CONTENTS.

  • DEFINITION OF MEDICAL DATABASE: n > 2 PATIENTS; q > 1 PUBLIC VARIABLES; r > 1 PRIVATE VARIABLES.

  • 'PUBLIC SET', Q = {1,-1,...,q,-q}.

  • 'PRIVATE SET', R = {q+1,-q-1,...,q+r,-q-r}.

  • DEFINITION 1. TRUTH TABLE.
    Let q > 1, r > 1, Q = {1,-1,...,q,-q}, and R = {q+1,-q-1,...,q+r,-q-r}. The 'truth table', T , is the set of all T c T , such that for every k, 1 < k < q+r, {k,-k} ^ T ¬= Ø , but {k,-k} ¬c T. The 'subtruth table', S , is the set of all S c S for which there exists a T c T such that S c T.

  • DEFINITION 2. POSTING.
    Let n > 2. Then P = ( P1 ,..., Ph ,..., Pn ) is an 'n-posting' if and only if for every h, 1 < h < n, Ph c S . Write: Ph \ P ; Read: Ph is a posting in P .

  • DEFINITION 3. PRIVATE POSTING.
    Let P be an n-posting. Then Ph \ P is 'weakly private in P' if and only if there exists an i ¬= h and Pi \ P such that ( Ph ^ Q ) = ( Pi ^ Q ) and Ph c Pi , respectively, 'strongly private' if Ph = Pi . The n-posting, P , is 'weakly private' ( respectively, 'strongly private' ) if and only if every Ph \ P is weakly private in P ( respectively, strongly private ).

  • DEFINITION 4. MAXIMAL POSTING.
    Let P be an n-posting, and Pj \ P . Then Pj is 'maximal' if and only if for every Pk \ P such that Pj c Pk , Pj = Pk .


    9. MATHEMATICAL THEOREMS.


    NEXT PAGE.
    PREVIOUS PAGE.
    RETURN TO TABLE OF CONTENTS.

  • THEOREM 1. EXISTENCE OF MAXIMAL POSTING.
    Let P be weakly private, and Ph \ P . Then there exists an i ¬= h and Pi \ P such that Ph c Pi , and Pi is maximal.
    Proof. Consider any Ph \ P , and let j0 = h. By Definition 3 of weakly private, there exists a j1 ¬= h and Pj1 \ P such that Ph c Pj1 . Select a most-inclusive such Pj1 . If Pj1 = Pj0 , then let Pi = Ph = Pj1 . Otherwise, continue this process until Pjm = Pjm-1 , and let Pi = Pjm . The selection process must terminate after at most n steps, because there are only n postings. Consider any Pk \ P such that Pi c Pk . If Pi ¬= Pk , then the selection process is not complete. Therefore, Pi = Pk , and by Definition 4 of maximal, Pi is maximal.

  • THEOREM 2. DUPLICATE MAXIMAL POSTING.
    Let P be weakly private, and Ph \ P be maximal. Then there exists an i ¬= h and Pi \ P such that Pi is maximal.
    Proof. Consider any maximal Ph \ P . By Definition 3 of weakly private, there exists a i ¬= h and Pi \ P such that Ph c Pi . If Ph ¬= Pi , then Ph is not maximal; contradiction of hypothesis. Therefore Pi = Ph . Consider any Pk \ P such that Pi = Ph c Pk . If Pi ¬= Pk , then Ph is not maximal; contradiction of hypothesis. Therefore, by Definition 4 of maximal posting, Pi is maximal.

  • THEOREM 3. NO PUBLIC IDENTIFICATION.
    Let P be weakly private, Ph \ P , and T c T , such that ( Ph ^ Q ) c ( T ^ Q ). Then there exists an i ¬= h and Pi \ P such that ( Pi ^ Q ) c ( T ^ Q ).
    Proof. Consider any Ph \ P and any T c T such that ( Ph ^ Q ) c ( T ^ Q ). Then by Definition 3 of weakly private, there exists an i ¬= h and Pi \ P such that ( Pi ^ Q ) = ( Ph ^ Q ) . Therefore, ( Pi ^ Q ) = ( Ph ^ Q ) c ( T ^ Q ).

  • THEOREM 4. SELF-IDENTIFICATION.
    Let P be weakly private, but not strongly private. Then there exists a Ph \ P and T c T such that Ph c T , but for every i ¬= h and Pi \ P , Pi ¬c T .
    Proof. By Definition 3 of weakly private, for every Ph \ P there exists a Pi \ P such that Ph c Pi . If P is not strongly private, then there must exist at least one for every Ph \ P for which Ph c Pi , but Ph ¬= Pi . By definition of subset, there exists a k c ( Pi - Ph ) . Construct T c T such that ( Pi U {-k} ) c T. Then Ph c T.

  • THEOREM 5. NO SELF-IDENTIFICATION. Let P be strongly private. Then for every Ph \ P and T c T such that Ph c T , there exists an i ¬= h and Pi \ P , Pi c T .
    Proof. Consider any Ph \ P and T c T such that Ph c T . By Definition 3 of strongly private, for every Ph \ P there exists an i ¬= h and Pi \ P such that Pi = Ph . Therefore, Ph = Pi c T .


    10. RESULTS.


    NEXT PAGE.
    PREVIOUS PAGE.
    RETURN TO TABLE OF CONTENTS.

  • PRIVACY DEFINITIONS IN THIS REPORT THUS SPECIFY AN ALGORITHM FOR REMOVING ('SCRUBBING') DATA-ELEMENTS FROM THE PUBLIC POSTING.

  • NO RECORD CAN BE MATCHED TO A SPECIFIC PATIENT, EVEN IF MANY PRIVATE FACTS MAY BE INCLUDED ABOUT EACH PATIENT.

  • ALGORITHM SPECIFIES WHICH DATA-ELEMENTS MUST BE MISSINGVALUIZED IN ORDER TO DE-IDENTIFY THE DATABASE UNDER TWO PRIVACY DEFINITIONS.

  • WEAK PRIVACY: KNOWLEDGE OF PUBLIC INFORMATION ABOUT A PATIENT DOES NOT DISCLOSE THE IDENTITY OF THE POSTED RECORD (THEOREM 3).

  • STRONG PRIVACY: EVEN THE PATIENT CANNOT KNOW WITH CERTAINTY THAT A PARTICULAR RECORD BELONGS TO HIMSELF/HERSELF (THEOREM 5).


    11. DISCUSSION.


    NEXT PAGE.
    PREVIOUS PAGE.
    RETURN TO TABLE OF CONTENTS.

  • EVOLVING HIPAA GUIDELINES: CLEARLY STATED PARADOX BETWEEN PROTECTING A PATIENT'S CONFIDENTIAL MEDICAL RECORDS AND INHIBITING PROGRESS OF MEDICAL RESEARCH.

  • TWO GENERAL APPROACHES TO PROBLEM: (SWEENEY, 1996, 1997, 1998). EITHER MISSINGVALUIZE (SCRUB) INDIVIDUAL DATA-ELEMENTS; OR ELSE INSERT ADDITIONAL, PHANTOM PATIENTS (DOPPELGANGERS).

  • SOCIAL VALUE OF PUBLIC MEDICAL RECORDS: SPECIAL INTEREST GROUPS; LOW-BUDGET RESEARCH; NON-STANDARD RESEARCH PARADIGMS.

  • DOPPELGANGER (DILUTION) APPROACH DESCRIBED IN THE CRYPTOGRAPHY LITERATURE.

  • HOWEVER, DOPPELGANGER SOLUTION IS SUBSTANTIALLY FRAUDULENT, POTENTIALLY MISLEADING TO THE LIKELY USERS OF A PUBLIC MEDICAL DATABASE (TISSUE-ARCHIVISTS, EPIDEMIOLOGISTS).


    12. DISCUSSION.


    NEXT PAGE.
    PREVIOUS PAGE.
    RETURN TO TABLE OF CONTENTS.

  • THIS REPORT INTRODUCES A SET THEORY DEFINITION AND ALGORITHM THAT TARGETS WHICH DATA-ELEMENTS MUST BE MISSINGVALUIZED.

  • SET THEORY IS AN UNDERAPPRECIATED FORMALISM FOR EXAMINING CONFIDENTIALITY ISSUES IN MEDICINE.

  • PROBLEM WITH SCRUBBING: STATISTICAL METHODS DO NOT WORK WELL WITH MEDICAL DATABASES HAVING NUMEROUS MISSING VALUES [CIOS AND MOORE, 2000].

  • DIFFICULTIES IN UMLS-ENCODING A DATABASE.

  • MEDICAL LOGIC / TAXONOMY NECESSARY.

  • PUBLIC PERSONS (LBJ'S CHOLECYSTECTOMY) MUST BE SELECTIVELY MISSINGVALUIZED.

  • NEW PARADIGM: STRONG PRIVACY, WEAK PRIVACY.




  • 13. REFERENCES.


    PREVIOUS PAGE.
    RETURN TO TABLE OF CONTENTS.

           1. U. S. Code of Federal Regulations, 45 CFR Subtitle A (10-1-95 Edition), part 46.101 (b) (4).

           2. U. S. Department of Health and Human Services. Standards for Privacy of Individually Identifiable Health Information.
    Fed Regist. 1999 Nov 3;64(212):59917-59966. http://aspe.hhs.gov/admnsimp/

           3. U. S. Government Documents: http://thomas.loc.gov

           4. Berman JJ, Moore GW, Hutchins GM.
    Maintaining patient confidentiality in the public domain Internet Autopsy Database (IAD).
    Proc AMIA Annu Fall Symp. 1996;:328-332.
    PMID: 8947682; UI: 97103310.

           5. Berman JJ, Moore GW, Hutchins GM.
    U. S. Senate Bill 422. The Genetic Confidentiality and Nondiscrimination Act of 1997.
    Diagn Mol Pathol. 1998 Aug;7(4):192-196.
    PMID: 9917128; UI: 99114200.

           6. Sweeney L.
    Privacy and medical-records research.
    N Engl J Med. 1998 Apr 9;338(15):1077.
    PMID: 9537887; UI: 98181820.

           7. Sweeney L.
    Guaranteeing anonymity when sharing medical data, the Datafly System.
    Proc AMIA Annu Fall Symp. 1997;:51-55.
    PMID: 9357587; UI: 98020458.

           8. Sweeney L.
    Replacing personally-identifying information in medical records, the Scrub system.
    Proc AMIA Annu Fall Symp. 1996;:333-337.
    PMID: 8947683; UI: 97103311.

           9. Carter JR, Nash NP, Cechner RL, Platt RD.
    Proposal for a national autopsy data bank. A potential major contribution of pathologists to the health care of the nation.
    Am J Clin Pathol. 76 (Suppl): 597-617, 1981.

           10. National Bioethics Advisory Commission (NBAC).
    http://bioethics.gov/general.html
    Executive Order 12975, October 3, 1995.
    Federal Register: October 5, 1995. v. 60.; no. 193. pp. 52063-52065

           11. U.S. National Library of Medicine.
    Unified Medical Language System.
    http://www.nlm.nih.gov/research/umls/

           12. Schneier B.
    Applied Cryptography, Second Edition. Protocols, Algorithms, and Source Code in C.
    New York: John Wiley & Sons, 1996.

          17. Johns Hopkins Autopsy Resource.
    http://www.netautopsy.org/

          18. Moore GW, Berman JJ.
    Anatomic Pathology Data Mining.
    In: Cios KJ, ed. Medical Data Mining and Knowledge Discovery. Heidelberg: Springer Verlag. 2000 (in press).

          19. Suppes PV.
    Axiomatic Set Theory.
    New York: Dover Publications. 1972.

          20. Bernays P.
    Axiomatic Set Theory.
    New York: Dover Publications. 1968.

          21. Bundy A, ed.
    Artificial Intelligence Techniques: A Comprehensive Catalogue. Fourth, Revised Edition.
    Heidelberg: Springer Verlag. ISBN: 3540593233. 1997.

          22. Cios KJ, Moore GW. 2000.
    Medical Data Mining and Knowledge Discovery: An Overview.
    In: Medical Data Mining and Knowledge Discovery, Cios KJ (ed.), Heidelberg: Springer Verlag. to appear in November, 2000.

          23. Moore GW, Hutchins GM.
    Effort and demand logic in medical decision making.
    Metamedicine 1980;1:277-304.

          24. Moore GW, Hutchins GM, Miller RE.
    Token swap test of significance for serial medical data bases.
    Am J Med. 1986;80:182-190.

          25. Moore GW, Berman JJ, Hanzlick RL, Buchino JJ, Hutchins GM. 1996.
    A prototype Internet autopsy database. 1625 consecutive fetal and neonatal autopsy facesheets spanning 20 years.
    Arch Pathol Lab Med. 1996;120:782-785.

          26. Saul JM.
    Legal Policy and Security Issues in the Handling of Medical Data.
    In: Cios KJ, (ed.). Medical Data Mining and Knowledge Discovery. Heidelberg: Springer Verlag. 2000.

          27. U. S. Department of Health and Human Services:
    Standards for Privacy of Individually Identifiable Health Information. Fed Regist. 1999 Nov 3;64(212):59917-59966.
    http://aspe.hhs.gov/admnsimp/

          28. U. S. National Library of Medicine.
    UMLS Knowledge Sources. Eleventh Edition. Unified Medical Language System.
    U. S. Department of Health and Human Services. National Institutes of Health. National Library of Medicine. 2000.


    Last Revised: 10/22/2000 by G. William Moore.