A RESTful interface to pseudonymization services in modern web applications

A Scalable Pseudonymization Tool for Rapid Deployment in Large Biomedical Research Networks: Development and Evaluation Study

Background

The SARS-CoV-2 pandemic has demonstrated once again that rapid collaborative research is essential for the future of biomedicine. Large research networks are needed to collect, share, and reuse data and biosamples to generate collaborative evidence. However, setting up such networks is often complex and time-consuming, as common tools and policies are needed to ensure interoperability and the required flows of data and samples, especially for handling personal data and the associated data protection issues. In biomedical research, pseudonymization detaches directly identifying details from biomedical data and biosamples and connects them using secure identifiers, the so-called pseudonyms. This protects privacy by design but allows the necessary linkage and reidentification.

Objective

Although pseudonymization is used in almost every biomedical study, there are currently no pseudonymization tools that can be rapidly deployed across many institutions. Moreover, using centralized services is often not possible, for example, when data are reused and consent for this type of data processing is lacking. We present the ORCHESTRA Pseudonymization Tool (OPT), developed under the umbrella of the ORCHESTRA consortium, which faced exactly these challenges when it came to rapidly establishing a large-scale research network in the context of the rapid pandemic response in Europe.

Methods

To overcome challenges caused by the heterogeneity of IT infrastructures across institutions, the OPT was developed based on programmable runtime environments available at practically every institution: office suites. The software is highly configurable and provides many features, from subject and biosample registration to record linkage and the printing of machine-readable codes for labeling biosample tubes. Special care has been taken to ensure that the algorithms implemented are efficient so that the OPT can be used to pseudonymize large data sets, which we demonstrate through a comprehensive evaluation.

Results

The OPT is available for Microsoft Office and LibreOffice, so it can be deployed on Windows, Linux, and MacOS. It provides multiuser support and is configurable to meet the needs of different types of research projects. Within the ORCHESTRA research network, the OPT has been successfully deployed at 13 institutions in 11 countries in Europe and beyond. As of June 2023, the software manages data about more than 30,000 subjects and 15,000 biosamples. Over 10,000 labels have been printed. The results of our experimental evaluation show that the OPT offers practical response times for all major functionalities, pseudonymizing 100,000 subjects in 10 seconds using Microsoft Excel and in 54 seconds using LibreOffice.

Conclusions

Innovative solutions are needed to make the process of establishing large research networks more efficient. The OPT, which leverages the runtime environment of common office suites, can be used to rapidly deploy pseudonymization and biosample management capabilities across research networks. The tool is highly configurable and available as open-source software.

Development of a Trusted Third Party at a Large University Hospital: Design and Implementation Study

Background

Pseudonymization has become a best practice to securely manage the identities of patients and study participants in medical research projects and data sharing initiatives. This method offers the advantage of not requiring the direct identification of data to support various research processes while still allowing for advanced processing activities, such as data linkage. Often, pseudonymization and related functionalities are bundled in specific technical and organization units known as trusted third parties (TTPs). However, pseudonymization can significantly increase the complexity of data management and research workflows, necessitating adequate tool support. Common tasks of TTPs include supporting the secure registration and pseudonymization of patient and sample identities as well as managing consent.

Objective

Despite the challenges involved, little has been published about successful architectures and functional tools for implementing TTPs in large university hospitals. The aim of this paper is to fill this research gap by describing the software architecture and tool set developed and deployed as part of a TTP established at Charité - Universitätsmedizin Berlin.

Methods

The infrastructure for the TTP was designed to provide a modular structure while keeping maintenance requirements low. Basic functionalities were realized with the free MOSAIC tools. However, supporting common study processes requires implementing workflows that span different basic services, such as patient registration, followed by pseudonym generation and concluded by consent collection. To achieve this, an integration layer was developed to provide a unified Representational state transfer (REST) application programming interface (API) as a basis for more complex workflows. Based on this API, a unified graphical user interface was also implemented, providing an integrated view of information objects and workflows supported by the TTP. The API was implemented using Java and Spring Boot, while the graphical user interface was implemented in PHP and Laravel. Both services use a shared Keycloak instance as a unified management system for roles and rights.

Results

By the end of 2022, the TTP has already supported more than 10 research projects since its launch in December 2019. Within these projects, more than 3000 identities were stored, more than 30,000 pseudonyms were generated, and more than 1500 consent forms were submitted. In total, more than 150 people regularly work with the software platform. By implementing the integration layer and the unified user interface, together with comprehensive roles and rights management, the effort for operating the TTP could be significantly reduced, as personnel of the supported research projects can use many functionalities independently.

Conclusions

With the architecture and components described, we created a user-friendly and compliant environment for supporting research projects. We believe that the insights into the design and implementation of our TTP can help other institutions to efficiently and effectively set up corresponding structures.

Data integration between clinical research and patient care: A framework for context-depending data sharing and in silico predictions

The transfer of new insights from basic or clinical research into clinical routine is usually a lengthy and time-consuming process. Conversely, there are still many barriers to directly provide and use routine data in the context of basic and clinical research. In particular, no coherent software solution is available that allows a convenient and immediate bidirectional transfer of data between concrete treatment contexts and research settings. Here, we present a generic framework that integrates health data (e.g., clinical, molecular) and computational analytics (e.g., model predictions, statistical evaluations, visualizations) into a clinical software solution which simultaneously supports both patient-specific healthcare decisions and research efforts, while also adhering to the requirements for data protection and data quality. Specifically, our work is based on a recently established generic data management concept, for which we designed and implemented a web-based software framework that integrates data analysis, visualization as well as computer simulation and model prediction with audit trail functionality and a regulation-compliant pseudonymization service. Within the front-end application, we established two tailored views: a clinical (i.e., treatment context) perspective focusing on patient-specific data visualization, analysis and outcome prediction and a research perspective focusing on the exploration of pseudonymized data. We illustrate the application of our generic framework by two use-cases from the field of haematology/oncology. Our implementation demonstrates the feasibility of an integrated generation and backward propagation of data analysis results and model predictions at an individual patient level into clinical decision-making processes while enabling seamless integration into a clinical information system or an electronic health record.

The GAIN Registry - a New Prospective Study for Patients with Multi-organ Autoimmunity and Autoinflammation

Patient registries are a very important and essential tool for investigating rare diseases, as most physicians only see a limited number of cases during their career. Diseases of multi-organ autoimmunity and autoinflammation are especially challenging, as they are characterized by diverse clinical phenotypes and highly variable expressivity. The GAIN consortium (German multi-organ Auto Immunity Network) developed a dataset addressing these challenges. ICD-11, HPO, and ATC codes were incorporated to document various clinical manifestations and medications with a defined terminology. The GAIN dataset comprises detailed information on genetics, phenotypes, medication, and laboratory values. Between November 2019 and July 2022, twelve centers from Europe have registered 419 patients with multi-organ autoimmunity or autoinflammation. The median age at onset of symptoms was 13 years (IQR 3-28) and the median delay from onset to diagnosis was 5 years (IQR 1-14). Of 354 (84.5%) patients who were genetically tested, 248 (59.2%) had a defined monogenetic cause. For 87 (20.8%) patients, no mutation was found and for 19 (4.5%), the result was pending. The most common gene affected was NFkB1 (48, 11.5%), and the second common was CTLA4 (40, 9.5%), both genetic patient groups being fostered by specific research projects within GAIN. The GAIN registry may serve as a valuable resource for research in the inborn error of immunity community by providing a platform for etiological and diagnostic research projects, as well as observational trials on treatment options.

Profile of the multicenter cohort of the German Cancer Consortium's Clinical Communication Platform

Treatment concepts in oncology are becoming increasingly personalized and diverse. Successively, changes in standards of care mandate continuous monitoring of patient pathways and clinical outcomes based on large, representative real-world data. The German Cancer Consortium's (DKTK) Clinical Communication Platform (CCP) provides such opportunity. Connecting fourteen university hospital-based cancer centers, the CCP relies on a federated IT-infrastructure sourcing data from facility-based cancer registry units and biobanks. Federated analyses resulted in a cohort of 600,915 patients, out of which 232,991 were incident since 2013 and for which a comprehensive documentation is available. Next to demographic data (i.e., age at diagnosis: 2.0% 0-20 years, 8.3% 21-40 years, 30.9% 41-60 years, 50.1% 61-80 years, 8.8% 81+ years; and gender: 45.2% female, 54.7% male, 0.1% other) and diagnoses (five most frequent tumor origins: 22,523 prostate, 18,409 breast, 15,575 lung, 13,964 skin/malignant melanoma, 9005 brain), the cohort dataset contains information about therapeutic interventions and response assessments and is connected to 287,883 liquid and tissue biosamples. Focusing on diagnoses and therapy-sequences, showcase analyses of diagnosis-specific sub-cohorts (pancreas, larynx, kidney, thyroid gland) demonstrate the analytical opportunities offered by the cohort's data. Due to its data granularity and size, the cohort is a potential catalyst for translational cancer research. It provides rapid access to comprehensive patient groups and may improve the understanding of the clinical course of various (even rare) malignancies. Therefore, the cohort may serve as a decisions-making tool for clinical trial design and contributes to the evaluation of scientific findings under real-world conditions.

Federated electronic data capture (fEDC): Architecture and prototype

In clinical research as well as patient care, structured documentation of findings is an important task. In many cases, this is achieved by means of electronic case report forms (eCRF) using corresponding information technology systems. To avoid double data entry, eCRF systems can be integrated with electronic health records (EHR). However, when researchers from different institutions collaborate in collecting data, they often use a single joint eCRF system on the Internet. In this case, integration with EHR systems is not possible in most cases due to information security and data protection restrictions. To overcome this shortcoming, we propose a novel architecture for a federated electronic data capture system (fEDC). Four key requirements were identified for fEDC: Definitions of forms have to be available in a reliable and controlled fashion, integration with electronic health record systems must be possible, patient data should be under full local control until they are explicitly transferred for joint analysis, and the system must support data sharing principles accepted by the scientific community for both data model and data captured. With our approach, sites participating in a joint study can run their own instance of an fEDC system that complies with local standards (such as being behind a network firewall) while also being able to benefit from using identical form definitions by sharing metadata in the Operational Data Model (ODM) format published by the Clinical Data Interchange Standards Consortium (CDISC) throughout the collaboration. The fEDC architecture was validated with a working open-source prototype at five German university hospitals. The fEDC architecture provides a novel approach with the potential to significantly improve collaborative data capture: Efforts for data entry are reduced and at the same time, data quality is increased since barriers for integrating with local electronic health record systems are lowered. Further, metadata are shared and patient privacy is ensured at a high level.

The strengths and complexities of European registries concerning paediatric kidney transplantation health care

Introduction

Patient data are increasingly available in (multi)national registries, especially for rare diseases. This study aims to provide an overview of current European registries of paediatric kidney transplantation (PKT) care, their coverage, and their focus. Based on these data, we assess whether the current status is optimal for achieving our common goal: the optimalisation of health care.

Methods

A list of all PKT centres within the European Union (EU) as well as active PKT registries was compiled using existing literature and the European Platform on Rare Disease Registration. Registry staff members were contacted to obtain information about the parameters collected and the registry design. These data were compared between registries.

Results

In total, 109 PKT centres performing PKT surgery were identified in the 27 EU Member States. Currently, five European PKT registries are actively collecting data. In 39% of these centres, no data were registered within any of these five existing international registries. A large variety was observed in the number of patients, centres, and countries involved in the registries. Furthermore, variability existed regarding the inclusion criteria, definitions used, and parameters collected. Collection of perioperative urologic data are currently underrepresented in the registries.

Discussion

Currently, multiple registries are collecting valuable information in the field of PKT, covering the majority of PKT centres in Europe. Due to a large variety in the parameters collected as well as different focuses, data collection is currently fragmented and suboptimal; therefore, the current existing data are incomplete. In addition, a considerable proportion of the transplantation centres do not enter data in any international registry. Combining available information and harmonising future data collection could empower the aim of these registries-namely increasing insights into the strengths and potential of current care and therefore improve healthcare.

Record linkage based patient intersection cardinality for rare disease studies using Mainzelliste and secure multi-party computation

BACKGROUND

The low number of patients suffering from any given rare diseases poses a difficult problem for medical research: With the exception of some specialized biobanks and disease registries, potential study participants' information are disjoint and distributed over many medical institutions. Whenever some of those facilities are in close proximity, a significant overlap of patients can reasonably be expected, further complicating statistical study feasibility assessments and data gathering. Due to the sensitive nature of medical records and identifying data, data transfer and joint computations are often forbidden by law or associated with prohibitive amounts of effort. To alleviate this problem and to support rare disease research, we developed the Mainzelliste Secure EpiLinker (MainSEL) record linkage framework, a secure Multi-Party Computation based application using trusted-third-party-less cryptographic protocols to perform privacy-preserving record linkage with high security guarantees. In this work, we extend MainSEL to allow the record linkage based calculation of the number of common patients between institutions. This allows privacy-preserving statistical feasibility estimations for further analyses and data consolidation. Additionally, we created easy to deploy software packages using microservice containerization and continuous deployment/continuous integration. We performed tests with medical researchers using MainSEL in real-world medical IT environments, using synthetic patient data.

RESULTS

We show that MainSEL achieves practical runtimes, performing 10 000 comparisons in approximately 5 minutes. Our approach proved to be feasible in a wide range of network settings and use cases. The "lessons learned" from the real-world testing show the need to explicitly support and document the usage and deployment for both analysis pipeline integration and researcher driven ad-hoc analysis use cases, thus clarifying the wide applicability of our software. MainSEL is freely available under: https://github.com/medicalinformatics/MainSEL CONCLUSIONS: MainSEL performs well in real-world settings and is a useful tool not only for rare disease research, but medical research in general. It achieves practical runtimes, improved security guarantees compared to existing solutions, and is simple to deploy in strict clinical IT environments. Based on the "lessons learned" from the real-word testing, we hope to enable a wide range of medical researchers to meet their needs and requirements using modern privacy-preserving technologies.

Time-dependent prediction of mortality and cytomegalovirus reactivation after allogeneic hematopoietic cell transplantation using machine learning

Allogeneic hematopoietic cell transplantation (HCT) effectively treats high-risk hematologic diseases but can entail HCT-specific complications, which may be minimized by appropriate patient management, supported by accurate, individual risk estimation. However, almost all HCT risk scores are limited to a single risk assessment before HCT without incorporation of additional data. We developed machine learning models that integrate both baseline patient data and time-dependent laboratory measurements to individually predict mortality and cytomegalovirus (CMV) reactivation after HCT at multiple time points per patient. These gradient boosting machine models provide well-calibrated, time-dependent risk predictions and achieved areas under the receiver-operating characteristic of 0.92 and 0.83 and areas under the precision-recall curve of 0.58 and 0.62 for prediction of mortality and CMV reactivation, respectively, in a 21-day time window. Both models were successfully validated in a prospective, non-interventional study and performed on par with expert hematologists in a pilot comparison.

The DKTK EXLIQUID consortium – exploiting liquid biopsies to advance cancer precision medicine for molecular tumor board patients

Testing for genetic alterations in tumor tissue allows clinicians to identify patients who most likely will benefit from molecular targeted treatment. EXLIQUID – exploiting liquid biopsies to advance cancer precision medicine – investigates the potential of additional non-invasive tools for guiding therapy decisions and monitoring of advanced cancer patients. The term “liquid biopsy” (LB) refers to non-invasive analysis of tumor-derived circulating material such as cell-free DNA in blood samples from cancer patients. Although recent technological advances allow sensitive and specific detection of LB biomarkers, only few LB assays have entered clinical routine to date. EXLIQUID is a German Cancer Consortium (DKTK)-wide joint funding project that aims at establishing LBs as a minimally-invasive tool to analyze molecular changes in circulating tumor DNA (ctDNA). Here, we present the structure, clinical aim, and methodical approach of the new DKTK EXLIQUID consortium. Within EXLIQUID, we will set up a multicenter repository of high-quality LB samples from patients participating in DKTK MASTER and local molecular tumor boards, which use molecular profiles of tumor tissues to guide targeted therapies. We will develop LB assays for monitoring of therapy efficacy by the analysis of tumor mutant variants and tumor-specific DNA methylation patterns in ctDNA from these patients. By bringing together LB experts from all DKTK partner sites and exploiting the diversity of their particular expertise, complementary skills and technologies, the EXLIQUID consortium addresses the challenges of translating LBs into the clinic. The DKTK structure provides EXLIQUID a unique position for the identification of liquid biomarkers even in less common tumor types, thereby extending the group of patients benefitting from non-invasive LB testing. Besides its scientific aims, EXLIQUID is building a valuable precision oncology cohort and LB platform which will be available for future collaborative research studies within the DKTK and beyond.

[Safety of the Living Kidney Donor - The German National Register - Development and Structure of a National Register in the Health Service Research]

The German living donor register Safety of the Living Kidney Donor - The German National Register (SOLKID-GNR) collects data of the medical and psychosocial outcome of living kidney donors. For the first time in Germany, a prospective data collection allows a scientifically based long-term analysis of how a living kidney donation influences the psychological and physical health of living kidney donors. This will contribute directly to improve the information and care of living kidney donors.

[Germany-wide, Web-based ParaReg Registry for Lifelong Monitoring of People with Spinal Cord Injury: Data Model, Ethico-legal Prerequisites and Technical Implementation]

OBJECTIVE

In Germany, treatment paths for patients with acute spinal cord injury (SCI) differ considerably depending on intrinsic, disease-specific and extrinsic factors. Which of these factors are associated with improved outcome with fewer subsequent complications and inpatient re-admissions is not clear. The German-wide, patient-centered, web-based ParaReg registry will be implemented to improve the long-term quality of patient care and the planning of treatment paths with increased cost-effectiveness.

METHODS

In the 2017-18 conceptualization phase, the data model of the registry was developed in an iterative process of the ParaReg steering committee together with the extended DMGP board and patient representatives. In ParaReg, routine social and medical data as well as internationally established neurological, functional and participation scores will be documented. The assignment of a unique patient ID allows a lifelong, cross-center documentation of inpatient stays in one of the 27 SCI centers organized in the German-speaking Medical Society for SCI (DMGP). The ParaReg data protection concept and patient information/consent are based on the Open Source Registry for Rare Diseases (OSSE) which were extended by GDPR-relevant aspects.

RESULTS

In the realization phase, which started in 2019, the information technology infrastructure was implemented according to the clinical ID management module of the Technology and Methods Platform for Networked Medical Research (TMF). In parallel, the legal and ethical prerequisites for registry operation under the patronage of the DMGP were created. Recommendations of the working group data protection of the TMF were integrated into ParaReg's data protection concept. Based on the feedback from the alpha test phase with documentation of the hospitalization data of 40 patients, the ergonomics of the electronic case report forms were improved in particular for data entry on mobile devices.

CONCLUSION

After completion of the monocentric alpha test phase, the multicenter data acquisition was started in 5 DMGP-SCI centers. The sustainability of ParaReg is ensured by the structural and financial support of the DMGP after expiry of the funding by the German Federal Ministry of Education and Research (BMBF).

The efficacy of automated feedback after internet-based depression screening: Study protocol of the German, three-armed, randomised controlled trial DISCOVER

BACKGROUND

Depression is one of the most disabling disorders worldwide, yet it often remains undetected. One promising approach to address both early detection and disease burden is depression screening followed by direct feedback to patients. Evidence suggests that individuals often seek information regarding mental health on the internet. Thus, internet-based screening with automated feedback has great potential to address individuals with undetected depression.

OBJECTIVES

To determine whether automated feedback after internet-based depression screening reduces depression severity as compared to no feedback.

METHODS

The internet-based, observer-blinded DISCOVER RCT aims to recruit a total of 1074 individuals. Participants will be screened for depression using the Patient Health Questionnaire (PHQ-9). In case of a positive screening result (PHQ-9 ≥ 10), participants with undetected depression will be randomised into one of three balanced study arms to receive either (a) no feedback (control arm), (b) standard feedback, or (c) tailored feedback on their screening result. The tailored feedback version will be adapted to participants' characteristics, i.e. symptom profile, preferences, and demographic characteristics. The primary hypothesis is that feedback reduces depression severity six months after screening compared to no feedback. The secondary hypothesis is that tailored feedback is more efficacious compared to standard feedback. Further outcomes are depression care, help-seeking behaviour, health-related quality of life, anxiety, somatic symptom severity, intervention acceptance, illness beliefs, adverse events, and a health economic evaluation. Follow-ups will be conducted one month and six months after screening by self-report questionnaires and clinical interviews. According to a statistical analysis plan, the primary outcome will be analysed on an intention-to-treat basis applying multilevel modelling.

DISCUSSION

The results of the DISCOVER RCT will inform about how automated feedback after internet-based screening could improve early detection and resolution of depression. Ways of dissemination and how the trial can contribute to an understanding of help-seeking behaviour processes will be discussed. If the results show that automated feedback after internet-based depression screening can reduce depression severity, the intervention could be easily implemented and might substantially reduce the disease burden of individuals with undetected depression.

ETHICAL APPROVAL

The study is approved by the Ethics Committee of the Hamburg Medical Association.

TRIAL REGISTRATION

The trial was registered at ClinicalTrials.gov in November 2020 (identifier: NCT04633096).

MAGICPL: A Generic Process Description Language for Distributed Pseudonymization Scenarios

OBJECTIVES

 Pseudonymization is an important aspect of projects dealing with sensitive patient data. Most projects build their own specialized, hard-coded, solutions. However, these overlap in many aspects of their functionality. As any re-implementation binds resources, we would like to propose a solution that facilitates and encourages the reuse of existing components.

METHODS

 We analyzed already-established data protection concepts to gain an insight into their common features and the ways in which their components were linked together. We found that we could represent these pseudonymization processes with a simple descriptive language, which we have called MAGICPL, plus a relatively small set of components. We designed MAGICPL as an XML-based language, to make it human-readable and accessible to nonprogrammers. Additionally, a prototype implementation of the components was written in Java. MAGICPL makes it possible to reference the components using their class names, making it easy to extend or exchange the component set. Furthermore, there is a simple HTTP application programming interface (API) that runs the tasks and allows other systems to communicate with the pseudonymization process.

RESULTS

 MAGICPL has been used in at least three projects, including the re-implementation of the pseudonymization process of the German Cancer Consortium, clinical data flows in a large-scale translational research network (National Network Genomic Medicine), and for our own institute's pseudonymization service.

CONCLUSIONS

 Putting our solution into productive use at both our own institute and at our partner sites facilitated a reduction in the time and effort required to build pseudonymization pipelines in medical research.

How to design a registry for undiagnosed patients in the framework of rare disease diagnosis: suggestions on software, data set and coding system

BACKGROUND

About 30 million people in the EU and USA, respectively, suffer from a rare disease. Driven by European legislative requirements, national strategies for the improvement of care in rare diseases are being developed. To improve timely and correct diagnosis for patients with rare diseases, the development of a registry for undiagnosed patients was recommended by the German National Action Plan. In this paper we focus on the question on how such a registry for undiagnosed patients can be built and which information it should contain.

RESULTS

To develop a registry for undiagnosed patients, a software for data acquisition and storage, an appropriate data set and an applicable terminology/classification system for the data collected are needed. We have used the open-source software Open-Source Registry System for Rare Diseases (OSSE) to build the registry for undiagnosed patients. Our data set is based on the minimal data set for rare disease patient registries recommended by the European Rare Disease Registries Platform. We extended this Common Data Set to also include symptoms, clinical findings and other diagnoses. In order to ensure findability, comparability and statistical analysis, symptoms, clinical findings and diagnoses have to be encoded. We evaluated three medical ontologies (SNOMED CT, HPO and LOINC) for their usefulness. With exact matches of 98% of tested medical terms, a mean number of five deposited synonyms, SNOMED CT seemed to fit our needs best. HPO and LOINC provided 73% and 31% of exacts matches of clinical terms respectively. Allowing more generic codes for a defined symptom, with SNOMED CT 99%, with HPO 89% and with LOINC 39% of terms could be encoded.

CONCLUSIONS

With the use of the OSSE software and a data set, which, in addition to the Common Data Set, focuses on symptoms and clinical findings, a functioning and meaningful registry for undiagnosed patients can be implemented. The next step is the implementation of the registry in centres for rare diseases. With the help of medical informatics and big data analysis, case similarity analyses could be realized and aid as a decision-support tool enabling diagnosis of some undiagnosed patients.

Optimization of the Mainzelliste software for fast privacy-preserving record linkage

BACKGROUND

Data analysis for biomedical research often requires a record linkage step to identify records from multiple data sources referring to the same person. Due to the lack of unique personal identifiers across these sources, record linkage relies on the similarity of personal data such as first and last names or birth dates. However, the exchange of such identifying data with a third party, as is the case in record linkage, is generally subject to strict privacy requirements. This problem is addressed by privacy-preserving record linkage (PPRL) and pseudonymization services. Mainzelliste is an open-source record linkage and pseudonymization service used to carry out PPRL processes in real-world use cases.

METHODS

We evaluate the linkage quality and performance of the linkage process using several real and near-real datasets with different properties w.r.t. size and error-rate of matching records. We conduct a comparison between (plaintext) record linkage and PPRL based on encoded records (Bloom filters). Furthermore, since the Mainzelliste software offers no blocking mechanism, we extend it by phonetic blocking as well as novel blocking schemes based on locality-sensitive hashing (LSH) to improve runtime for both standard and privacy-preserving record linkage.

RESULTS

The Mainzelliste achieves high linkage quality for PPRL using field-level Bloom filters due to the use of an error-tolerant matching algorithm that can handle variances in names, in particular missing or transposed name compounds. However, due to the absence of blocking, the runtimes are unacceptable for real use cases with larger datasets. The newly implemented blocking approaches improve runtimes by orders of magnitude while retaining high linkage quality.

CONCLUSION

We conduct the first comprehensive evaluation of the record linkage facilities of the Mainzelliste software and extend it with blocking methods to improve its runtime. We observed a very high linkage quality for both plaintext as well as encoded data even in the presence of errors. The provided blocking methods provide order of magnitude improvements regarding runtime performance thus facilitating the use in research projects with large datasets and many participants.

Good Practice Data Linkage (GPD): A Translation of the German Version

The data linkage of different data sources for research purposes is being increasingly used in recent years. However, generally accepted methodological guidance is missing. The aim of this article is to provide methodological guidelines and recommendations for research projects that have been consented to across different German research societies. Another aim is to endow readers with a checklist for the critical appraisal of research proposals and articles. This Good Practice Data Linkage (GPD) was already published in German in 2019, but the aspects mentioned can easily be transferred to an international context, especially for other European Union (EU) member states. Therefore, it is now also published in English. Since 2016, an expert panel of members of different German scientific societies have worked together and developed seven guidelines with a total of 27 practical recommendations. These recommendations include (1) the research objectives, research questions, data sources, and resources; (2) the data infrastructure and data flow; (3) data protection; (4) ethics; (5) the key variables and linkage methods; (6) data validation/quality assurance; and (7) the long-term use of data for questions still to be determined. The authors provide a rationale for each recommendation. Future revisions will include new developments in science and updates of data privacy regulations.

Key components and IT assistance of participant management in clinical research: a scoping review

Objectives

Managing participants and their data are fundamental for the success of a clinical trial. Our review identifies and describes processes that deal with management of trial participants and highlights information technology (IT) assistance for clinical research in the context of participant management.

Methods

A scoping literature review design, based on the Preferred Reporting Items for Systematic Reviews and Meta-analyses statement, was used to identify literature on trial participant-related proceedings, work procedures, or workflows, and assisting electronic systems.

Results

The literature search identified 1329 articles of which 111 were included for analysis. Participant-related procedures were categorized into 4 major trial processes: recruitment, obtaining informed consent, managing identities, and managing administrative data. Our results demonstrated that management of trial participants is considered in nearly every step of clinical trials, and that IT was successfully introduced to all participant-related areas of a clinical trial to facilitate processes.

Discussion

There is no precise definition of participant management, so a broad search strategy was necessary, resulting in a high number of articles that had to be excluded. Nevertheless, this review provides a comprehensive overview of participant management-related components, which was lacking so far. The review contributes to a better understanding of how computer-assisted management of participants in clinical trials is possible.

Enabling External Inquiries to an Existing Patient Registry by Using the Open Source Registry System for Rare Diseases: Demonstration of the System Using the European Society for Immunodeficiencies Registry

BACKGROUND

The German Network on Primary Immunodeficiency Diseases (PID-NET) utilizes the European Society for Immunodeficiencies (ESID) registry as a platform for collecting data. In the context of PID-NET data, we show how registries based on custom software can be made interoperable for better collaborative access to precollected data. The Open Source Registry System for Rare Diseases (Open-Source-Registersystem für Seltene Erkrankungen [OSSE], in German) provides patient organizations, physicians, scientists, and other parties with open source software for the creation of patient registries. In addition, the necessary interoperability between different registries based on the OSSE, as well as existing registries, is supported, which allows those registries to be confederated at both the national and international levels.

OBJECTIVE

Data from the PID-NET registry should be made available in an interoperable manner without losing data sovereignty by extending the existing custom software of the registry using the OSSE registry framework.

METHODS

This paper describes the following: (1) the installation and configuration of the OSSE bridgehead, (2) an approach using a free toolchain to set up the required interfaces to connect a registry with the OSSE bridgehead, and (3) the decentralized search, which allows the formulation of inquiries that are sent to a selected set of registries of interest.

RESULTS

PID-NET uses the established and highly customized ESID registry software. By setting up a so-called OSSE bridgehead, PID-NET data are made interoperable according to a federated approach, and centrally formulated inquiries for data can be received. As the first registry to use the OSSE bridgehead, the authors introduce an approach using a free toolchain to efficiently implement and maintain the required interfaces. Finally, to test and demonstrate the system, two inquiries are realized using the graphical query builder. By establishing and interconnecting an OSSE bridgehead with the underlying ESID registry, confederated queries for data can be received and, if desired, the inquirer can be contacted to further discuss any requirements for cooperation.

CONCLUSIONS

The OSSE offers an infrastructure that provides the possibility of more collaborative and transparent research. The decentralized search functionality includes registries into one search application while still maintaining data sovereignty. The OSSE bridgehead enables any registry software to be integrated into the OSSE network. The proposed toolchain to set up the required interfaces consists of freely available software components that are well documented. The use of the decentralized search is uncomplicated to use and offers a well-structured, yet still improvable, graphical user interface to formulate queries.

Mainzelliste SecureEpiLinker (MainSEL): Privacy-Preserving Record Linkage using Secure Multi-Party Computation

Motivation

Record Linkage has versatile applications in real-world data analysis contexts, where several datasets need to be linked on the record level in the absence of any exact identifier connecting related records. An example are medical databases of patients, spread across institutions, that have to be linked on personally identifiable entries like name, date of birth or ZIP code. At the same time, privacy laws may prohibit the exchange of this personally identifiable information (PII) across institutional boundaries, ruling out the outsourcing of the record linkage task to a trusted third party. We propose to employ privacy-preserving record linkage (PPRL) techniques that prevent, to various degrees, the leakage of PII while still allowing for the linkage of related records.

Results

We develop a framework for fault-tolerant PPRL using secure multi-party computation with the medical record keeping software Mainzelliste as the data source. Our solution does not rely on any trusted third party and all PII is guaranteed to not leak under common cryptographic security assumptions. Benchmarks show the feasibility of our approach in realistic networking settings: linkage of a patient record against a database of 10 000 records can be done in 48 s over a heavily delayed (100 ms) network connection, or 3.9 s with a low-latency connection.

Availability and implementation

The source code of the sMPC node is freely available on Github at https://github.com/medicalinformatics/SecureEpilinker subject to the AGPLv3 license. The source code of the modified Mainzelliste is available at https://github.com/medicalinformatics/MainzellisteSEL.

Supplementary information

Supplementary data are available at Bioinformatics online.

Big Picture on Privacy Enhancing Technologies in e-Health: A Holistic Personal Privacy Workflow

The collection and processing of personal data offers great opportunities for technological advances, but the accumulation of vast amounts of personal data also increases the risk of misuse for malicious intentions, especially in health care. Therefore, personal data are legally protected, e.g., by the European General Data Protection Regulation (GDPR), which states that individuals must be transparently informed and have the right to take control over the processing of their personal data. In real applications privacy policies are used to fulfill these requirements which can be negotiated via user interfaces. The literature proposes privacy languages as an electronic format for privacy policies while the users privacy preferences are represented by preference languages. However, this is only the beginning of the personal data life-cycle, which also includes the processing of personal data and its transfer to various stakeholders. In this work we define a personal privacy workflow, considering the negotiation of privacy policies, privacy-preserving processing and secondary use of personal data, in context of health care data processing to survey applicable Privacy Enhancing Technologies (PETs) to ensure the individuals’ privacy. Based on a broad literature review we identify open research questions for each step of the workflow.

The NEW ESID online database network

SUMMARY

Primary Immunodeficiencies (PIDs) belong to the group of rare diseases. The European Society for Immunodeficiencies (ESID) operates an international research database application for continuous long-term documentation of patient data. The system is a web application which runs in a standard browser. Therefore, the system is easy to access from any location. Technically, the system is based on Gails backed by MariaDB with high standard security features to comply with the demands of a modern research platform.

AVAILABILITY AND IMPLEMENTATION

The ESID Online Database is accessible via the official website: https://esid.org/Working-Parties/Registry-Working-Party/ESID-Registry. A demo system is available via: https://cci-esid-reg-demo-app.uniklinik-freiburg.de/EERS with user demouser and password Demo-2019.

Assessment of scalability and performance of the record linkage tool E-PIX® in managing multi-million patients in research projects at a large university hospital in Germany

Background

The identity management is a central component in medical research. Patients are recruited from various sites, which requires an error tolerant record linkage method, to ensure that patients are registered only once. In large research projects or institutions, the identity management has to deal with several thousands or millions of patients. In environments with large numbers of patients the register process could lead to high runtimes caused by record linkage. The Central Biomaterial Bank of the Charité (ZeBanC) searched for an identity management solution, which can handle millions of patients in large research projects with an acceptable performance. The goal of this paper was to simulate the registration of several million patients using the E-PIX service at Charité – Universitätsmedizin Berlin. The E-PIX service was evaluated in terms of needed runtimes, memory requirements, and processor utilization. A total of at least 20 million patients had to be registered. The runtimes to register patients into databases with various sizes should be examined, and the maximum number of patients, which the E-PIX service could handle, should be determined.

Methods

Tools were set up or developed to measure the needed runtimes, the memory used and the processor usage to register patients into various sizes of databases. To generate runtimes close to reality, modified patient data based on transposed real patient data were used for the simulation. The transposed patient data were sent to E-PIX to measure the runtimes of the registration process. This measurement was repeated for various database sizes.

Results

E-PIX is suitable to manage multi-million patients within a dataset. With the given hardware, it was possible to register a total of more than 30 million patients. It was possible to register more than 16 thousand patients per day into this database.

Conclusions

The E-PIX tool fulfills the requirements of the Charité to be used for large research projects. The use of E-PIX is intended for the research context in the Charité.

European lipodystrophy registry: background and structure

BACKGROUND

Lipodystrophy syndromes comprise a group of extremely rare and heterogeneous diseases characterized by a selective loss of adipose tissue in the absence of nutritional deprivation or catabolic state. Because of the rarity of each lipodystrophy subform, research in this area is difficult and international co-operation mandatory. Therefore, in 2016, the European Consortium of Lipodystrophies (ECLip) decided to create a registry for patients with lipodystrophy.

RESULTS

The registry was build using the information technology Open Source Registry System for Rare Diseases in the EU (OSSE), an open-source software and toolbox. Lipodystrophy specific data forms were developed based on current knowledge of typical signs and symptoms of lipodystrophy. The platform complies with the new General Data Protection Regulation (EU) 2016/679 by ensuring patient pseudonymization, informational separation of powers, secure data storage and security of communication, user authentication, person specific access to data, and recording of access granted to any data. Inclusion criteria are all patients with any form of lipodystrophy (with the exception of HIV-associated lipodystrophy). So far 246 patients from nine centres (Amsterdam, Bologna, Izmir, Leipzig, Münster, Moscow, Pisa, Santiago de Compostela, Ulm) have been recruited. With the help from the six centres on the brink of recruitment (Cambridge, Lille, Nicosia, Paris, Porto, Rome) this number is expected to double within the next one or 2 years.

CONCLUSIONS

A European registry for all patients with lipodystrophy will provide a platform for improved research in the area of lipodystrophy. All physicians from Europe and neighbouring countries caring for patients with lipodystrophy are invited to participate in the ECLip Registry.

STUDY REGISTRATION

ClinicalTrials.gov (NCT03553420). Registered 14 March 2018, retrospectively registered.

An Architecture for Translational Cancer Research As Exemplified by the German Cancer Consortium

Networking of medical institutions by means of a capable data infrastructure has the potential to open up vast amounts of routine data to translational cancer research. However, the secondary use of information collected independently in several institutions is a challenging task of data integration. In this review, we discuss the requirements and common challenges involved in the establishment of such a platform. We present methods and tools from the field of medical informatics as solutions to semantic and technical heterogeneity, questions of data protection and record linkage, as well as issues of trust and data ownership. We also describe the architecture of an existing cancer research network as an exemplary application of these methods.

Privacy-Preserving Linkage of Genomic and Clinical Data Sets

The capacity to link records associated with the same individual across data sets is a key challenge for data-driven research. The challenge is exacerbated by the potential inclusion of both genomic and clinical data in data sets that may span multiple legal jurisdictions, and by the need to enable re-identification in limited circumstances. Privacy-Preserving Record Linkage (PPRL) methods address these challenges. In 2016, the Interdisciplinary Committee of the International Rare Diseases Research Consortium (IRDiRC) launched a task team to explore approaches to PPRL. The task team is a collaboration with the Global Alliance for Genomics and Health (GA4GH) Regulatory and Ethics and Data Security Work Streams, and aims to prepare policy and technology standards to enable highly reliable linking of records associated with the same individual without disclosing their identity except under conditions in which the use of the data has led to information of importance to the individual's safety or health, and applicable law allows or requires the return of results. The PPRL Task Force has examined the ethico-legal requirements, constraints, and implications of PPRL, and has applied this knowledge to the exploration of technology methods and approaches to PPRL. This paper reports and justifies the findings and recommendations thus far.

Modern Information Technology for Cancer Research: What's in IT for Me? An Overview of Technologies and Approaches

Information technology (IT) can enhance or change many scenarios in cancer research for the better. In this paper, we introduce several examples, starting with clinical data reuse and collaboration including data sharing in research networks. Key challenges are semantic interoperability and data access (including data privacy). We deal with gathering and analyzing genomic information, where cloud computing, uncertainties and reproducibility challenge researchers. Also, new sources for additional phenotypical data are shown in patient-reported outcome and machine learning in imaging. Last, we focus on therapy assistance, introducing tools used in molecular tumor boards and techniques for computer-assisted surgery. We discuss the need for metadata to aggregate and analyze data sets reliably. We conclude with an outlook towards a learning health care system in oncology, which connects bench and bedside by employing modern IT solutions.

Connecting healthcare and clinical research: Workflow optimizations through seamless integration of EHR, pseudonymization services and EDC systems

OBJECTIVE

In the last years, several projects promote the secondary use of routine healthcare data based on electronic health record (EHR) data. In multicenter studies, dedicated pseudonymization services are applied for unified pseudonym handling. Healthcare, clinical research and pseudonymization systems are generally disconnected. Hence, the aim of this research work is to integrate these applications and to evaluate the workflow of clinical research.

METHODS

We analyzed and identified technical solutions for legislation compliant automatic pseudonym generation and for the integration into EHR as well as electronic data capture (EDC) systems. The Mainzelliste was used as pseudonymization service, which is available as open source solution and compliant with the data privacy concept in Germany. Subject of the integration was the local EHR and an in-house developed EDC system. A time and motion study was conducted to evaluate the effects on the workflow.

RESULTS

Integration of EHR, pseudonymization service and EDC systems is technically feasible and leads to a less fragmented usage of all applications. Generated pseudonyms are obtained from the service hosted at a trusted third party and can now be used in the EDC as well as in the EHR system for direct access and re-identification. The evaluation of 90 registration iterations shows that the time for documentation has been significantly reduced in average by 39.6 s (56.3%) from 71 ± 8 s to 31 ± 5 s per registered study patient.

CONCLUSIONS

By incorporating EHR, EDC and pseudonymization systems, it is now feasible to support multicenter studies and registers out of an integrated system landscape within a hospital. Optimizing the workflow of patient registration for clinical research allows reduction of double data entry and transcription errors as well as a seamless transition from clinical routine to research data collection.

Exploiting Distributed, Heterogeneous and Sensitive Data Stocks while Maintaining the Owner’s Data Sovereignty

Background: To achieve statistical significance in medical research, biological or data samples from several bio- or databanks often need to be complemented by those of other institutions. For that purpose, IT-based search services have been established to locate datasets matching a given set of criteria in databases distributed across several institutions. However, previous approaches require data owners to disclose information about their samples, raising a barrier for their participation in the network.

Objective: To devise a method to search distributed databases for datasets matching a given set of criteria while fully maintaining their owner’s data sovereignty.

Methods: As a modification to traditional federated search services, we propose the decentral search, which allows the data owner a high degree of control. Relevant data are loaded into local bridgeheads, each under their owner’s sovereignty. Researchers can formulate criteria sets along with a project proposal using a central search broker, which then notifies the bridgeheads. The criteria are, however, treated as an inquiry rather than a query: Instead of responding with results, bridgeheads notify their owner and wait for his/her decision regarding whether and what to answer based on the criteria set, the matching datasets and the specific project proposal. Without the owner’s explicit consent, no data leaves his/ her institution.

Results: The decentral search has been deployed in one of the six German Centers for Health Research, comprised of eleven university hospitals. In the process, compliance with German data protection regulations has been confirmed. The decentral search also marks the centerpiece of an open source registry software toolbox aiming to build a national registry of rare diseases in Germany.

Conclusions: While the sacrifice of real-time answers impairs some use-cases, it leads to several beneficial side effects: improved data protection due to data parsimony, tolerance for incomplete data schema mappings and flexibility with regard to patient consent. Most importantly, as no datasets ever leave their institution, owners can reject projects without facing potential peer pressure. By its lower barrier for participation, a decentral search service is likely to attract a larger number of partners and to bring a researcher into contact with the right potential partners.

Registries in Clinical Epidemiology: the European Surveillance System on Contact Allergies (ESSCA)

Background: Disease registries rely on consistent electronic data capturing (EDC) pertinent to their objectives; either by using existing electronic data as far as available, or by implementing specific software solutions.

Objectives: To describe the current practice of an international disease registry (European Surveillance System on Contact Allergies, ESSCA, www.essca-dc.org) against different state of the art approaches for EDC.

Methods: Since 2002, ESSCA is collecting data, currently from 53 departments in 12 countries. Departmental EDC software ranges from spreadsheets to comprehensive “patch test software” based on a relational database. In the Erlangen data centre, such diverse data is imported, converted to a common format, quality checked and pooled for scientific analyses.

Results: Feed-back to participating departments for quality control is provided by standardised reports. Varying author teams publish scientific analyses addressing the objective of contact allergy surveillance.

Conclusions: Although ESSCA represents a historically grown, heterogeneous network and not one unified approach to EDC, some of its features have contributed to its viability in the last 12 years and may be useful to consider for similar investigator-initiated networks.

[Transregional tracking in newborn hearing screening]

BACKGROUND AND OBJECTIVE

When patients in the universal newborn hearing screening program move from one geographical area to another between initial screening and medical follow-up, the responsibility for their tracking also moves from one screening center to another. As a result, these patients are lost to follow-up according to the center which had initial responsibility. In cooperation with the Association of German Hearing Screening Centers ("Verband Deutscher Hörscreening-Zentralen e. V.," VDHZ) as an offer to the developers of tracking software, a concept for nationwide tracking including a reference implementation and evaluation is described.

METHODS

On the basis of error analysis of real screening data, techniques for preprocessing data, the technical background of the interface, and details regarding integration of the interface into tracking software are presented. Data from a stress test are shown.

RESULTS

In a simulation stress test with six hearing screening centers and 54,551 children, all requests were answered within an average response time of 637 ms (standard deviation, SD = 266 ms; median 613 ms). Anonymized surnames (n = 675/1.24%) and duplicate entries in the database (n = 49/0.01%) were detected.

CONCLUSION

A transregional tracking procedure using heterogeneous tracking software is possible without the use of a standardized screening ID. The presented approach seems conceptually and technically suitable.

Mobile access to virtual randomization for investigator-initiated trials

Background/aims Randomization is indispensable in clinical trials in order to provide unbiased treatment allocation and a valid statistical inference. Improper handling of allocation lists can be avoided using central systems, for example, human-based services. However, central systems are unaffordable for investigator-initiated trials and might be inaccessible from some places, where study subjects need allocations. We propose mobile access to virtual randomization, where the randomization lists are non-existent and the appropriate allocation is computed on demand. Methods The core of the system architecture is an electronic data capture system or a clinical trial management system, which is extended by an R interface connecting the R server using the Java R Interface. Mobile devices communicate via the representational state transfer web services. Furthermore, a simple web-based setup allows configuring the appropriate statistics by non-statisticians. Our comprehensive R script supports simple randomization, restricted randomization using a random allocation rule, block randomization, and stratified randomization for un-blinded, single-blinded, and double-blinded trials. For each trial, the electronic data capture system or the clinical trial management system stores the randomization parameters and the subject assignments. Results Apps are provided for iOS and Android and subjects are randomized using smartphones. After logging onto the system, the user selects the trial and the subject, and the allocation number and treatment arm are displayed instantaneously and stored in the core system. So far, 156 subjects have been allocated from mobile devices serving five investigator-initiated trials. Conclusion Transforming pre-printed allocation lists into virtual ones ensures the correct conduct of trials and guarantees a strictly sequential processing in all trial sites. Covering 88% of all randomization models that are used in recent trials, virtual randomization becomes available for investigator-initiated trials and potentially for large multi-center trials.

A generic solution for web-based management of pseudonymized data

BACKGROUND

Collaborative collection and sharing of data have become a core element of biomedical research. Typical applications are multi-site registries which collect sensitive person-related data prospectively, often together with biospecimens. To secure these sensitive data, national and international data protection laws and regulations demand the separation of identifying data from biomedical data and to introduce pseudonyms. Neither the formulation in laws and regulations nor existing pseudonymization concepts, however, are precise enough to directly provide an implementation guideline. We therefore describe core requirements as well as implementation options for registries and study databases with sensitive biomedical data.

METHODS

We first analyze existing concepts and compile a set of fundamental requirements for pseudonymized data management. Then we derive a system architecture that fulfills these requirements. Next, we provide a comprehensive overview and a comparison of different technical options for an implementation. Finally, we develop a generic software solution for managing pseudonymized data and show its feasibility by describing how we have used it to realize two research networks.

RESULTS

We have found that pseudonymization models are highly heterogeneous, already on a conceptual level. We have compiled a set of requirements from different pseudonymization schemes. We propose an architecture and present an overview of technical options. Based on a selection of technical elements, we suggest a generic solution. It supports the multi-site collection and management of biomedical data. Security measures are multi-tier pseudonymity and physical separation of data over independent backend servers. Integrated views are provided by a web-based user interface. Our approach has been successfully used to implement a national and an international rare disease network.

CONCLUSIONS

We were able to identify a set of core requirements out of several pseudonymization models. Considering various implementation options, we realized a generic solution which was implemented and deployed in research networks. Still, further conceptual work on pseudonymity is needed. Specifically, it remains unclear how exactly data is to be separated into distributed subsets. Moreover, a thorough risk and threat analysis is needed.

A workflow-driven approach to integrate generic software modules in a Trusted Third Party

BACKGROUND

Cohort studies and registries rely on massive amounts of personal medical data. Therefore, data protection and information security as well as ethical aspects gain in importance and need to be considered as early as possible during the establishment of a study. Resulting legal and ethical obligations require a precise implementation of appropriate technical and organisational measures for a Trusted Third Party.

METHODS

This paper defines and organises a consistent workflow-management to realize a Trusted Third Party. In particular, it focusses the technical implementation of a Trusted Third Party Dispatcher to provide basic functionalities (including identity management, pseudonym administration and informed consent management) and measures required to meet study specific conditions of cohort studies and registries. Thereby several independent open source software modules developed and provided by the MOSAIC project are used. This technical concept offers the necessary flexibility and extensibility to address legal and ethical requirements of individual scenarios.

RESULTS

The developed concept for a Trusted Third Party Dispatcher allows mapping single process steps as well as individual requirements and characteristics of particular studies to workflows, which in turn can be combined to model complex Trusted Third Party processes. The uniformity of this approach permits unrestricted re-combination of the available functionalities (depending on the applied software modules) for various research projects.

CONCLUSION

The proposed approach for the technical implementation of an independent Trusted Third Party reduces the effort for scenario specific implementations as well as for maintenance. The applicability and the efficacy of the concept for a workflow-driven Trusted Third Party could be confirmed during the establishment of several nationwide studies (e.g. German Centre for Cardiovascular Research and the National Cohort).