Health data privacy through homomorphic encryption and distributed ledger computing: an ethical-legal qualitative expert assessment study

Abstract

Background Increasingly, hospitals and research institutes are developing technical solutions for sharing patient data in a privacy preserving manner. Two of these technical solutions are homomorphic encryption and distributed ledger technology. Homomorphic encryption allows computations to be performed on data without this data ever being decrypted. Therefore, homomorphic encryption represents a potential solution for conducting feasibility studies on cohorts of sensitive patient data stored in distributed locations. Distributed ledger technology provides a permanent record on all transfers and processing of patient data, allowing data custodians to audit access. A significant portion of the current literature has examined how these technologies might comply with data protection and research ethics frameworks. In the Swiss context, these instruments include the Federal Act on Data Protection and the Human Research Act. There are also institutional frameworks that govern the processing of health related and genetic data at different universities and hospitals. Given Switzerland’s geographical proximity to European Union (EU) member states, the General Data Protection Regulation (GDPR) may impose additional obligations. Methods To conduct this assessment, we carried out a series of qualitative interviews with key stakeholders at Swiss hospitals and research institutions. These included legal and clinical data management staff, as well as clinical and research ethics experts. These interviews were carried out with two series of vignettes that focused on data discovery using homomorphic encryption and data erasure from a distributed ledger platform. Results For our first set of vignettes, interviewees were prepared to allow data discovery requests if patients had provided general consent or ethics committee approval, depending on the types of data made available. Our interviewees highlighted the importance of protecting against the risk of reidentification given different types of data. For our second set, there was disagreement amongst interviewees on whether they would delete patient data locally, or delete data linked to a ledger with cryptographic hashes. Our interviewees were also willing to delete data locally or on the ledger, subject to local legislation. Conclusion Our findings can help guide the deployment of these technologies, as well as determine ethics and legal requirements for such technologies.

A Survey on Applications of Distributed Ledger Technology in Healthcare

“…Erokhin et al [13] examined DLT as a cutting-edge method of preventing subpar drugs from reaching the market and its sneaky identification. Zuenkova and Khavtorin [14] assessed the potential for DLT to enhance the digital measurement of client experience, analyzing research on independent evaluation of the quality of services offered by medical organizations and contemporary techniques to evaluate patients' satisfaction with healthcare professionals.…”

Az érzékeny kutatási adatok megosztása a személyre szabott orvoslás gyakorlatában

“…A modell és a felek között kicserélt köztes értékek persze az érzékeny adatok helyben tartása és a kicserélt adatok mennyiségének csökkentése mellett is ki vannak téve adatvédelmi kockázatoknak, amit kriptográfiai megoldásokkal lehetséges kontrollálni. Ezek a módszerek különféle stratégiákon alapulnak, mint például a differenciált adatvédelem (DP -differential privacy), a biztonságos több résztvevős számítások (SMC -secure multiparty computation) vagy a homomorf titkosítás (HE -homomorphic encryption) [22][23][24].…”

Device Authentication using Homomorphic Encryption

“…Two of these technical solutions are homomorphic encryption and distributed ledger technology. Homomorphic encryption allows encrypted patient data to be shared with other health care service providers while it is encrypted [18].…”