Generation and De-Identification of I ndian Clinical Discharge Summaries using LLM s (2024)

Abstract: The consequences of a healthcare data breach can be devastating for the patients, providers, and payers. The average financial impact of a data breach in recent months has been estimated to be close to USD 10 million. This is especially significant for healthcare organizations in India that are managing rapid digitization while still establishing data governance procedures that align with the letter and spirit of the law. Computer-based systems for de-identification of personal information are vulnerable to data drift, often rendering them ineffective in cross-institution settings. Therefore, a rigorous assessment of existing de-identification against local health datasets is imperative to support the safe adoption of digital health initiatives in India. Using a small set of de-identified patient discharge summaries provided by an Indian healthcare institution, in this paper, we report the nominal performance of de-identification algorithms (based on language models) trained on publicly available non-Indian datasets, pointing towards a lack of cross-institutional generalization. Similarly, experimentation with off-the-shelf de-identification systems reveals potential risks associated with the approach. To overcome data scarcity, we explore generating synthetic clinical reports (using publicly available and Indian summaries) by performing in-context learning over Large Language Models (LLMs). Our experiments demonstrate the use of generated reports as an effective strategy for creating high-performing de-identification systems with good generalization capabilities.

## introduction over 330 million patient records in india have already been linked with a unique central id (pib press release). to put this in perspective, the number roughly equals the total population of the united states. several federal initiatives aimed * equal contribution at establishing standards for medical information exchange, adoption of controlled terminologies, and promoting open architecture-based systems for the management of patient records have seen a steady rise in the adoption of electronic health records within indian healthcare institutions (ministry of health and family welfare (mohfw), @xcite . this data represents an under-utilized resource that has profound implications for informing public policy, medical research and patient care. at the same time, it also poses some serious challenges. the risks of revealing patient identity even from data that has been anonymized are well known @xcite . privacy regulations such as gdpr 2016 (european parliament and council of the european union) and the hipaa privacy rule 2003 (u.s. department of health and human services (hhs)) lay down heavy penalties on non compliance with data safety protocols. a robust data de-identification pipeline is vital if we aim to unlock insights from these electronic patient histories. natural language processing (nlp) methods for de-identification are known to perform significantly better than manual @xcite . however, these have been studied mostly in the single-institution setting. there are limited studies that evaluate de-identification performance of these methods across institutions @xcite . these suggest that nlp methods for de-identification perform poorly when evaluated on data from a different institution compared to the one that contributed the training data. this is especially significant in the context of patient data originating within indian healthcare institutions. to the best of our knowledge, studies evaluating the performance of nlp based de-identification systems on patient data from indian healthcare institutions have not yet been carried out. one reason for this might be that until recently there was no regulatory framework for accessing patient data for research. the indian digital personal data protection act 2023 (dpdpa) (ministry of electronics and information technology (meity), india) is a landmark legislation that came into effect in september 2023 and covers all organizations that process the personal data of individuals in india. similar to gdpr 2016, the dpdpa defines responsibilities for organizations that collect, store, and process data from patients in india and holds them legally accountable for safeguarding patient privacy. the dpdpa also highlights the need for a data de-identification solution that has been validated on patient data from indian healthcare institutions. the present study takes a step towards answering this imminent need. using a dataset of fully deidentified 99 discharge summaries obtained under institutional review board (irb) approval from the sanjay gandhi post graduate institute of medical sciences (sgpgims), lucknow, india, the study evaluates language models (lms) for the task of de-identification. furthermore, commercially available de-identification solutions are also evaluated. hereafter, we refer to this dataset as the indian clinical discharge summaries (icds r , subscript r refers to real) dataset. given the paucity of clinical data, the study also evaluates large language models (llms) on the task of generating synthetic clinical texts for training de-identification models. critically, the study highlights the existence of several personal health information (phi) elements in the icds r dataset that are unique to the language use and cultural practices in india. it is unlikely that the existing de-identification solutions have been trained to recognize these unique phi elements, and therefore, their detection may be unreliable. in a nutshell, we make the following contributions: automatic data de-identification methods for biomedical texts have focused on leveraging machine learning techniques to ensure privacy while maintaining data utility. named entity recognition (ner) systems have been tailored to identify and anonymize personal health information/personal identifiable information (phi/pii) from clinical narratives. earlier work explored support vector machines (svms) for identifying phi @xcite . researchers have also explored deep learning models, such as convolutional neural networks (cnns) and recurrent neural networks (rnns) @xcite , which have shown superior performance over the conventional approach. in recent years, there has been a growing interest in the application of transformer-based models like bert @xcite for the clinical ner and de-identification task @xcite . llms have also been explored for various clinical tasks such as clinical nli @xcite . hybrid approaches that combine rule-based and machine learning methods have also been developed to enhance the robustness of de-identification systems @xcite . a study by yang et al. (2019) used a hybrid model combining long short-term memory (lstm) networks with conditional random fields (crfs) for the de-identification of clinical notes. it demonstrated the effectiveness of integrating local resources and diverse word embeddings, and achieved high f1 scores across various de-identification tasks. furthermore, el azzouzi et al. (2023) de-identified french electronic health records using distant supervision and deep learning techniques. the study utilized models like bi-lstm+crf and enhanced them with contextualized word embeddings. it achieved remarkable accuracy in removing identifiable information while maintaining data utility. these innovations underscore the continuous improvement apollo hospital hospital sector 11, main road, faridabad -121001,india location discharge summary crno: 9876543210 id name: rahul kumar patient 35/ y age m department: ward c hospital unit: unit-3 ward/bed: 1423 icu hospital admission no: adm-5678901234 id admitted on: 15-08-2023 date 09:30 discharged on: 20-08-2023 date 14:00 patient type: normal consultant: dr. smitha john doctor discharge type: normal discharge correspond. address:, distt. state haryana location pin no. phone no +91-9999999999 contact admission details: patient was admitted to the hospital on 15-08-2023 date at 09:30 with a chief complaint of chest pain. he was diagnosed with acute myocardial infarction and was treated with thrombolysis and angioplasty. figure 1: a sample of annotated text from discharge summary and adaptation of de-identification methods to address the evolving challenges in data privacy. with remarkable progress made in generative ai techniques, researchers have started exploring generating synthetic clinical data. for example, medgan (choi et al., 2017) has been proposed to generate high-dimensional discrete variables such as patient records. it shows that it can produce realistic ehr data that preserves the statistical properties of the original dataset. researchers have also explored differential privacy techniques in conjunction with generative adversarial networks (gans) to ensure that the synthetic data does not allow re-identification of individuals. there is also ongoing research into hybrid models that combine rule-based and machine learning techniques to generate data that not only looks realistic but also adheres to known clinical correlations and constraints @xcite . such approaches ensure that the synthetic data is both safe and scientifically valid for use in biomedical modeling simulations. the trend highlights the potential of synthetic data to address privacy and data availability challenges in biomedical research. in this paper, we explore llms for generating synthetic clinical reports that closely resemble reports in icds r , thus capturing the underlying data generation processes. ## generated discharge summaries datasets initial experimentation showed over-fitting in models on the of in-silico biomedical experiments in addition to training data augmentation @xcite . using the samples from icds r we generated medical discharge summaries specific to indian patients using llms (gemma, llama-3-8b-instruct, and mistral-7b-instruct-v0.1) via in-context learning (icl). we experimented extensively with various prompts and discharge summaries, as explained below. our choice of llms was driven by the feasibility of instantiating these models on-premise. prompting is a key aspect of using llms. as described below, we experimented with various prompt designs. discharge summaries generation using the n2c2-2006 dataset: since the n2c2-2006 discharge summaries are publicly accessible, we generated synthetic discharge summaries based on these along with phi annotations using gemini-pro-1.0. we arrived at a functional prompt by iteratively tuning and inspecting the synthesized outputs for overall length, presence of key subsections, and correct phi annotation. while tuning our prompts, we did not check for the medical validity of the discharge summaries (see app. evaluation of the quality of the generated summaries: we assessed the face validity of the gen- ## de-identification task de-identification task: de-identification is conceptually similar to a named entity recognition task. both icds g g and icds l g were pre-processed and converted into bio format as is customary in named entity recognition development (also see app. fig. 4 ). formally, given some text, @xmath0, w 2 , w 3 , ..., w n ) containing n words, deidentification requires labeling each of the word w i with a tag t k coming from a ner tagset t 1 , t 2 , ..., t t . subsequently, the labeled entities can be redacted or replaced with fake values for privacy protection. ## model training experiments initial experiments with icds r using a 69-10-20 (train-val-test) split resulted in overfitting given that icds r is small, containing only 99 discharge summaries. we also experimented with training the model on n2c2-2006 and n2c2-2014 datasets and testing on icds r to check for cross-institutional generalization. we experimented with several combinations of real and synthetic datasets and evaluated on the test set of n2c2-2006, n2c2-2014, and icds r . ## conclusion and future directions in this paper, we explored the task of deidentification on indian clinical discharge summaries. experiments indicate a poor generalization of fine-tuned (on public datasets) models and poor performance of the off-shelf commercial systems. experiments with llm generated summaries look promising; the model fine-tuned on generated summaries and public datasets shows good generalization performance. our results are based on a small test set. using the insights from our work, we aim to set-up an active learning workflow that combines our fine-tuned model and human annotators to produce a larger test dataset on which we may evaluate overall model performance as well as by conditioning on a medical specialty. the augmented (generated summaries with original data) institution-specific dataset can be used to fine-tune ner models that have been pre-trained on phi data cost-effectively. achieving cross-institution portability remains a topic of active research. however, many open-source large language models can be deployed on-premise and, as described above, fine-tuned to provide an immediate and effective solution to personal data protection in indian healthcare institutions.