Synthetic health records can now carry a privacy guarantee: attack detection near chance at ε=8, clinical validity 0.961
Synopsis
Synthetic electronic health records have long traded clinical fidelity against formal privacy guarantees. SynthEHR-DP combines a mixed-type encoder, a temporal transformer encoder and a conditional variational autoencoder, trained under differentially private stochastic gradient descent with Rényi privacy accounting, then applies a post-hoc clinical constraint layer that spends no privacy budget. On MIMIC-IV at a total budget of ε=8 and δ=10⁻⁵, membership inference AUC is 0.52, downstream TSTR AUROC is 0.786, 4.2% below the non-private TRTR oracle of 0.821, and the clinical validity score is 0.961.
Interpretation
Synthetic electronic health records can now carry a formal privacy guarantee together with high clinical validity, rather than only one of the two. Earlier synthesis routes either sacrificed clinical fidelity or provided no formal privacy guarantee; among DP-aware baselines at the matched budget, the highest clinical validity was DP-VAE-EHR at 0.873. On MIMIC-IV at ε=8 and δ=10⁻⁵ over 5 random seeds, SynthEHR-DP reaches a clinical validity score of 0.961±0.003, at least 8.8 percentage points above every DP-aware baseline, a difference the authors report as significant at p<0.05 by bootstrap.
The privacy side sits near random guessing, indicating that the differential privacy constraint during training does hold under an empirical attack. medGAN, which carries no privacy constraint, shows membership inference AUC of 0.68±0.02 on the same data, against an ideal of 0.50. SynthEHR-DP records membership inference AUC of 0.52±0.01 and TPR@1%FPR of 1.2±0.1%; in the same table AIM records AUC 0.51±0.01, and the authors treat the 0.01 gap as measurement noise.
Generation proceeds in four steps: heterogeneous static features are compressed into one embedding, the event sequence is compressed into a context vector, a conditional variational autoencoder is trained on noisy gradients, and outputs are corrected at inference. The mixed-type encoder compresses the more than 10,000-dimensional ICD-10 one-hot space to 256 dimensions, lowering gradient sensitivity and therefore the noise needed for a given ε. Ablation shows TSTR AUROC falling from 0.786 to 0.761 without the mixed-type encoder and to 0.744 without the temporal transformer encoder, while clinical validity falls from 0.961 to 0.872 without the clinical constraint layer.
The privacy budget is split by phase: encoder pre-training uses public ontology data and spends nothing, while encoder fine-tuning and joint model training account for ε₁=2 and ε₂=6. The clinical constraint layer is applied after generation and uses only aggregate co-occurrence marginals, so it consumes no privacy budget. Trained on eICU and evaluated on MIMIC-IV without retraining, TSTR AUROC is 0.764, 2.8% below the in-distribution result, with clinical validity of 0.948.
Perspective
The demonstrated scope is structured electronic health records, meaning tabular and time-series features, excluding free-text clinical notes; evaluation runs on MIMIC-IV and eICU at a total privacy budget of ε=8 and δ=10⁻⁵. The authors propose extending the framework to free text, federated multi-site training, and tighter budgets via public-data pre-training.
The authors note that some practitioners consider ε between 1 and 3 acceptable for healthcare, and at ε=1 TSTR AUROC drops to about 0.72; the clinical validity score covers five rule categories, and expert clinician review remains the gold standard for deployment-grade evaluation; truncating sequences to 48 events may inadequately represent patients staying longer than 7 days; and differential privacy degrades statistical fidelity more for rare conditions, so minority phenotypes may be underrepresented.