PPSEHR: A Synthetic Medical Record Generation System Based on Differential Privacy

Medical data is the cornerstone of modern healthcare systems, but its sensitivity poses privacy challenges. As an enterprise-level Streamlit application, the PPSEHR project integrates large language models (LLMs) and differential privacy algorithms to generate synthetic electronic health records (EHRs) with mathematically-proven privacy protection, aiming to resolve the core conflict between privacy protection and unlocking the value of medical data.

Medical data faces strict regulatory restrictions (such as HIPAA, GDPR) due to its highly personalized characteristics (identity identifiers, diagnostic results, etc.). Traditional desensitization methods (removing identifiers, generalization, etc.) are vulnerable to re-identification of individuals via linkage/inference attacks and also damage the statistical properties of data. Synthetic data generates entirely new fake data by learning the distribution of real data, preserving statistical patterns while eliminating the risk of exposing real individual information; PPSEHR further introduces a differential privacy framework to address privacy leakage issues caused by overfitting of generative models.

Differential Privacy: As the gold standard for privacy protection, it ensures that the algorithm's output is insensitive to the presence or absence of a single record. This is achieved by adding calibrated noise to training data queries and using DP-SGD to optimize model training; it supports users in configuring privacy budgets to balance protection strength and data utility, and provides privacy loss tracking.

Large Language Models: To meet the needs of processing medical texts (medical records, medical orders, etc.), it learns medical terminology and narrative patterns through fine-tuning, and generates coherent texts in combination with structured fields; it mitigates privacy leakage risks of pre-trained models through differential privacy fine-tuning and post-processing filtering.

The system uses Streamlit to build an interactive web interface, with core modules including:

1. Data Ingestion: Supports formats such as HL7 FHIR and CSV, and automatically identifies field types;
2. Privacy Analysis: Evaluates privacy risks of raw data and identifies sensitive attributes;
3. Synthetic Generation: Allows users to configure parameters like sample count and privacy budget, and supports incremental updates;
4. Quality Evaluation: Verifies the fidelity (distribution matching, correlation preservation) and privacy (resistance to inference attacks) of synthetic data, and generates evaluation reports.

Enterprise-level features: Multi-user access control, audit logs, API integration, containerized deployment supporting horizontal scaling.

Application Scenarios:

• Medical Research: Replace real data to accelerate algorithm development and ethical review;
• Software Development: Provide a secure testing environment to support function verification and stress testing;
• Medical Education: Offer case resources to simulate clinical experiences.

Compliance Value: The mathematical guarantee of differential privacy provides a legal basis for data sharing, which may exempt some compliance obligations under regulations like GDPR (depending on the jurisdiction), enhancing confidence in data sharing.

Challenges:

1. Trade-off between data utility and privacy: Differential privacy noise reduces data accuracy, especially in high-dimensional sparse medical data;
2. Preservation of complex medical relationships: Difficulty in capturing temporal dynamics (multiple visits) and entity relationships;
3. Fairness: Generative models may inherit or amplify biases in training data.

Future Directions: Explore adaptive noise mechanisms and privacy loss allocation strategies; improve generative architecture by combining temporal models and graph neural networks; ensure population representativeness of synthetic data to enhance fairness.