Individual privacy versus public good: protecting confidentiality in health research

Development of time to event prediction models using federated learning

BACKGROUND

In a wide range of diseases, it is necessary to utilize multiple data sources to obtain enough data for model training. However, performing centralized pooling of multiple data sources, while protecting each patients' sensitive data, can require a cumbersome process involving many institutional bodies. Alternatively, federated learning (FL) can be utilized to train models based on data located at multiple sites.

METHOD

We propose two methods for training time-to-event prediction models based on distributed data, relying on FL algorithms, for time-to-event prediction models. Both approach incorporates steps to allow prediction of individual-level survival curves, without exposing individual-level event times. For Cox proportional hazards models, the latter is accomplished by using a kernel smoother for the baseline hazard function. The other proposed methodology is based on general parametric likelihood theory for right-censored data. We compared these two methods in four simulation and with one real-world dataset predicting the survival probability in patients with Hodgkin lymphoma (HL).

RESULTS

The simulations demonstrated that the FL models performed similarly to the non-distributed case in all four experiments, with only slight deviations in predicted survival probabilities compared to the true model. Our findings were similar in the real-world advanced-stage HL example where the FL models were compared to their non-distributed versions, revealing only small deviations in performance.

CONCLUSION

The proposed procedures enable training of time-to-event models using data distributed across sites, without direct sharing of individual-level data and event times, while retaining a predictive performance on par with undistributed approaches.

Suicide deaths associated with climate change-induced heat anomalies in Australia: a time series regression analysis

BACKGROUND

Although environmental determinants play an important role in suicide mortality, the quantitative influence of climate change-induced heat anomalies on suicide deaths remains relatively underexamined.

OBJECTIVE

The objective is to quantify the impact of climate change-induced heat anomalies on suicide deaths in Australia from 2000 to 2019.

METHODS

A time series regression analysis using a generalised additive model was employed to explore the potentially non-linear relationship between temperature anomalies and suicide, incorporating structural variables such as sex, age, season and geographic region. Suicide deaths data were obtained from the Australian National Mortality Database, and gridded climate data of gridded surface temperatures were sourced from the Australian Gridded Climate Dataset.

FINDINGS

Heat anomalies in the study period were between 0.02°C and 2.2°C hotter than the historical period due to climate change. Our analysis revealed that approximately 0.5% (264 suicides, 95% CI 257 to 271) of the total 50 733 suicides within the study period were attributable to climate change-induced heat anomalies. Death counts associated with heat anomalies were statistically significant (p value 0.03) among men aged 55+ years old. Seasonality was a significant factor, with increased deaths during spring and summer. The relationship between high heat anomalies and suicide deaths varied across different demographic segments.

CONCLUSIONS AND IMPLICATIONS

This study highlights the measurable impact of climate change-induced heat anomalies on suicide deaths in Australia, emphasising the need for increased climate change mitigation and adaptation strategies in public health planning and suicide prevention efforts focusing on older adult men. The findings underscore the importance of considering environmental factors in addition to individual-level factors in understanding and reducing suicide mortality.

Privacy-preserving analysis of time-to-event data under nested case-control sampling

Analyses of distributed data networks of rare diseases are constrained by legitimate privacy and ethical concerns. Analytical centers (e.g. research institutions) are thus confronted with the challenging task of obtaining data from recruiting sites that are often unable or unwilling to share personal records of participants. For time-to-event data, recently popularized disclosure techniques with privacy guarantees (e.g., Differentially Private Generative Adversarial Networks) are generally computationally expensive or inaccessible to applied researchers. To perform the widely used Cox proportional hazards regression, we propose an easy-to-implement privacy-preserving data analysis technique by pooling (i.e. aggregating) individual records of covariates at recruiting sites under the nested case-control sampling framework before sharing the pooled nested case-control subcohort. We show that the pooled hazard ratio estimators, under the pooled nested case-control subsamples from the contributing sites, are maximum likelihood estimators and provide consistent estimates of the individual level full cohort HRs. Furthermore, a sampling technique for generating pseudo-event times for individual subjects that constitute the pooled nested case-control subsamples is proposed. Our method is demonstrated using extensive simulations and analysis of the National Lung Screening Trial data. The utility of our proposed approach is compared to the gold standard (full cohort) and synthetic data generated using classification and regression trees. The proposed pooling technique performs to near-optimal levels comparable to full cohort analysis or synthetic data; the efficiency improves in rare event settings when more controls are matched on during nested case-control subcohort sampling.

Associations between pressure to breastfeed and depressive, anxiety, obsessive-compulsive, and eating disorder symptoms among postpartum women

BACKGROUND

Data from qualitative interviews indicate postpartum individuals feel pressure from their healthcare providers, the media, and their partners to breastfeed their infant(s). However, the link between pressure to breastfeed and maternal mental health symptoms has not been evaluated quantitatively. The goal of the current study was to evaluate the associations between perceived pressure to breastfeed from various sources and depressive, anxiety, obsessive-compulsive, and eating disorder symptoms among postpartum individuals.

METHODS

Participants were 306 women, ages 18-39, who gave birth in the past 12 months in the United States (primarily in North Carolina). They completed an online survey about their health history (including mental health symptoms) and breastfeeding experiences.

RESULTS

Results found postpartum women perceived more pressure to breastfeed from healthcare providers and from the media compared to pressure to breastfeed from their partners. Pressure from healthcare providers was associated with depressive, obsessive-compulsive, and eating disorder symptoms, but not with anxiety symptoms. Pressure from the media was associated with only depressive and eating disorder symptoms. Pressure from partners was not significantly associated with mental health symptoms. Above and beyond the other sources of pressure, pressure from healthcare providers explained a unique proportion of variance of obsessive-compulsive and eating disorder symptoms.

LIMITATIONS

Limitations include the cross-sectional design (which limits causal interpretations), and the homogenous sample (87% identified as White).

CONCLUSIONS

Messaging and information about breastfeeding (particularly from healthcare providers) should be reviewed to determine if there is language which could be perceived as "pressure." It is important to screen for a variety of mental health symptoms, including eating disorders, in perinatal populations when discussing breastfeeding.

'Guidance should have been there 15 years ago' research stakeholders' perspectives on ancillary care in the global south: a case study of Malawi

BACKGROUND

Medical researchers in resource-constrained settings must make difficult moral decisions about the provision of ancillary care to participants where additional healthcare needs fall outside the scope of the research and are not provided for by the local healthcare system. We examined research stakeholder perceptions and experiences of ancillary care in biomedical research projects in Malawi.

METHODS

We conducted 45 qualitative in-depth interviews with key research stakeholders: researchers, health officials, research ethics committee members, research participants and grants officers from international research funding organisations. Thematic analysis was used to analyse and interpret the findings.

FINDINGS

All stakeholders perceived the provision of ancillary care to have potential health benefits to study participants in biomedical research. However, they also had concerns, particularly related to the absence of guidance to support it. Some suggested that consideration for ancillary care provision could be possible on a case-by-case basis but that most of the support from research projects should be directed towards strengthening the public health system, emphasising public good above individual or personal benefits. Some researchers and ethics committee members raised concerns about potential tensions in terms of funding, for example balancing study demands with addressing participants' additional health needs.

CONCLUSION

Our findings highlight the complexities and gaps in the guidance around the provision of ancillary care in Malawi and other resource-constrained settings more generally. To promote the provision of ancillary care, we recommend that national and international guidelines for research ethics include specific recommendations for resource-constrained settings and specific types of research.

Perceived Risk of Re-Identification in OMOP-CDM Database: A Cross-Sectional Survey

BACKGROUND

The advancement of information technology has immensely increased the quality and volume of health data. This has led to an increase in observational study, as well as to the threat of privacy invasion. Recently, a distributed research network based on the common data model (CDM) has emerged, enabling collaborative international medical research without sharing patient-level data. Although the CDM database for each institution is built inside a firewall, the risk of re-identification requires management. Hence, this study aims to elucidate the perceptions CDM users have towards CDM and risk management for re-identification.

METHODS

The survey, targeted to answer specific in-depth questions on CDM, was conducted from October to November 2020. We targeted well-experienced researchers who actively use CDM. Basic statistics (total number and percent) were computed for all covariates.

RESULTS

There were 33 valid respondents. Of these, 43.8% suggested additional anonymization was unnecessary beyond, "minimum cell count" policy, which obscures a cell with a value lower than certain number (usually 5) in shared results to minimize the liability of re-identification due to rare conditions. During extract-transform-load processes, 81.8% of respondents assumed structured data is under control from the risk of re-identification. However, respondents noted that date of birth and death were highly re-identifiable information. The majority of respondents (n = 22, 66.7%) conceded the possibility of identifier-contained unstructured data in the NOTE table.

CONCLUSION

Overall, CDM users generally attributed high reliability for privacy protection to the intrinsic nature of CDM. There was little demand for additional de-identification methods. However, unstructured data in the CDM were suspected to have risks. The necessity for a coordinating consortium to define and manage the re-identification risk of CDM was urged.

Opportunities and barriers for the use of Australian cancer registries as platforms for randomized clinical trials

It is well recognized that randomized controlled trials (RCTs) are a powerful tool to investigate causal relationships, and are considered the gold standard level of research evidence. However, RCTs can be expensive and time-consuming, and when they employ strict eligibility criteria, it results in an unrepresentative population and limited external validity. Recently, the registry-based randomized clinical trial (RRCT) has emerged as an alternative trial design. Utilizing registries to underpin such studies, RRCTs can have advantages including rapid recruitment, and enhanced generalizability. In Australia, legislated mandatory reporting of cancer diagnoses means that jurisdictional cancer registries are a rich source of systematically collected patient details, representing sound platforms for comprehensive data capture that can serve as a key tool for further research. We review the roles of cancer registries in Australia, discuss important considerations relevant to the design of RRCTs, and outline the opportunities provided by cancer registries to strengthen cancer research.

Differential privacy in health research: A scoping review

OBJECTIVE

Differential privacy is a relatively new method for data privacy that has seen growing use due its strong protections that rely on added noise. This study assesses the extent of its awareness, development, and usage in health research.

MATERIALS AND METHODS

A scoping review was conducted by searching for ["differential privacy" AND "health"] in major health science databases, with additional articles obtained via expert consultation. Relevant articles were classified according to subject area and focus.

RESULTS

A total of 54 articles met the inclusion criteria. Nine articles provided descriptive overviews, 31 focused on algorithm development, 9 presented novel data sharing systems, and 8 discussed appraisals of the privacy-utility tradeoff. The most common areas of health research where differential privacy has been discussed are genomics, neuroimaging studies, and health surveillance with personal devices. Algorithms were most commonly developed for the purposes of data release and predictive modeling. Studies on privacy-utility appraisals have considered economic cost-benefit analysis, low-utility situations, personal attitudes toward sharing health data, and mathematical interpretations of privacy risk.

DISCUSSION

Differential privacy remains at an early stage of development for applications in health research, and accounts of real-world implementations are scant. There are few algorithms for explanatory modeling and statistical inference, particularly with correlated data. Furthermore, diminished accuracy in small datasets is problematic. Some encouraging work has been done on decision making with regard to epsilon. The dissemination of future case studies can inform successful appraisals of privacy and utility.

CONCLUSIONS

More development, case studies, and evaluations are needed before differential privacy can see widespread use in health research.

Planning security architecture for health survey data storage and access

Sensitive data from health research surveys need to be protected from loss, damage or unwanted release, especially when data include personally identifying information, protected health information or other private material. Researchers and practitioners must ensure privacy and confidentiality in the architecture of data systems and in access to the data. Internal and external risks may be deliberate or accidental, involving unintended loss, modification or exposure. To prevent risk while allowing access requires balancing concerns against providing an environment that does not impede work. The authors' purpose in this paper is to draw attention to basic data security needs for health survey data from the perspective of both the health researcher/practitioner and infrastructure/programming staff to ensure that data are securely and adequately protected. We describe risk classifications and how they affect system architecture, drawing on recent experience with systems for storage of and access to electronic health survey data.

Privacy of Clinical Research Subjects: An Integrative Literature Review

With changes in clinical research practice, the importance of a study-subject's privacy and the confidentiality of their personal data is growing. However, the body of research is fragmented, and a synthesis of work in this area is lacking. Accordingly, an integrative review was performed, guided by Whittemore and Knafl's work. Data from PubMed, Scopus, and CINAHL searches from January 2012 to February 2017 were analyzed via the constant comparison method. From 16 empirical and theoretical studies, six topical aspects were identified: the evolving nature of health data in clinical research, sharing of health data, the challenges of anonymizing data, collaboration among stakeholders, the complexity of regulation, and ethics-related tension between social benefits and privacy. Study subjects' privacy is an increasingly important ethics principle for clinical research, and privacy protection is rendered even more challenging by changing research practice.

Privacy Policy and Technology in Biomedical Data Science

Privacyis an important consideration when sharing clinical data, which often contain sensitive information. Adequate protection to safeguard patient privacy and to increase public trust in biomedical research is paramount. This review covers topics in policy and technology in the context of clinical data sharing. We review policy articles related to (a) the Common Rule, HIPAA privacy and security rules, and governance; (b) patients' viewpoints and consent practices; and (c) research ethics. We identify key features of the revised Common Rule and the most notable changes since its previous version. We address data governance for research in addition to the increasing emphasis on ethical and social implications. Research ethics topics include data sharing best practices, use of data from populations of low socioeconomic status (SES), recent updates to institutional review board (IRB) processes to protect human subjects' data, and important concerns about the limitations of current policies to address data deidentification. In terms of technology, we focus on articles that have applicability in real world health care applications: deidentification methods that comply with HIPAA, data anonymization approaches to satisfy well-acknowledged issues in deidentified data, encryption methods to safeguard data analyses, and privacy-preserving predictive modeling. The first two technology topics are mostly relevant to methodologies that attempt to sanitize structured or unstructured data. The third topic includes analysis on encrypted data. The last topic includes various mechanisms to build statistical models without sharing raw data.

Assessing privacy risks in population health publications using a checklist-based approach

OBJECTIVE

Recent growth in the number of population health researchers accessing detailed datasets, either on their own computers or through virtual data centers, has the potential to increase privacy risks. In response, a checklist for identifying and reducing privacy risks in population health analysis outputs has been proposed for use by researchers themselves. In this study we explore the usability and reliability of such an approach by investigating whether different users identify the same privacy risks on applying the checklist to a sample of publications.

METHODS

The checklist was applied to a sample of 100 academic population health publications distributed among 5 readers. Cohen's κ was used to measure interrater agreement.

RESULTS

Of the 566 instances of statistical output types found in the 100 publications, the most frequently occurring were counts, summary statistics, plots, and model outputs. Application of the checklist identified 128 outputs (22.6%) with potential privacy concerns. Most of these were associated with the reporting of small counts. Among these identified outputs, the readers found no substantial actual privacy concerns when context was taken into account. Interrater agreement for identifying potential privacy concerns was generally good.

CONCLUSION

This study has demonstrated that a checklist can be a reliable tool to assist researchers with anonymizing analysis outputs in population health research. This further suggests that such an approach may have the potential to be developed into a broadly applicable standard providing consistent confidentiality protection across multiple analyses of the same data.

Selecting Optimal Subset to release under Differentially Private M-estimators from Hybrid Datasets

Privacy concern in data sharing especially for health data gains particularly increasing attention nowadays. Now some patients agree to open their information for research use, which gives rise to a new question of how to effectively use the public information to better understand the private dataset without breaching privacy. In this paper, we specialize this question as selecting an optimal subset of the public dataset for M-estimators in the framework of differential privacy (DP) in [1]. From a perspective of non-interactive learning, we first construct the weighted private density estimation from the hybrid datasets under DP. Along the same line as [2], we analyze the accuracy of the DP M-estimators based on the hybrid datasets. Our main contributions are (i) we find that the bias-variance tradeoff in the performance of our M-estimators can be characterized in the sample size of the released dataset; (2) based on this finding, we develop an algorithm to select the optimal subset of the public dataset to release under DP. Our simulation studies and application to the real datasets confirm our findings and set a guideline in the real application.

A Position Statement on Population Data Science: The Science of Data about People

Information is increasingly digital, creating opportunities to respond to pressing issues about human populations using linked datasets that are large, complex, and diverse. The potential social and individual benefits that can come from data-intensive science are large, but raise challenges of balancing individual privacy and the public good, building appropriate socio-technical systems to support data-intensive science, and determining whether defining a new field of inquiry might help move those collective interests and activities forward. A combination of expert engagement, literature review, and iterative conversations led to our conclusion that defining the field of Population Data Science (challenge 3) will help address the other two challenges as well. We define Population Data Science succinctly as the science of data about people and note that it is related to but distinct from the fields of data science and informatics. A broader definition names four characteristics of: data use for positive impact on citizens and society; bringing together and analyzing data from multiple sources; finding population-level insights; and developing safe, privacy-sensitive and ethical infrastructure to support research. One implication of these characteristics is that few people possess all of the requisite knowledge and skills of Population Data Science, so this is by nature a multi-disciplinary field. Other implications include the need to advance various aspects of science, such as data linkage technology, various forms of analytics, and methods of public engagement. These implications are the beginnings of a research agenda for Population Data Science, which if approached as a collective field, can catalyze significant advances in our understanding of trends in society, health, and human behavior.

Anonymization for outputs of population health and health services research conducted via an online data center

Objective

Online data centers (ODCs) are becoming increasingly popular for making health-related data available for research. Such centers provide good privacy protection during analysis by trusted researchers, but privacy concerns may still remain if the system outputs are not sufficiently anonymized. In this article, we propose a method for anonymizing analysis outputs from ODCs for publication in academic literature.

Methods

We use as a model system the Secure Unified Research Environment, an online computing system that allows researchers to access and analyze linked health-related data for approved studies in Australia. This model system suggests realistic assumptions for an ODC that, together with literature and practice reviews, inform our solution design.

Results

We propose a two-step approach to anonymizing analysis outputs from an ODC. A data preparation stage requires data custodians to apply some basic treatments to the dataset before making it available. A subsequent output anonymization stage requires researchers to use a checklist at the point of downloading analysis output. The checklist assists researchers with highlighting potential privacy concerns, then applying appropriate anonymization treatments.

Conclusion

The checklist can be used more broadly in health care research, not just in ODCs. Ease of online publication as well as encouragement from journals to submit supplementary material are likely to increase both the volume and detail of analysis results publicly available, which in turn will increase the need for approaches such as the one suggested in this paper.

A Review of Statistical Disclosure Control Techniques Employed by Web-Based Data Query Systems

We systematically reviewed the statistical disclosure control techniques employed for releasing aggregate data in Web-based data query systems listed in the National Association for Public Health Statistics and Information Systems (NAPHSIS). Each Web-based data query system was examined to see whether (1) it employed any type of cell suppression, (2) it used secondary cell suppression, and (3) suppressed cell counts could be calculated. No more than 30 minutes was spent on each system. Of the 35 systems reviewed, no suppression was observed in more than half (n = 18); observed counts below the threshold were observed in 2 sites; and suppressed values were recoverable in 9 sites. Six sites effectively suppressed small counts. This inquiry has revealed substantial weaknesses in the protective measures used in data query systems containing sensitive public health data. Many systems utilized no disclosure control whatsoever, and the vast majority of those that did deployed it inconsistently or inadequately.

Data Safe Havens and Trust: Toward a Common Understanding of Trusted Research Platforms for Governing Secure and Ethical Health Research

In parallel with the advances in big data-driven clinical research, the data safe haven concept has evolved over the last decade. It has led to the development of a framework to support the secure handling of health care information used for clinical research that balances compliance with legal and regulatory controls and ethical requirements while engaging with the public as a partner in its governance. We describe the evolution of 4 separately developed clinical research platforms into services throughout the United Kingdom-wide Farr Institute and their common deployment features in practice. The Farr Institute is a case study from which we propose a common definition of data safe havens as trusted platforms for clinical academic research. We use this common definition to discuss the challenges and dilemmas faced by the clinical academic research community, to help promote a consistent understanding of them and how they might best be handled in practice. We conclude by questioning whether the common definition represents a safe and trustworthy model for conducting clinical research that can stand the test of time and ongoing technical advances while paying heed to evolving public and professional concerns.