# Does BERT Pretrained on Clinical Notes Reveal Sensitive Data?

**Authors:** Eric Lehman, Sarthak Jain, Karl Pichotta, Yoav Goldberg, Byron C. Wallace  
**arXiv:** [2104.07762](https://arxiv.org/abs/2104.07762)  
**Date:** 2021-04-15  
**Summary page:** https://www.summarizepaper.com/en/arxiv-id/2104.07762v2/

## Key points

- Study investigates risks of releasing weights of a BERT model trained on sensitive, non-deidentified Electronic Health Records (EHR)
- Large Transformers pretrained on clinical notes show improvements in predictive clinical tasks
- Concerns arise regarding privacy and security of patient information
- Cost and data access requirements make parameter sharing attractive, but safety of releasing weights needs assessment
- Various approaches designed to recover Personal Health Information (PHI) from trained BERT
- Focus on extracting patient names and associated medical conditions
- Simple probing methods not effective, but more sophisticated attacks may succeed in extracting sensitive information
- Privacy implications should be considered when releasing pretrained models trained on sensitive healthcare data
- Experimental setup and baseline probing models provided publicly for further research at https://github.com/elehman16/exposing_patient_data_release
- Study highlights potential risks and emphasizes need for privacy considerations and robust security measures to protect patient data.

## Summary

In the study titled "Does BERT Pretrained on Clinical Notes Reveal Sensitive Data? ", authors Eric Lehman, Sarthak Jain, Karl Pichotta, Yoav Goldberg, and Byron C. Wallace investigate the potential risks associated with releasing the weights of a BERT model trained on sensitive, non-deidentified Electronic Health Records (EHR). While large Transformers pretrained over clinical notes from EHR have shown significant improvements in predictive clinical tasks, concerns arise regarding the privacy and security of patient information. The authors highlight that the cost and data access requirements for training such models make parameter sharing an attractive option. However, if researchers have access to large sets of sensitive EHR data and train a BERT model or similar models on it, there is a need to assess whether it would be safe to release the weights of such a model. To address this concern, the authors design various approaches aimed at recovering Personal Health Information (PHI) from a trained BERT. Specifically, they focus on extracting patient names and their associated medical conditions. The study utilizes the MIMIC-III corpus of EHR for training BERT models. The findings indicate that simple probing methods are not effective in extracting sensitive information from BERT trained on the MIMIC-III corpus. However, more sophisticated "attacks" may potentially succeed in doing so. These results emphasize the importance of considering privacy implications when releasing pretrained models trained on sensitive healthcare data. To facilitate further research in this area, the authors provide their experimental setup and baseline probing models publicly available at https://github.com/elehman16/exposing_patient_data_release . This resource can aid researchers in exploring potential vulnerabilities and developing safeguards to protect patient privacy when working with pretrained clinical language models. Overall, this study sheds light on the potential risks associated with releasing weights of pretrained models trained on non-deidentified EHR data. It underscores the need for careful consideration of privacy concerns and the development of robust security measures to ensure patient data remains protected.