Stays that resemble each other
Every circle is a group of hospital stays with similar length, cost, severity and admission pattern. Diagnosis was not used for grouping; red circles are groups that nonetheless turn out to be mostly one diagnosis category. Select a circle to see what sets it apart.
Cluster Hierarchy
Thinned for PreviewFrom raw records to groups you can explain
Start from data that is already de-identified
New York State publishes every inpatient discharge with identifiers removed: age in five bands, ZIP code cut to three digits, year only. DataExplorer keeps the clinical and financial fields and drops facility identifiers.
2,196,737 discharges in the 2024 file; a reproducible random sample of 150,000 is explored here.
Remove records that cannot be compared
Stays with missing severity, age band or diagnosis group are dropped, as are stays billed at under $100, which are data-entry artefacts.
2,196,240 of 2,196,737 discharges were usable.
Compare each stay with its peers
Length of stay and cost are log-scaled. Each stay is also ranked against all stays with the same diagnosis-related group, so a long stay for a simple case stands out from a long stay for a complex one.
5 volume features, 6 ratio features and 2 indicators.
Group similar stays
HDBSCAN builds the hierarchy from length, cost, severity, mortality risk, age band and admission type. Diagnosis categories and payer are left out, so they can be used to interpret the result.
147 clusters; none smaller than 100 stays.
Apply the release controls
Before anything leaves the service, groups under ten are withheld, counts and averages receive calibrated noise, and record-level views are reduced to a coarsened sample.
k = 10; differential-privacy noise with ε = 1 per statistic.
Compare cohorts side by side
Open up to four clusters next to each other, see their diagnosis, admission and payer mix, and the features that distinguish them.
All of it runs in the browser against the live service.
Protection at every layer
These controls are active in the live explorer. They decide what the service is willing to release, whatever is asked of it.
De-identified at the source
The state removes direct identifiers before publication. Ages are bands, ZIP codes are three digits, and dates are reduced to the year.
Small groups are withheld
No cluster and no category count is shown for fewer than ten stays. A group that small is reported only as withheld.
Calibrated noise on every aggregate
Counts and averages carry differential-privacy noise. The noise is fixed per question, so asking again does not average it away.
Coarsened record views
Record-level views are a fixed random sample of at most 1,500 stays with numbers rounded to two significant digits.
No raw file on the public service
Clustering is done ahead of time. The deployed service carries only the prepared, protected table.
Audit trail
Every question asked of a protected dataset is written to the service log.
Compute on data that stays hidden
Three techniques let organisations answer questions together without handing over their data. Each one below is a working demonstration that runs when you press the button, on regional figures from the hospital data.
A statewide total that no one has to disclose their part of
Eight health service areas each hold a private count of hospital stays. Each area splits its count into three random-looking shares and sends one to each compute node. The nodes add up what they hold. Only when the three sums are combined does a number appear, and it is the statewide total.
| Region | Private count | Share to Node A | Share to Node B | Share to Node C |
|---|
A server that adds numbers it cannot read
Your browser creates a key pair and sends out only the public half. Each region encrypts its stay count and its cost total with it. An aggregator multiplies the ciphertexts, which adds the numbers underneath, and sends back two encrypted totals. Only your browser can open them.
Look something up without revealing what you looked up
Two servers hold the same 25 summary records. Your browser sends each a random-looking selection of records; the two selections differ in exactly one place, the record you want. Each server returns its selection combined into one block. Combining the two blocks cancels everything except your record.
Retrieved Record
Reconstructed Locally- Run a retrieval to see the record.
Cohorts that are one diagnosis category
Grouping used length, cost and severity only. 36 of the 74 finest clusters are still at least 60% a single diagnosis category. Select a row to open that cluster in the preview.
| Diagnosis category | Stays | Share of cluster |
|---|---|---|
| Loading… | ||
The demonstration dataset
Hospital Inpatient Discharges (SPARCS De-Identified), 2024, published by the New York State Department of Health. The file contains no protected health information under HIPAA. The New York State Department of Health makes no representation, warranty or guarantee relating to the data or analyses derived from these data.
Dataset Profile
Analytics your privacy office can sign off
Talk to our team about DataExplorer for clinical, claims and operational data, and about deployments that use secure computation between organisations.
Request a Briefing →