💻 computer science

SynthEHR-DP: Clinically Valid Electronic Health Record Synthesis with Differential Privacy Guarantees

The paper introduces SynthEHR-DP, a novel generative framework that combines a Mixed-Type Encoder, Temporal Transformer, and Conditional Variational Autoencoder with Differentially Private training and a post-hoc Clinical Constraint Layer to produce clinically valid, privacy-preserving synthetic Electronic Health Records that achieve state-of-the-art performance on the privacy-utility trade-off.

Original authors: Kishore Arul

Published 2026-10-26

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Kishore Arul

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the modern hospital, a patient's journey is recorded in immense detail. Every diagnosis, every medication, every vital sign, and every lab result is captured in a digital file known as an electronic health record. These records are a treasure trove for scientists, offering a window into how diseases spread, how drugs work, and how to build better tools for doctors. Yet, this same richness makes the data incredibly sensitive. Even when names and social security numbers are removed, the unique combination of a person's age, location, and medical history can often reveal their identity. This creates a difficult stalemate: researchers need access to this information to save lives, but sharing it risks violating the privacy of the very people they hope to help.

For years, the solution has been to create "synthetic" data. Instead of sharing real patient files, scientists use computer programs to generate fake records that look and behave statistically just like the real ones. The hope is that researchers can study these fake records without ever seeing a real person's data. However, a significant problem has persisted. Many of these synthetic records are either too simple to be useful for complex medical research, or they are so detailed that they accidentally leak information about the real patients they were modeled after. If a synthetic record is too perfect, a clever attacker might be able to reverse-engineer it to find the original person. The central challenge has been finding a way to make these fake records both medically accurate and mathematically guaranteed to be private.

A new study introduces a system called SynthEHR-DP, designed to solve this exact problem. The researchers built a sophisticated computer model that learns from real hospital records to generate new, synthetic ones. What sets this system apart is that it was trained using a specific mathematical technique called differential privacy. This technique works by adding a precise amount of "noise" or random disturbance to the learning process. Imagine trying to hear a single conversation in a crowded room; the noise makes it impossible to isolate any one voice, yet the overall pattern of the crowd's chatter remains clear. In the same way, the system learns the general rules of human health without memorizing the specific details of any single patient.

The team tested their system on two massive databases of real hospital records, one containing about 40,000 patients and another with roughly 200,000. They set the privacy settings to a strict level, ensuring that even if someone knew almost everything about a patient, they could not determine with any certainty whether that patient was in the training data. The results were striking. When the researchers tried to trick the system into revealing if a specific person was in the training set, the system's guesses were no better than random chance, effectively neutralizing the risk of re-identification.

Crucially, this high level of privacy did not come at the cost of usefulness. The synthetic records generated by SynthEHR-DP were not just random numbers; they held up under rigorous medical scrutiny. The system produced data that was clinically valid, meaning the relationships between different medical conditions and treatments made sense according to established medical rules. For example, the synthetic records did not suggest that a child had a condition that only affects adults, or that a patient had a heart rate that was biologically impossible. When other researchers used these synthetic records to train their own medical prediction models, those models performed almost as well as if they had been trained on the real, private data.

The researchers found that their approach outperformed previous methods that tried to balance privacy and accuracy. While other systems either sacrificed too much accuracy to be safe or were too risky to be trusted, this new method achieved a rare combination. It provided a formal, mathematical guarantee of privacy while maintaining a high degree of medical realism. The system successfully generated records that could be used to predict serious outcomes, such as whether a patient would be readmitted to the hospital or develop a severe infection, with an accuracy that was only slightly lower than what could be achieved with the real data.

One of the most significant aspects of this work is how it handles the complexity of medical data. Patient records are messy and varied, containing a mix of numbers, text codes, and timelines that change over time. The new system uses a specialized architecture to understand these different types of information simultaneously. It can process a patient's static details, like age and gender, alongside their dynamic history, such as a sequence of lab tests taken over several days. By organizing this information carefully before applying the privacy protections, the system minimizes the amount of noise needed, which helps preserve the quality of the final synthetic data.

The study also addressed a common concern in synthetic data generation: the risk that the fake records might contain impossible medical combinations. To prevent this, the researchers added a final step where the generated data is checked against a set of medical rules. This step ensures that the output is logically consistent with how human bodies work, without requiring any additional access to private patient records. This process acts as a safety net, catching any errors that might have slipped through the initial generation and correcting them before the data is released.

The implications of this work are substantial for the future of medical research. It offers a pathway for hospitals and research institutions to share data more freely without fear of violating patient privacy. If widely adopted, this technology could accelerate the discovery of new treatments and the development of better diagnostic tools, as scientists would have access to vast, high-quality datasets that are safe to use. The researchers have made their code and models available to the public, inviting others to verify the results and build upon the foundation they have laid.

Ultimately, the study demonstrates that it is possible to have both privacy and utility. The fear that protecting patient data must mean sacrificing the quality of research is not a necessary trade-off. By using advanced mathematical techniques and careful engineering, the SynthEHR-DP system shows that we can create a new kind of data resource—one that honors the dignity and privacy of patients while unlocking the full potential of medical science. The work stands as a proof that with the right tools, we can protect the individual while advancing the collective good.

Technical Summary: SynthEHR-DP

Problem Statement

The sharing of Electronic Health Records (EHRs) for secondary research is severely restricted by privacy legislation and the risk of patient re-identification. While synthetic data generation offers a potential solution by creating statistically similar datasets without containing real patient entries, existing approaches face a critical trade-off: they either sacrifice clinical fidelity or fail to provide formal privacy guarantees. Standard generative models (e.g., GANs, VAEs) without privacy constraints are vulnerable to membership inference and attribute inference attacks. Conversely, applying Differential Privacy (DP) to complex, high-dimensional, and heterogeneous EHR data often results in severe utility degradation due to the noise required to protect privacy, particularly when preserving temporal and ontological relationships.

The central research question addressed is whether synthetic EHR data can be generated that is simultaneously:

Formally $(\epsilon, \delta)$ -differentially private.
Clinically valid (adhering to medical ontologies and physiological ranges).
Useful for downstream machine learning tasks.

Methodology: SynthEHR-DP

SynthEHR-DP is a generative framework designed to address the heterogeneity and longitudinal nature of EHR data while maintaining strict privacy guarantees. The architecture consists of four primary components:

1. Mixed-Type Encoder (MTE)

EHR data contains static features (demographics, diagnoses, medications) that are a mix of continuous, categorical, binary, and multi-hot encoded vectors (e.g., ICD-10 codes). The MTE projects these heterogeneous inputs into a unified dense embedding space.

Mechanism: It uses learned linear projections for continuous and binary features and a pre-trained embedding layer for categorical ICD-10 codes.
Privacy Benefit: By reducing the effective input dimensionality from over 10,000 (full ICD-10 vocabulary) to 256 dimensions, the MTE significantly reduces the $\ell_2$ sensitivity of gradients. This reduction lowers the amount of Gaussian noise required for a given privacy budget ( $\epsilon$ ), thereby preserving utility.
Pre-training: The ICD-10 embedding layer is pre-trained on public medical ontology co-occurrence statistics (ClinicalBERT, SNOMED-CT) without using individual patient records, consuming zero privacy budget.

2. Temporal Transformer Encoder (TTE)

EHRs are longitudinal, containing irregularly sampled clinical events over time.

Mechanism: A lightweight transformer encoder (2 layers, 4 attention heads) processes the temporal sequence of clinical measurements. It utilizes continuous-time positional encoding based on elapsed time since admission.
Output: The sequence is mean-pooled to produce a fixed-size temporal context vector ( $c_i \in \mathbb{R}^{128}$ ), which conditions the generative model.

3. DP-CVAE Core

The core generative model is a Conditional Variational Autoencoder (CVAE) trained under Differentially Private Stochastic Gradient Descent (DP-SGD).

Architecture: The encoder approximates the posterior distribution $q_\phi(z | e_i, c_i)$ , and the decoder reconstructs features using type-appropriate distributions (Gaussian for continuous, Bernoulli for binary, Gumbel-Softmax for categorical).
Training Protocol: Per-sample gradients are clipped to a maximum $\ell_2$ norm ( $C=1.0$ ), and isotropic Gaussian noise is added to the batch gradient sum before parameter updates.
Accounting: R'enyi Differential Privacy (RDP) accounting is used to track the accumulated privacy loss, which is converted to $(\epsilon, \delta)$ -DP guarantees.

4. Clinical Constraint Layer (CCL)

To ensure the generated data is medically plausible, a post-hoc constraint layer is applied during inference.

Function: It enforces three tiers of constraints:
1. Hard Ontological Constraints: Rules derived from SNOMED-CT and ICD-10 guidelines (e.g., sex-specific diagnoses).
2. Physiological Plausibility: Clipping continuous values (vitals, labs) to validated clinical reference ranges.
3. Co-occurrence Soft Constraints: Penalizing statistically implausible diagnosis combinations based on non-private aggregate marginals.
Privacy Cost: Crucially, the CCL operates entirely post-generation without access to individual patient records, consuming zero additional privacy budget.

Key Contributions

SynthEHR-DP Framework: A novel architecture combining a Mixed-Type Encoder, Temporal Transformer, and DP-CVAE specifically designed for heterogeneous, longitudinal EHR data.
Dimensionality Reduction for Privacy: The MTE reduces gradient sensitivity, allowing for lower noise injection and higher utility under DP constraints.
Zero-Cost Clinical Validity: The introduction of the CCL enforces SNOMED-CT ontological consistency and physiological plausibility without consuming any privacy budget.
Comprehensive Evaluation: A rigorous evaluation on MIMIC-IV ( $N \approx 40,000$ ) and eICU ( $N \approx 200,000$ ) datasets, reporting both privacy metrics (membership inference, attribute inference, re-identification risk) and utility metrics (statistical fidelity, ML efficacy, clinical validity).
Reproducibility: Commitment to releasing open-source code and pre-trained models upon acceptance.

Results

Experiments were conducted at a total privacy budget of $(\epsilon = 8, \delta = 10^{-5})$ .

Privacy Performance

Membership Inference: SynthEHR-DP achieved an MIA AUC of 0.52, which is near-random chance (ideal 0.50), indicating strong resistance to membership inference attacks. This is a significant improvement over non-private baselines (medGAN AUC 0.68).
Attribute Inference & Re-identification: The method demonstrated low attribute inference accuracy delta ( $\Delta$ -Acc = 2.1%) and negligible re-identification risk (RiR = 0.1%), comparable to other DP-aware baselines like AIM and DP-VAE-EHR.

Utility Performance

Downstream ML Efficacy (TSTR): When trained on synthetic data and tested on real data for 30-day in-hospital mortality prediction, SynthEHR-DP achieved an AUROC of 0.786. This is within 4.2% of the non-private oracle (0.821) and statistically significantly better than the best DP-aware baseline, AIM (0.771).
Clinical Validity: The model achieved a Clinical Validity Score (CVS) of 0.961, the highest among all DP-aware baselines (surpassing the next best by $\ge 8.8$ percentage points). This confirms the effectiveness of the CCL.
Generalization: Cross-dataset evaluation (training on eICU, testing on MIMIC-IV) showed a modest generalization gap, suggesting the model learns transferable clinical distributions rather than site-specific artifacts.
Extended Tasks: The utility advantage held across four prediction tasks (Mortality, Readmission, Length of Stay, Sepsis), with consistent gaps of 4.2–4.9% from non-private baselines.

Ablation Studies

Removing the MTE reduced TSTR AUROC by 2.5%.
Removing the TTE reduced TSTR AUROC by 4.2%.
Removing the CCL reduced the Clinical Validity Score by 8.9 percentage points, with no change in privacy or other utility metrics, confirming the CCL's role in validity without privacy cost.

Significance and Claims

The paper claims that SynthEHR-DP establishes a new state-of-the-art on the privacy–utility Pareto frontier for EHR synthesis. By integrating dimensionality reduction, temporal modeling, and post-hoc clinical constraints, the framework enables the safe, open sharing of synthetic clinical data with provable patient privacy guarantees.

The author asserts that the method successfully balances the inherent trade-off between privacy and utility:

It provides formal $(\epsilon, \delta)$ -DP guarantees that bound adversarial advantage analytically.
It maintains high clinical validity through the CCL, a feature often missing in purely statistical DP methods.
It achieves utility levels close to non-private synthesis, making it viable for secondary research, drug discovery, and AI-driven diagnostics.

The paper concludes that while challenges remain regarding low privacy budgets ( $\epsilon \le 3$ ) and the exclusion of free-text notes, SynthEHR-DP represents a significant step toward enabling federated, multi-institutional EHR synthesis without raw data ever leaving individual hospital premises.