Partially Synthetic Data

Only columns with high re-identification risk or sensitivity are synthesized. Non-sensitive, structurally essential fields—such as timestamps, administrative codes, or device identifiers—remain intact.

• Targeted synthesis: Focuses computational resources on high-risk variables
• Structural preservation: Maintains referential integrity and temporal ordering
• Example: In a clinical dataset, genomic markers and income brackets are synthesized, while admission dates and hospital IDs are retained

Partially synthetic data explicitly navigates the utility-privacy trade-off by retaining real data where privacy risk is low and synthesizing only where risk is high.

• Higher utility than fully synthetic data for tasks relying on non-sensitive fields
• Stronger privacy than anonymized data for sensitive attributes
• Quantifiable: Privacy loss budgets (ε in differential privacy) can be applied selectively to synthesized columns only

Synthetic values are generated conditioned on the retained real fields, ensuring that the statistical relationships between sensitive and non-sensitive variables are preserved.

• Conditional GANs (cGANs) or Bayesian networks model P(sensitive | non-sensitive)
• Preserves correlations: A synthesized income value remains consistent with the real occupation and education fields
• Prevents semantic drift: Generated values stay within plausible ranges defined by real context

Partially synthetic data generation follows a multi-stage pipeline where each sensitive column is synthesized sequentially, conditioned on all previously processed columns.

• Ordering matters: Columns with the most dependencies are synthesized first
• Iterative refinement: Each step uses the output of prior synthesis as conditioning input
• Example: Synthesize diagnosis codes → condition medication data on synthesized diagnoses → condition lab results on both

Partially synthetic datasets require granular privacy auditing because the retained real fields create a mixed risk surface. Attackers may leverage real quasi-identifiers to re-identify synthesized sensitive values.

• k-anonymity is evaluated on the retained quasi-identifier subset
• Membership inference attacks test whether real records can be distinguished
• Nearest Neighbor Adversarial Accuracy (NNAA) measures identifiability in the combined real-synthetic space

Partially synthetic data is explicitly recognized in frameworks like HIPAA Safe Harbor and the EU AI Act, where retaining non-identifiable operational fields while synthesizing protected health information (PHI) can satisfy de-identification requirements.

• HIPAA: Retained fields must not constitute PHI or quasi-identifiers
• GDPR: Synthesized fields are not considered personal data if re-identification risk is demonstrably low
• Clinical research: IRBs increasingly accept partially synthetic data for secondary analysis

Pharmaceutical companies use partially synthetic data to share trial results with external researchers without exposing protected health information (PHI). Demographics and genomic markers are synthesized, while treatment arms, dosing schedules, and outcome measures remain untouched. This preserves the statistical validity of survival analyses and subgroup comparisons while satisfying HIPAA Safe Harbor requirements. The Yale Open Data Access (YODA) project exemplifies this model, enabling independent re-analysis of clinical trial data through controlled synthesis of participant-level identifiers.

Rare disease registries aggregate data from multiple hospitals where full synthesis would destroy the temporal disease progression patterns essential for research. Partially synthetic approaches retain actual diagnosis dates, lab values, and procedure codes while synthesizing zip codes, exact ages, and rare demographic combinations that create re-identification risk. The NIH Global Rare Diseases Patient Registry (GRDR) uses this technique to enable federated queries across institutions without exposing patient-level quasi-identifiers.

FDA-mandated post-market studies require manufacturers to share adverse event data with regulators and academic partners. Partially synthetic data retains the device model, implant date, and malfunction classification while synthesizing patient identifiers and hospital-specific variables. This enables accurate failure mode analysis and survival modeling without violating patient consent agreements. The MDEpiNet (Medical Device Epidemiology Network) initiative leverages this approach for multi-stakeholder safety signal detection.

Payers and health technology assessment bodies require granular cost and utilization data to evaluate treatment value. Partially synthetic claims datasets preserve diagnosis codes, procedure costs, and length-of-stay metrics while synthesizing member IDs and provider taxonomies. This maintains the integrity of cost-effectiveness models and budget impact analyses. The CMS Virtual Research Data Center (VRDC) program applies partial synthesis to Medicare claims, enabling researchers to run custom analyses on privacy-protected data.

International genomic consortia like the Global Alliance for Genomics and Health (GA4GH) use partially synthetic approaches to share variant-level data. Actual genomic coordinates, allele frequencies, and phenotype associations are preserved, while sample-level metadata and pedigree structures are synthesized. This enables researchers to query whether specific variants exist in a cohort without accessing individual-level genotypes, preventing membership inference attacks while supporting rare variant discovery.

Public health agencies monitor chief complaint data in real-time to detect disease outbreaks. Partially synthetic pipelines retain syndrome categories, geospatial clusters, and temporal signals while synthesizing individual patient narratives and exact arrival timestamps. The CDC National Syndromic Surveillance Program (NSSP) employs this technique to share situational awareness with local health departments without compromising patient privacy during public health emergencies.