Privacy-preserving data sharing infrastructures for medical research: systematization and comparison

Abstract

Background Data sharing is considered a crucial part of modern medical research. Unfortunately, despite its advantages, it often faces obstacles, especially data privacy challenges. As a result, various approaches and infrastructures have been developed that aim to ensure that patients and research participants remain anonymous when data is shared. However, privacy protection typically comes at a cost, e.g. restrictions regarding the types of analyses that can be performed on shared data. What is lacking is a systematization making the trade-offs taken by different approaches transparent. The aim of the work described in this paper was to develop a systematization for the degree of privacy protection provided and the trade-offs taken by different data sharing methods. Based on this contribution, we categorized popular data sharing approaches and identified research gaps by analyzing combinations of promising properties and features that are not yet supported by existing approaches. Methods The systematization consists of different axes. Three axes relate to privacy protection aspects and were adopted from the popular Five Safes Framework: (1) safe data, addressing privacy at the input level, (2) safe settings, addressing privacy during shared processing, and (3) safe outputs, addressing privacy protection of analysis results. Three additional axes address the usefulness of approaches: (4) support for de-duplication, to enable the reconciliation of data belonging to the same individuals, (5) flexibility, to be able to adapt to different data analysis requirements, and (6) scalability, to maintain performance with increasing complexity of shared data or common analysis processes. Results Using the systematization, we identified three different categories of approaches: distributed data analyses, which exchange anonymous aggregated data, secure multi-party computation protocols, which exchange encrypted data, and data enclaves, which store pooled individual-level data in secure environments for access for analysis purposes. We identified important research gaps, including a lack of approaches enabling the de-duplication of horizontally distributed data or providing a high degree of flexibility. Conclusions There are fundamental differences between different data sharing approaches and several gaps in their functionality that may be interesting to investigate in future work. Our systematization can make the properties of privacy-preserving data sharing infrastructures more transparent and support decision makers and regulatory authorities with a better understanding of the trade-offs taken.

Real world data and data science in medical research: present and future

“…The RWD includes medical data with sensitive personal information. Therefore, data privacy has to be protected for any types of data source in compliance with national data protection laws such as the US Health Insurance Portability and Accountability Act (HIPAA), the EU General Data Protection Regulation (GDPR), and the Japan Act on the Protection of Personal Information (Personal Information Protection Commission, Government of Japan, 2020 ; Office of Civil Rights, Department of Health and Human Services, 2002 ; The European Parliament & the Council of the European Union EUR-Lex, 2019 ; Wirth et al, 2021 ). In Japan, medical data is regarded as sensitive information and consent from patients (opt-in consent) is required to use such data for secondary purposes unless it is anonymized according to the act.…”

Population health science as a unifying foundation for translational clinical and public health research

“…In many cases precise geo-spatial information is sufficient. But even after the identifiers themselves have been stripped, the greater the number of variable fields on each subject, the easier re-identification becomes ( Harron et al, 2017 ; Wirth et al, 2021 ).…”

“…Companies routinely approach health delivery systems to obtain “deidentified” patient health data ( Farr, 2018Farr ). Although the datasets can be rendered “anonymized” based on deletion of PII, techniques to link the records with existing data are abundant ( Harron et al, 2017 ; Wirth et al, 2021 ). Although such linkages have the potential to elucidate important and otherwise unanswerable questions about the relationships between social behaviors and health, the proposed arrangement would likely raise patients’ hackles, but does not violate US law, suggesting the need for approaches to more thoughtfully weigh and adjudicate trade-offs.…”

Achieving Inclusivity by Design: Social and Contextual Information in Medical Knowledge

“…The more information that is collected about an individual patient or research participant, the more difficult it is to ensure that person's privacy even after overtly identifying information such as their name or date of birth have been removed. Different data-sharing strategies have been proposed to deal with the challenge while still enabling re-use of data for research purposes [58]. Data managers have a responsibility and legal obligation to ensure that information is securely stored, and only made accessible for those purposes for which the individual has given their consent.…”