Spontaneous reporting systems (SRS) have been developed to collect adverse event records that contain personal demographics and sensitive information like drug indications and adverse reactions. The release of SRS data may disclose the privacy of the data provider. Unlike other microdata, very few anonymyization methods have been proposed to protect individual privacy while publishing SRS data. MS(k, θ*)-bounding is the first privacy model for SRS data that considers multiple individual records, mutli-valued sensitive attributes, and rare events. PPMS(k, θ*)-bounding then is proposed for solving cross-release attacks caused by the follow-up cases in the periodical SRS releasing scenario. A recent trend of microdata anonymization combines the traditional syntactic model and differential privacy, fusing the advantages of both models to yield a better privacy protection method. This paper proposes the PPMS-DP(k, θ*, ε) framework, an enhancement of PPMS(k, θ*)-bounding that embraces differential privacy to improve privacy protection of periodically released SRS data. We propose two anonymization algorithms conforming to the PPMS-DP(k, θ*, ε) framework, PPMS-DPnumand PPMS-DPall. Experimental results on the FAERS datasets show that both PPMS-DPnumand PPMS-DPallprovide significantly better privacy protection than PPMS-(k, θ*)-bounding without sacrificing data distortion and data utility.

Nowadays, spontaneous reporting systems (SRS) have been widely established to collect adverse drug events for ADR detection and analysis, e.g., the FDA Adverse Event Reporting System (FAERS). The SRS data are provided to the researchers, even open to the public, to foster the research of ADR detection and analysis. Normally, SRS data contains personal information and some sensitive value such as indication. It is necessary to de-identify the SRS data for preventing the disclosure of individual privacy before the data are published. Although there have been many different privacy preserving models and anonymization methods in the literature, they are not suitable for protecting SRS data from disclosure due to some features of SRS data. As such, we previously have proposed a privacy model called MS(k, θ*)-bounding and the associated algorithm MS-Anonymization. In the real world, the SRS data is dynamically growing and needs to be published periodically, which thwarts our single-release-focus method, i.e., MS(k, θ*)-bounding. In this paper, we present some potential attacks on periodically published SRS data and propose a new privacy model called PPMS(k, θ*)-bounding and the associated PPMS-Anonymization algorithm. Experimental results on selected FAERS datasets show that our new method can prevent privacy disclosure from the attacks in periodical data publishing scenario with reasonable sacrifice of data utility and acceptable deviation to the strength of ADR signals.