Geographic Masking Techniques for Point-Level Health Data

Part of Privacy-Preserving Spatial Analytics, this guide covers geographic masking — displacing each patient or case address point by a controlled random offset so the exact household can no longer be recovered, while the perturbed cloud still supports legitimate spatial analysis. It walks the four displacement families used in practice, the privacy-versus-utility tradeoff that governs every parameter choice, a deterministic Python implementation of donut and population-adaptive masking, and the validation and audit controls that make a masked release defensible.

Geomasking exists because the two obvious alternatives both fail. Publishing true coordinates discloses households; aggregating every point to a coarse polygon destroys the fine-scale pattern that point-pattern epidemiology exists to measure. Masking is the middle path: move each point far enough that no individual is identifiable, but no farther than the analysis can tolerate. Done well, a masked dataset yields the same cluster locations, the same density peaks, and the same distance-band structure as the true data; done carelessly, it either leaks addresses or manufactures artifacts. The difference is entirely in the displacement distribution and whether it adapts to where people actually live.

Concept & Epidemiological Alignment

A geomask replaces each true location $x_i$ with a masked location $x_i' = x_i + \delta_i$, where the displacement $\delta_i$ is drawn at random. Two design choices define a method: the distribution of the displacement distance $r = \lVert\delta_i\rVert$, and whether that distribution adapts to local conditions. The direction is almost always uniform on $[0, 2\pi)$ — there is rarely a reason to prefer one bearing — so the entire privacy-utility character of a mask lives in how far it moves points and where.

The privacy goal is stated in terms of the underlying population: a masked point is safe when enough people could plausibly have generated it. If the true point sits in a dense apartment block, a small displacement already places hundreds of candidate households between the masked location and the truth; if it sits on an isolated rural parcel, even a large displacement may leave the nearest occupied dwelling obvious. This is why a fixed displacement radius is never adequate across a heterogeneous study area, and why the strongest methods scale displacement to local population density. The formal per-record guarantee — how many people are plausibly closer to the masked point than the true one — is spatial k-anonymity, developed in Spatial K-Anonymity for Microdata and applied as a mask validator in Validating Geomasks with Spatial K-Anonymity.

The utility goal is that the perturbation preserves the spatial statistics the data will feed. Masking adds independent noise to each location, which inflates estimated inter-point distances and flattens sharp density peaks — precisely the quantities K-Function & Point Pattern Analysis measures. A displacement whose typical magnitude is small relative to the scale of the clustering being studied leaves Ripley’s $K$ almost unchanged; a displacement comparable to the radius of the disease cluster smears the signal away. The masking parameters must therefore be chosen against the analytic scale, not in the abstract.

The core process is a constrained sampling loop: draw a displacement, form a candidate masked point, test it against the privacy and habitability constraints, and resample if it fails.

Displacement Methods & Selection

The families differ only in the radial distribution $f(r)$ and whether it adapts, but those differences decide both the privacy floor and the utility cost.

Uniform random perturbation over a disc is the simplest but has a fatal weakness: the disc includes its own center, so a nontrivial fraction of points barely move, and some are masked essentially onto the truth. A half-normal (Gaussian) displacement is worse in this respect — the modal distance is zero — even though it preserves pattern beautifully because most points move only slightly. The bimodal Gaussian mitigates the problem by mixing in a second, farther mode, but the definitive fix is donut masking: forbid any displacement shorter than $r_{\min}$, so every point is guaranteed to move a minimum distance while still capped at $r_{\max}$. The full derivation and reproducible implementation live in Donut Geomasking for Patient Address Points.

Population-density-adaptive masking is donut masking whose outer radius $r_{\max}$ is enlarged where people are sparse and tightened where they are dense, so the number of people between the mask and the truth — not the distance — is held roughly constant. This is the method that behaves correctly across a study area that spans a downtown core and its rural fringe with a single configuration.

Spatial Data Prerequisites

Masking is a distance operation, so it must run in a projected, distance-preserving CRS — displacing points in degrees produces offsets that shrink toward the poles and distort the guaranteed minimum. Reproject every layer to an equal-area or local metric CRS following your Coordinate Reference Systems for Public Health standard before sampling a single offset; an EPSG:5070 CONUS Albers or the appropriate UTM zone keeps $r_{\min}$ and $r_{\max}$ in true metres.

Minimum inputs before masking:

• Case points as a projected point GeoDataFrame with a stable, non-patient identifier for join and audit — never a raw medical record number.
• Population surface — a raster of residential density or a block/block-group polygon layer with population counts — in the same CRS, used both to scale adaptive radii and to validate achieved $k$.
• Habitable-land mask — water bodies, industrial parcels, and other uninhabitable polygons — so masked points can be rejected if they land where no one lives.
• Parameters from config, not literals: $r_{\min}$, $r_{\max}$ (or the target $k$ that sets it), the RNG seed, and the maximum resample attempts.

# Reproject and attach the population surface before any displacement.
# Pinned: geopandas==0.14.4, pyproj==3.6.1
import geopandas as gpd

def prepare_for_masking(cases: gpd.GeoDataFrame, equal_area_crs="EPSG:5070") -> gpd.GeoDataFrame:
    if cases.crs is None:
        raise ValueError("Case layer has no CRS; refusing to mask in unknown units.")
    cases = cases.to_crs(equal_area_crs)            # metres, so rmin/rmax are true metres
    assert cases.geom_type.eq("Point").all(), "Geomasking expects point geometry only"
    return cases.sort_values("record_key").reset_index(drop=True)  # stable order = reproducible

Production Implementation: Donut + Adaptive Geomasking

The implementation below performs donut masking with an optional density-adaptive outer radius, draws from a seeded generator so the run is byte-reproducible, rejects candidates that land on uninhabitable land, and emits one structured audit record per point without ever logging a true coordinate. The radial sampler uses the area-correct inverse transform for an annulus, $r = \sqrt{U\,(r_{\max}^2 - r_{\min}^2) + r_{\min}^2}$ with $U \sim \mathrm{Uniform}(0,1)$, so displaced points are uniformly distributed over the ring rather than bunched at its inner edge.

# Deterministic donut + population-adaptive geomasking.
# Pinned: geopandas==0.14.4, numpy==1.26.4, shapely==2.0.4, pyproj==3.6.1
import logging
import numpy as np
import geopandas as gpd
from shapely.geometry import Point

logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(message)s")
log = logging.getLogger("geomask")

def _annulus_radius(rng, r_min, r_max, n):
    """Area-correct radii uniform over the annulus [r_min, r_max]."""
    u = rng.random(n)
    return np.sqrt(u * (r_max**2 - r_min**2) + r_min**2)

def _adaptive_rmax(density, target_k, r_floor, r_cap):
    """Outer radius so the disc is expected to contain ~target_k residents.

    density is residents per square metre at the true point. Solving
    target_k = density * pi * r_max^2 for r_max, then clamping to sane bounds.
    """
    with np.errstate(divide="ignore", invalid="ignore"):
        r = np.sqrt(target_k / (np.pi * np.maximum(density, 1e-12)))
    return np.clip(r, r_floor, r_cap)

def donut_geomask(cases: gpd.GeoDataFrame, *, seed: int, r_min: float,
                  r_max: float, target_k: int | None = None,
                  density_col: str | None = None, habitable=None,
                  max_tries: int = 25) -> gpd.GeoDataFrame:
    """Mask each case point with a seeded donut (optionally density-adaptive).

    seed        : logged RNG seed — the run is reproducible from this alone.
    r_min/r_max : fixed inner/outer radius in CRS metres.
    target_k    : if set with density_col, r_max is adapted per point to reach ~k.
    habitable   : optional shapely (multi)polygon; candidates outside are rejected.
    """
    rng = np.random.default_rng(seed)               # single seeded source
    xs = cases.geometry.x.to_numpy()
    ys = cases.geometry.y.to_numpy()
    n = len(cases)

    if target_k is not None and density_col is not None:
        rmax_i = _adaptive_rmax(cases[density_col].to_numpy(), target_k,
                                r_floor=r_max, r_cap=r_max * 6.0)
    else:
        rmax_i = np.full(n, r_max)

    out_x = np.empty(n); out_y = np.empty(n); tries = np.ones(n, dtype=int)
    for i in range(n):
        for attempt in range(1, max_tries + 1):
            theta = rng.random() * 2.0 * np.pi                       # uniform bearing
            r = _annulus_radius(rng, r_min, rmax_i[i], 1)[0]         # annulus distance
            cx, cy = xs[i] + r * np.cos(theta), ys[i] + r * np.sin(theta)
            if habitable is None or habitable.contains(Point(cx, cy)):
                out_x[i], out_y[i], tries[i] = cx, cy, attempt
                break
        else:
            # Exhausted attempts: fall back to the largest habitable-agnostic move,
            # flag it, and force manual review rather than releasing a bad mask.
            out_x[i], out_y[i], tries[i] = cx, cy, -1
            log.warning("record=%s exhausted %d tries; flagged for review",
                        cases.iloc[i]["record_key"], max_tries)

    masked = cases.copy()
    masked["geometry"] = gpd.GeoSeries(
        [Point(x, y) for x, y in zip(out_x, out_y)], crs=cases.crs)
    masked["mask_tries"] = tries

    # Audit record: parameters and seed, never a true coordinate.
    log.info("geomask done n=%d seed=%d r_min=%.1f r_max=%.1f target_k=%s "
             "flagged=%d", n, seed, r_min, r_max, target_k, int((tries < 0).sum()))
    return masked

The seed is the whole reproducibility story: given the same input order, the same seed, and the same parameters, the function returns identical masked coordinates, so a reviewer can regenerate the exact release and confirm nothing was hand-edited. That is also why the input is sorted on a stable key before masking — a shuffled input would consume the generator in a different order and produce a different, unverifiable output.

Parameter Selection & Tuning

Three quantities determine both privacy and utility, and each must be justified in writing rather than defaulted.

• Minimum radius $r_{\min}$. This is the privacy floor: no point moves less than $r_{\min}$, defeating the near-zero displacements that plague uniform and Gaussian masks. Set it to the smallest distance at which the true parcel is no longer the obvious source given local density — larger in sparse areas.
• Outer radius $r_{\max}$ or target $k$. In fixed mode $r_{\max}$ caps the utility loss; in adaptive mode you instead set a target $k$ and let $r_{\max}$ float per point so roughly $k$ residents fall inside each disc. Prefer the target-$k$ formulation when the study area spans very different densities, because a single radius cannot serve both a city and its hinterland.
• RNG seed and attempt cap. The seed is not a tuning knob but a logged constant; the attempt cap bounds how long the loop searches for a habitable landing before flagging a point for review.

Tune against the downstream analysis, not in isolation. If the release feeds distance-band cluster detection, run the intended point-pattern test on both the true and masked data over a grid of $r_{\max}$ values and pick the largest displacement whose Ripley’s $K$ still tracks the truth within tolerance — the point where privacy is maximized without destroying the signal. Mask displacement that is small relative to the clustering scale is nearly transparent to $K$; displacement comparable to that clustering scale is not.

Edge Cases & Failure Modes

• Coastal and uninhabitable landings. Near a shoreline or a large industrial parcel, a uniform-bearing draw frequently lands in water or on unpopulated land. The habitable-mask rejection above handles the common case; when a point is nearly surrounded by water, cap the retries and flag rather than forcing an absurd inland jump that distorts the pattern.
• Sparse-rural obviousness. In very low density, even a large displacement leaves the nearest dwelling identifiable. Adaptive $r_{\max}$ helps, but the honest answer is sometimes that point release is inappropriate and the record should be aggregated instead — the routing decision made in the parent section.
• Edge effects at the study boundary. Points near the frame can be displaced outside the reporting area, and the population surface beyond the edge is unknown, so achieved $k$ is under-estimated there. Pad the population surface one $r_{\max}$ beyond the boundary and clip only at output.
• Correlated re-masking. Re-running a mask with a new seed on the same points and publishing both releases lets an adversary average the two masked locations back toward the truth. Mask once, log the seed, and never republish the same records under a fresh seed.
• Zero or missing density. Adaptive $r_{\max}$ divides by local density; guard against zeros (handled by the 1e-12 floor) and impute missing density conservatively (low density → larger displacement), never as high density.

Compliance & Audit Controls

A masked release is defensible only if the masking is reconstructable and the guarantee is proven, not asserted. Bind the parameters and seed to the output, and validate achieved $k$ before release — the mask parameters alone do not prove privacy, because a large $r_{\max}$ in a dense area can still leave a low-$k$ point.

• Log parameters, never truth. Record the seed, $r_{\min}$, $r_{\max}$ (or target $k$), CRS authority, and per-point attempt count. Never write a true coordinate or a record’s real address to any log — the audit trail must not itself be a disclosure vector, consistent with the minimum-necessary rules in Compliance Mapping Frameworks.
• Validate before publishing. Compute the achieved spatial $k$ for every masked point against the population surface and refuse to release any point below the target; the procedure is detailed in the validation guide linked below.
• Deterministic re-run. Hash the configuration (seed + parameters + CRS) into the output metadata so a reviewer can regenerate byte-identical masked coordinates.
• Precision hygiene. Round masked coordinates to a precision no finer than the displacement scale so no spurious sub-metre digits imply false accuracy — align to your precision standards in epi-mapping.

Production Implementation Checklist

• All layers reprojected to a single distance-preserving CRS before any displacement
• Case points sorted on a stable, non-patient key so the seeded run is reproducible
• Displacement drawn with the area-correct annulus formula, not a uniform radius
• $r_{\min}$ set as an explicit privacy floor; $r_{\max}$ or target $k$ justified in writing
• Population surface and habitable-land mask attached in the same CRS
• RNG seed logged; masked coordinates regenerate byte-identically from it
• Candidates on uninhabitable land rejected; retry-exhausted points flagged for review
• Achieved spatial $k$ validated for every point before release
• Boundary population padded one $r_{\max}$ beyond the frame; results clipped at output
• No true coordinate or address written to any log or audit record
• Downstream point-pattern test re-run to confirm the clustering signal survived masking

Frequently Asked Questions

Why not just use a simple Gaussian or uniform displacement? Because both put their highest probability mass on tiny displacements — a uniform disc includes its own center and a half-normal peaks at zero — so a share of points barely move and some are masked essentially onto the truth. Donut masking enforces a minimum radius, guaranteeing every point moves a defensible distance.

How large should the displacement be? Large enough that at least your target number of residents lies between the mask and the truth, and no larger than the downstream analysis tolerates. In a heterogeneous study area, fix a target $k$ and let the outer radius adapt to local density rather than choosing one radius for everywhere.

Does masking ruin cluster detection? Not if the displacement is small relative to the scale of the clustering you are studying. Independent per-point noise inflates short inter-point distances and softens density peaks, so tune the radius against the intended point-pattern test and pick the largest displacement whose Ripley’s K still tracks the true data.

What must I keep to prove a masked release was done correctly? The RNG seed, the displacement parameters, the CRS, and the achieved minimum spatial k — but never a true coordinate. With the seed and parameters a reviewer regenerates the exact masked points; with the achieved k they confirm the privacy guarantee actually held.

Related Topics

• Privacy-Preserving Spatial Analytics — the parent section placing masking among the four disclosure-control method families.
• Donut Geomasking for Patient Address Points — the focused annulus-sampling implementation with minimum and maximum radii.
• Validating Geomasks with Spatial K-Anonymity — proving each masked point achieves the target k against a population surface.
• K-Function & Point Pattern Analysis — the downstream test whose signal masking must preserve.
• Spatial K-Anonymity for Microdata — the formal per-record guarantee that gives masking its privacy floor.