Large Transformers pretrained over clinical notes from Electronic Health Records ( EHR ) have afforded substantial gains in performance on predictive clinical tasks . The cost of training such models ( and the necessity of data access to do so ) coupled with their utility motivates parameter sharing , i.e. , the release of pretrained models such as ClinicalBERT ( Alsentzer et al . , 2019 ) . While most efforts have used deidentified EHR , many researchers have access to large sets of sensitive , nondeidentified EHR with which they might train a BERT model ( or similar ) . Would it be safe to release the weights of such a model if they did ? In this work , we design a battery of approaches intended to recover Personal Health Information ( PHI ) from a trained BERT . Specifically , we attempt to recover patient names and conditions with which they are associated . We find that simple probing methods are not able to meaningfully extract sensitive information from BERT trained over the MIMIC-III corpus of EHR . However , more sophisticated " attacks " may succeed in doing so : To facilitate such research , we make our experimental setup and baseline probing models available . 1 Pretraining large ( masked ) language models such as BERT ( Devlin et al . , 2019 ) over domain specific corpora has yielded consistent performance gains across a broad range of tasks . In biomedical NLP , this has often meant pretraining models over collections of Electronic Health Records ( EHRs ) ( Alsentzer et al . , 2019 ) . For example , Huang et al . ( 2019 ) showed that pretraining models over EHR data improves performance on clinical predictive tasks . Given their empirical utility , and the fact that pretraining large networks requires a nontrivial amount of compute , there is a natural desire to equal contribution . 1 https://github.com / elehman16/ exposing_patient_data_release . share the model parameters for use by other researchers in the community . However , in the context of pretraining models over patient EHR , this poses unique potential privacy concerns : Might the parameters of trained models leak sensitive patient information ? In the United States , the Health Insurance Portability and Accountability Act ( HIPAA ) prohibits the sharing of such text if it contains any reference to Protected Health Information ( PHI ) . If one removes all reference to PHI , the data is considered " deidentified " , and is therefore legal to share . While researchers may not directly share nondeidentified text,2 it is unclear to what extent models pretrained on non-deidentified data pose privacy risks . Further , recent work has shown that general purpose large language models are prone to memorizing sensitive information which can subsequently be extracted ( Carlini et al . , 2020 ) . In the context of biomedical NLP , such concerns have been cited as reasons for withholding direct publication of trained model weights ( McKinney et al . , 2020 ) . These uncertainties will continue to hamper dissemination of trained models among the broader biomedical NLP research community , motivating a need to investigate the susceptibility of such models to adversarial attacks . This work is a first step towards exploring the potential privacy implications of sharing model weights induced over non-deidentified EHR text . We propose and run a battery of experiments intended to evaluate the degree to which Transformers ( here , BERT ) pretrained via standard masked language modeling objectives over notes in EHR might reveal sensitive information ( Figure 1 ) . We find that simple methods are able to recover associations between patients and conditions at rates better than chance , but not with performance beyond that achievable using baseline condition frequencies . This holds even when we enrich clinical notes by explicitly inserting patient names into every sentence . Our results using a recently proposed , more sophisticated attack based on generating text ( Carlini et al . , 2020 ) are mixed , and constitute a promising direction for future work . We have performed an initial investigation into the degree to which large Transformers pretrained over EHR data might reveal sensitive personal health information ( PHI ) . We ran a battery of experiments in which we attempted to recover such information from BERT model weights estimated over the MIMIC-III dataset ( into which we artificially reintroduced patient names , as MIMIC is deidentified ) . Across these experiments , we found that we were mostly unable to meaningfully expose PHI using simple methods . Moreover , even when we constructed a variant of data in which we prepended patient names to every sentence prior to pretraining BERT , we were still unable to recover sensitive information reliably . Our initial results using more advanced techniques based on generation ( Carlini et al . 2020 ; Table 9 ) are intriguing but inconclusive at present . Our results certainly do not rule out the possibility that more advanced methods might reveal PHI . But , these findings do at least suggest that doing so is not trivial . To facilitate further research , we make our experimental setup and baseline probing models available : https://github.com/ elehman16 / exposing_patient_data_release .

Challenge: Whether distributing a language model such as BERT pre-trained on non-deidentified data like Electronic Health Records can leak sensitive patient information remains unknown.
Approach: They design a set of approaches aiming to recover Personal Health Information such as patient names and associated conditions from a trained BERT.
Outcome: They find that simple probing methods are unable to extract sensitive information better than change even by using patient names explicitly.