k-Anonymity in Context of Digitally Signed CDA Documents

If medical data are provided to third parties for secondary use, the protection of the patients privacy is an essential issue. In general this is accomplished by removing identifying and quasi-identifying information to provide k-anonymity for a given data set. This means, that one patient cannot be distinguished from at least k−1 other individuals. However, if the single records of the data set are digitally signed, the modification of the respective records destroys their integrity as well as their authenticity. Hence, digital signatures, which are an invaluable tool for verifying the integrity and authenticity of digital medical data, seem to be inadequate in this scenario. But, especially in context of secondary use, malicious manipulations and processing errors may lead to serious failures in a subsequent medical (treatment) process. In this paper we propose a novel approach based on generalized redactable signatures that realizes k-anonymity for sets of digitally signed records. To the best of our knowledge this is the first work that combines these seemingly contradictory topics very efficiently. In particular, the proposed solution allows any party to verify the original digital signatures for medical data, although these data are modified during the process of achieving k-anonymity. The main advantage of this approach is that all parties involved in the aforementioned process are able to verify the integrity and authenticity based on the original digital signatures.