Privacy versus public health: the impact of current confidentiality rules

External validity in distributed data networks

PURPOSE

While much has been written about how distributed networks address internal validity, external validity is rarely discussed. We aimed to define key terms related to external validity, discuss how they relate to distributed networks, and identify how three networks (the US Food and Drug Administration's Sentinel System, the Canadian Network for Observational Drug Effect Studies [CNODES], and the National Patient Centered Clinical Research Network [PCORnet]) deal with external validity.

METHODS

We define external validity, target populations, target validity, generalizability, and transportability and describe how each relates to distributed networks. We then describe Sentinel, CNODES, and PCORnet and how each approaches these concepts, including a sample case study.

RESULTS

Each network approaches external validity differently. As its target population is US citizens and it includes only US data, Sentinel primarily worries about lack of external validity by not including some segments of the population. The fact that CNODES includes Canadian, United States, and United Kingdom data forces them to seriously consider whether the United States and United Kingdom data will be transportable to Canadian citizens when they meta-analyze database-specific estimates. PCORnet, with its focus on study-specific cohorts and pragmatic trials, conducts more case-by-case explorations of external validity for each new analytic data set it generates.

CONCLUSIONS

There is no one-size-fits-all approach to external validity within distributed networks. With these networks and comparisons between their findings becoming a key part of pharmacoepidemiology, there is a need to adapt tools for improving external validity to the distributed network setting.

A Novel Framework to Address the Complexities of Housing Insecurity and Its Associated Health Outcomes and Inequities: "Give, Partner, Invest"

The association between housing insecurity and reduced access to healthcare, diminished mental and physical health, and increased mortality is well-known. This association, along with structural racism, social inequities, and lack of economic opportunities, continues to widen the gap in health outcomes and other disparities between those in higher and lower socio-economic strata in the United States and throughout the advanced economies of the world. System-wide infrastructure failures at municipal, state, and federal government levels have inadequately addressed the difficulty with housing affordability and stability and its associated impact on health outcomes and inequities. Healthcare systems are uniquely poised to help fill this gap and engage with proposed solutions. Strategies that incorporate multiple investment pathways and emphasize community-based partnerships and innovation have the potential for broad public health impacts. In this manuscript, we describe a novel framework, "Give, Partner, Invest," which was created and utilized by the University of Pittsburgh Medical Center (UPMC) Insurance Services Division (ISD) as part of the Integrated Delivery and Finance System to demonstrate the financial, policy, partnership, and workforce levers that could make substantive investments in affordable housing and community-based interventions to improve the health and well-being of our communities. Further, we address housing policy limitations and infrastructure challenges and offer potential solutions.

A Social-Identity Theory of Information-Access Regulation (SITIAR): Understanding the Psychology of Sharing and Withholding

Secrecy, privacy, confidentiality, concealment, disclosure, and gossip all involve sharing and withholding access to information. However, existing theories do not account for the fundamental similarity between these concepts. Accordingly, it is unclear when sharing and withholding access to information will have positive or negative effects and why these effects might occur. We argue that these problems can be addressed by conceptualizing these phenomena more broadly as different kinds of information-access regulation. Furthermore, we outline a social-identity theory of information-access regulation (SITIAR) that proposes that information-access regulation shapes shared social identity, explaining why people who have access to information feel a sense of togetherness with others who have the same access and a sense of separation from those who do not. This theoretical framework unifies diverse findings across disparate lines of research and generates a number of novel predictions about how information-access regulation affects individuals and groups.

The Early Stage of the COVID-19 Outbreak in Tunisia, France, and Germany: A Systematic Mapping Review of the Different National Strategies

The multitude of national strategies used against the COVID-19 pandemic makes it necessary to review and synthesize them in order to identify potential gaps and shortcomings, and to help prioritize future control efforts. This systematic mapping review is aimed at identifying the coronavirus pandemic management strategies adopted by France, Tunisia, and Germany during the early stage of the COVID-19 outbreak. A set of government websites in addition to the PubMed and Google Scholar databases were searched to identify scientific articles and institutional documents related to the national strategies of the three countries up until July 2020. The references included were mapped and narratively synthesized based on the pillars of the Monitoring and Evaluation Framework of the Strategic Preparedness and Response Plan defined by the World Health Organization. Of the 2765 records screened, 65 documents were included in the study. The analysis of these documents showed that Germany was the first country to implement mass screening of cases and that France was the first country to implement measures to impose general containment at the national level. It also showed that Tunisia was the only country to have imposed the confinement of passengers on repatriation flights in dedicated containment centers and at the expense of the state.

Identifying and prioritizing benefits and risks of using privacy-enhancing software through participatory design: a nominal group technique study with patients living with chronic conditions

OBJECTIVE

While patients often contribute data for research, they want researchers to protect their data. As part of a participatory design of privacy-enhancing software, this study explored patients' perceptions of privacy protection in research using their healthcare data.

MATERIALS AND METHODS

We conducted 4 focus groups with 27 patients on privacy-enhancing software using the nominal group technique. We provided participants with an open source software prototype to demonstrate privacy-enhancing features and elicit privacy concerns. Participants generated ideas on benefits, risks, and needed additional information. Following a thematic analysis of the results, we deployed an online questionnaire to identify consensus across all 4 groups. Participants were asked to rank-order benefits and risks. Themes around "needed additional information" were rated by perceived importance on a 5-point Likert scale.

RESULTS

Participants considered "allowance for minimum disclosure" and "comprehensive privacy protection that is not currently available" as the most important benefits when using the privacy-enhancing prototype software. The most concerning perceived risks were "additional checks needed beyond the software to ensure privacy protection" and the "potential of misuse by authorized users." Participants indicated a desire for additional information with 6 of the 11 themes receiving a median participant rating of "very necessary" and rated "information on the data custodian" as "essential."

CONCLUSIONS

Patients recognize not only the benefits of privacy-enhancing software, but also inherent risks. Patients desire information about how their data are used and protected. Effective patient engagement, communication, and transparency in research may improve patients' comfort levels, alleviate patients' concerns, and thus promote ethical research.

Privacy concerns can explain unwillingness to download and use contact tracing apps when COVID-19 concerns are high

Governments around the world have increasingly relied on technology to promote public health, such as using electronic health records and portable fitness devices. During the COVID-19 pandemic, “contact tracing apps” for smartphones have also been promoted in many countries as a way to allow public officials to facilitate contact tracing. But uptake in virtually all countries where such apps have been promoted is slow, one reason being privacy concerns. Conducting three experiments across France (n = 471), Australia (n = 202), and the United States (n = 1005), we explore if salient COVID-19 concerns, which intuitively should increase concerns about personal and public health, might in fact increase privacy concerns and thereby reduce uptake of contact tracing apps. Using an experimental design where we randomly assign participants to either a disease concerns or control condition, we find that salient COVID-19 concerns decrease intentions to download contact tracing apps. Mediation results reveal that greater valuations of privacy explain the lower willingness. We therefore explain why COVID-19 contact tracing apps that are promoted when the pandemic is at its peak see low levels of uptake. Our results provide policy makers with implications concerning how to promote uptake to help “flatten the curve” of not just the current pandemic but potentially also future ones.

US Privacy Laws Go Against Public Preferences: Impeding Public Health and Research (Preprint)

Background

Reaping the benefits from massive volumes of data collected in all sectors to improve population health, inform personalized medicine, and transform biomedical research requires the delicate balance between the benefits and risks of using individual-level data. There is a patchwork of US data protection laws that vary depending on the type of data, who is using it, and their intended purpose. Differences in these laws challenge big data projects using data from different sources. The decisions to permit or restrict data uses are determined by elected officials; therefore, constituent input is critical to finding the right balance between individual privacy and public benefits.

Objective

This study explores the US public’s preferences for using identifiable data for different purposes without their consent.

Methods

We measured data use preferences of a nationally representative sample of 504 US adults by conducting a web-based survey in February 2020. The survey used a choice-based conjoint analysis. We selected choice-based conjoint attributes and levels based on 5 US data protection laws (Health Insurance Portability and Accountability Act, Family Educational Rights and Privacy Act, Privacy Act of 1974, Federal Trade Commission Act, and the Common Rule). There were 72 different combinations of attribute levels, representing different data use scenarios. Participants were given 12 pairs of data use scenarios and were asked to choose the scenario they were the most comfortable with. We then simulated the population preferences by using the hierarchical Bayes regression model using the ChoiceModelR package in R.

Results

Participants strongly preferred data reuse for public health and research than for profit-driven, marketing, or crime-detection activities. Participants also strongly preferred data use by universities or nonprofit organizations over data use by businesses and governments. Participants were fairly indifferent about the different types of data used (health, education, government, or economic data).

Conclusions

Our results show a notable incongruence between public preferences and current US data protection laws. Our findings appear to show that the US public favors data uses promoting social benefits over those promoting individual or organizational interests. This study provides strong support for continued efforts to provide safe access to useful data sets for research and public health. Policy makers should consider more robust public health and research data use exceptions to align laws with public preferences. In addition, policy makers who revise laws to enable data use for research and public health should consider more comprehensive protection mechanisms, including transparent use of data and accountability.

Balancing Personal Privacy and Public Safety During COVID-19: The Case of South Korea

There has been vigorous debate on how different countries responded to the COVID-19 pandemic. To secure public safety, South Korea actively used personal information at the risk of personal privacy whereas France encouraged voluntary cooperation at the risk of public safety. In this article, after a brief comparison of contextual differences with France, we focus on South Korea's approaches to epidemiological investigations. To evaluate the issues pertaining to personal privacy and public health, we examine the usage patterns of original data, de-identification data, and encrypted data. Our specific proposal discusses the COVID index, which considers collective infection, outbreak intensity, availability of medical infrastructure, and the death rate. Finally, we summarize the findings and lessons for future research and the policy implications.

National Ambulance Surveillance System: A novel method using coded Australian ambulance clinical records to monitor self-harm and mental health-related morbidity

Self-harm and mental health are inter-related issues that substantially contribute to the global burden of disease. However, measurement of these issues at the population level is problematic. Statistics on suicide can be captured in national cause of death data collected as part of the coroner's review process, however, there is a significant time-lag in the availability of such data, and by definition, these sources do not include non-fatal incidents. Although survey, emergency department, and hospitalisation data present alternative information sources to measure self-harm, such data do not include the richness of information available at the point of incident. This paper describes the mental health and self-harm modules within the National Ambulance Surveillance System (NASS), a unique Australian system for monitoring and mapping mental health and self-harm. Data are sourced from paramedic electronic patient care records provided by Australian state and territory-based ambulance services. A team of specialised research assistants use a purpose-built system to manually scrutinise and code these records. Specific details of each incident are coded, including mental health symptoms and relevant risk indicators, as well as the type, intent, and method of self-harm. NASS provides almost 90 output variables related to self-harm (i.e., type of behaviour, self-injurious intent, and method) and mental health (e.g., mental health symptoms) in the 24 hours preceding each attendance, as well as demographics, temporal and geospatial characteristics, clinical outcomes, co-occurring substance use, and self-reported medical and psychiatric history. NASS provides internationally unique data on self-harm and mental health, with direct implications for translational research, public policy, and clinical practice. This methodology could be replicated in other countries with universal ambulance service provision to inform health policy and service planning.

COVID-19: Putting the General Data Protection Regulation to the Test

The coronavirus disease (COVID-19) pandemic is very much a global health issue and requires collaborative, international health research efforts to address it. A valuable source of information for researchers is the large amount of digital health data that are continuously collected by electronic health record systems at health care organizations. The European Union’s General Data Protection Regulation (GDPR) will be the key legal framework with regard to using and sharing European digital health data for research purposes. However, concerns persist that the GDPR has made many organizations very risk-averse in terms of data sharing, even if the regulation permits such sharing. Health care organizations focusing on individual risk minimization threaten to undermine COVID-19 research efforts. In our opinion, there is an ethical obligation to use the research exemption clause of the GDPR during the COVID-19 pandemic to support global collaborative health research efforts. Solidarity is a European value, and here is a chance to exemplify it by using the GDPR regulatory framework in a way that does not hinder but actually fosters solidarity during the COVID-19 pandemic.

Missed opportunities to advance knowledge on traffic safety: Accessibility of driver licensing and crash data for scientific research

OBJECTIVE

Identifiable individual-level driver licensing and motor vehicle crash data are essential to advancing transportation safety research. However, epidemiologic studies using such data are rare, which may reflect their inaccessibility. We conducted a legal mapping study to evaluate US state laws regulating access to driver licensing and motor vehicle crash data for use in scientific research.

METHODS

Legal statutes regulating the release of driver licensing and motor vehicle crash data for all 50 US states and the District of Columbia (D.C.) were retrieved. Legal text was evaluated to determine whether these jurisdictions authorize release of identifiable individual-level licensing and crash data for use in non-governmental research.

RESULTS

Thirty-six states and D.C. explicitly authorize release of identifiable individual-level licensing data to researchers. Only five states and D.C. authorize release of identifiable individual-level crash records. No states explicitly prohibit the release of individual-level data about licensing records and only three states prohibit release of individual-level crash record data, meaning that in many states it is ambiguous whether and when releasing such data to researchers is permitted.

CONCLUSIONS

It is important to understand why licensing data are not used more frequently in transportation safety research given that many state laws permit access for non-governmental researchers. Reforming state laws to clarify and increase access to identifiable individual-level crash report data is an important priority for transportation safety advocates and researchers.

Data sharing practices in randomized trials of addiction interventions

INTRODUCTION

Transparent, open scientific research practices aim to improve the validity and reproducibility of research findings. A key component of open science is the public sharing of data and metadata that constitute the basis for research findings.

METHODS

We conducted a 6 year cross-sectional investigation of the rates and methods of data sharing in 15 high-impact addiction journals that publish clinical trials. We extracted trial characteristics and whether the trial data were shared publicly in any form. We conducted a sensitivity analysis of only trials with public funding sources.

RESULTS

In the included journals, zero (0/394, 0.0%) RCTs shared their data publicly. The large majority (315/394, 79.9%) of included trials received funding from public sources. Eight journals had data sharing policies and published 299 of the included trials (75.9%).

CONCLUSION

Our finding has significant implications for the addiction research community. These implications are broad, ranging from possibly slowed scientific advancement to noncompliance with obligations to the public whose tax dollars funded a large majority of the included RCTs. To improve the rates of data sharing, we recommend studying incentive systems, while simultaneously working to cultivate a data sharing system that emphasizes scientific, rather than author, accuracy.

Risk and protective factors of identity theft victimization in the United States

•

Identity theft is a pervasive problem and a public health issue.

•

Frequent online purchasing behaviors result in greater risk of identity theft.

•

Corporate and government data breaches put consumers at risk for identity theft.

•

Risk factors vary by identity theft subtype.

•

Routine individual preventative behaviors can mitigate identity theft risk.

Identity theft victimization is associated with serious physical and mental health morbidities. The problem is expanding as society becomes increasingly reliant on technology to store and transfer personally identifying information. Guided by lifestyle-routine activity theory, this study sought to identify risk and protective factors associated with identity theft victimization and determine whether individual-level behaviors, including frequency of online purchasing and data protection practices, are determinative of victimization. Data from sequential administrations of the U.S. National Crime Victimization Survey–Identity Theft Supplement (ITS) in 2012 and 2014 were combined (N = 128,419). Using multivariable logistic regression, risk and protective factors were examined for three subtypes: 1) unauthorized use of existing credit card/bank accounts, and unauthorized use of personal information to 2) open new accounts, or 3) engage in instrumental activities (e.g., applying for government benefits, receiving medical care, filing false tax returns). Existing credit card/bank accounts and new accounts identity theft victimization were associated with higher levels of online purchasing activity and prior identity theft victimization. All identity theft subtypes were associated with government/corporate data breaches and other crime victimization experiences. Routine individual-level preventive behaviors such as changing online passwords and shredding/destroying documents were protective. Identity theft subtypes showed divergent socio-demographic risk/protective profiles, with those of higher socioeconomic status more likely to be victims of existing credit card/bank account identity theft. Identity theft is a pervasive, growing problem with serious health and psychosocial consequences, yet individuals can engage in specific protective behaviors to mitigate victimization risk.

Decision-making under uncertainty in environmental health policy: new approaches

Decision-making in environmental health policy is a complex procedure even in well-known conditions. Thus, in the case of uncertainty, decision-making becomes a hurdle race. We address scientific uncertainty, methods to reduce uncertainty, biomedical doubt and science communication, and the role of stakeholders, activists, lobbies and media that together influence policy decisions. We also consider the major responsibility and role of the medico-scientific community in this process. This community can and should teach the principle of scientific uncertainty to all stakeholders, advise policy-makers and underline the ethical issues, considering that our brains are not only the deposit of our humanity but also the route to environmental health and societal harmony.

The concept of Datenherrschaft of patient information from a Heideggerian perspective

Purpose

In this paper, patient information is approached from a Heideggerian perspective with the intention to gather an understanding about the personal nature of the information. The purpose of this paper is to analyse the ownership of patient information and then present Datenherrschaft (German for “mastery over information”) as a suitable model for patient ownership of patient information.

Design/methodology/approach

This paper is theoretical in approach. It is based on arguments derived from Heidegger’s work in the Being and Time.

Findings

Based on this Heideggerian approcah, a proposal for using the special definition of ownership of patient information – Datenherrschaft – given to a patient is suggested. From a Heideggerian perspective, it can be stated that the patient has the strongest rights towards patient information because this information is crucial for a patient to have an understanding about their Dasein (being-in-the-world).

Research limitations/implications

Datenherrschaft is used as an example of an ethically justified way of regulating the patient information ownership and should be analysed further. Especially the practical implications of implementing Datenherrschaft need more research.

Originality/value

Patient information ownership is an issue that is neither unambiguously solved in many countries, nor has it, in our view, been ethically justified. The potential solution – Datenherrschaft – presented in this paper is clear and has strong philosophical justifications.

Becoming a Hybrid Entity: A Policy Option for Public Health

When Congress passed HIPAA, it did not intend to constrain public health's data sharing in the same way as clinical or payers. In fact, HIPAA recognizes data sharing with public health as a matter of national priority and shields this function from its reach. However, a health department may offer services that bring it within HIPAA's purview, such as running a Children's Health Insurance Program or a laboratory that bills electronically. When this is the case, HIPAA requires all information and departments be subject to HIPAA unless the public health authority chooses to hybridize. Health departments might re-assess their coverage and elect to become a hybrid entity, thereby restricting HIPAA to only where required and removing barriers to information sharing with communities.

Impact of linkage quality on inferences drawn from analyses using data with high rates of linkage errors in rural Tanzania

BACKGROUND

Studies based on high-quality linked data in developed countries show that even minor linkage errors, which occur when records of two different individuals are erroneously linked or when records belonging to the same individual are not linked, can impact bias and precision of subsequent analyses. We evaluated the impact of linkage quality on inferences drawn from analyses using data with substantial linkage errors in rural Tanzania.

METHODS

Semi-automatic point-of-contact interactive record linkage was used to establish gold standard links between community-based HIV surveillance data and medical records at clinics serving the surveillance population. Automated probabilistic record linkage was used to create analytic datasets at minimum, low, medium, and high match score thresholds. Cox proportional hazards regression models were used to compare HIV care registration rates by testing modality (sero-survey vs. clinic) in each analytic dataset. We assessed linkage quality using three approaches: quantifying linkage errors, comparing characteristics between linked and unlinked data, and evaluating bias and precision of regression estimates.

RESULTS

Between 2014 and 2017, 405 individuals with gold standard links were newly diagnosed with HIV in sero-surveys (n = 263) and clinics (n = 142). Automated probabilistic linkage correctly identified 233 individuals (positive predictive value [PPV] = 65%) at the low threshold and 95 individuals (PPV = 90%) at the high threshold. Significant differences were found between linked and unlinked records in primary exposure and outcome variables and for adjusting covariates at every threshold. As expected, differences attenuated with increasing threshold. Testing modality was significantly associated with time to registration in the gold standard data (adjusted hazard ratio [HR] 4.98 for clinic-based testing, 95% confidence interval [CI] 3.34, 7.42). Increasing false matches weakened the association (HR 2.76 at minimum match score threshold, 95% CI 1.73, 4.41). Increasing missed matches (i.e., increasing match score threshold and positive predictive value of the linkage algorithm) was strongly correlated with a reduction in the precision of coefficient estimate (R2 = 0.97; p = 0.03).

CONCLUSIONS

Similar to studies with more negligible levels of linkage errors, false matches in this setting reduced the magnitude of the association; missed matches reduced precision. Adjusting for these biases could provide more robust results using data with considerable linkage errors.

Private collection: high correlation of sample collection and patient admission date in clinical microbiological testing complicates sharing of phylodynamic metadata

Infectious pathogens are known for their rapid evolutionary rates with new mutations arising over days to weeks. The ability to rapidly recover whole genome sequences and analyze the spread and evolution of pathogens using genetic information and pathogen collection dates has lead to interest in real-time tracking of infectious transmission and outbreaks. However, the level of temporal resolution afforded by these analyses may conflict with definitions of what constitutes protected health information (PHI) and privacy requirements for de-identification for publication and public sharing of research data and metadata. In the United States, dates and locations associated with patient care that provide greater resolution than year or the first three digits of the zip code are generally considered patient identifiers. Admission and discharge dates are specifically named as identifiers in Department of Health and Human Services guidance. To understand the degree to which one can impute admission dates from specimen collection dates, we examined sample collection dates and patient admission dates associated with more than 270,000 unique microbiological results from the University of Washington Laboratory Medicine Department between 2010 and 2017. Across all positive microbiological tests, the sample collection date exactly matched the patient admission date in 68.8% of tests. Collection dates and admission dates were identical from emergency department and outpatient testing 86.7% and 96.5% of the time, respectively, with >99% of tests collected within 1 day from the patient admission date. Samples from female patients were significantly more likely to be collected closer to admission date that those from male patients. We show that PHI-associated dates such as admission date can confidently be imputed from deposited collection date. We suggest that publicly depositing microbiological collection dates at greater resolution than the year may not meet routine Safe Harbor-based requirements for patient de-identification. We recommend the use of Expert Determination to determine PHI for a given study and/or direct patient consent if clinical laboratories or phylodynamic practitioners desire to make these data available.

Addressing data privacy in matched studies via virtual pooling

BACKGROUND

Data confidentiality and shared use of research data are two desirable but sometimes conflicting goals in research with multi-center studies and distributed data. While ideal for straightforward analysis, confidentiality restrictions forbid creation of a single dataset that includes covariate information of all participants. Current approaches such as aggregate data sharing, distributed regression, meta-analysis and score-based methods can have important limitations.

METHODS

We propose a novel application of an existing epidemiologic tool, specimen pooling, to enable confidentiality-preserving analysis of data arising from a matched case-control, multi-center design. Instead of pooling specimens prior to assay, we apply the methodology to virtually pool (aggregate) covariates within nodes. Such virtual pooling retains most of the information used in an analysis with individual data and since individual participant data is not shared externally, within-node virtual pooling preserves data confidentiality. We show that aggregated covariate levels can be used in a conditional logistic regression model to estimate individual-level odds ratios of interest.

RESULTS

The parameter estimates from the standard conditional logistic regression are compared to the estimates based on a conditional logistic regression model with aggregated data. The parameter estimates are shown to be similar to those without pooling and to have comparable standard errors and confidence interval coverage.

CONCLUSIONS

Virtual data pooling can be used to maintain confidentiality of data from multi-center study and can be particularly useful in research with large-scale distributed data.

Geospatial cryptography: enabling researchers to access private, spatially referenced, human subjects data for cancer control and prevention

As the volume, accuracy and precision of digital geographic information have increased, concerns regarding individual privacy and confidentiality have come to the forefront. Not only do these challenge a basic tenet underlying the advancement of science by posing substantial obstacles to the sharing of data to validate research results, but they are obstacles to conducting certain research projects in the first place. Geospatial cryptography involves the specification, design, implementation and application of cryptographic techniques to address privacy, confidentiality and security concerns for geographically referenced data. This article defines geospatial cryptography and demonstrates its application in cancer control and surveillance. Four use cases are considered: (1) national-level de-duplication among state or province-based cancer registries; (2) sharing of confidential data across cancer registries to support case aggregation across administrative geographies; (3) secure data linkage; and (4) cancer cluster investigation and surveillance. A secure multi-party system for geospatial cryptography is developed. Solutions under geospatial cryptography are presented and computation time is calculated. As services provided by cancer registries to the research community, de-duplication, case aggregation across administrative geographies and secure data linkage are often time-consuming and in some instances precluded by confidentiality and security concerns. Geospatial cryptography provides secure solutions that hold significant promise for addressing these concerns and for accelerating the pace of research with human subjects data residing in our nation's cancer registries. Pursuit of the research directions posed herein conceivably would lead to a geospatially encrypted geographic information system (GEGIS) designed specifically to promote the sharing and spatial analysis of confidential data. Geospatial cryptography holds substantial promise for accelerating the pace of research with spatially referenced human subjects data.

Confidentiality considerations for use of social-spatial data on the social determinants of health: Sexual and reproductive health case study

Understanding whether and how the places where people live, work, and play are associated with health behaviors and health is essential to understanding the social determinants of health. However, social-spatial data which link a person and their attributes to a geographic location (e.g., home address) create potential confidentiality risks. Despite the growing body of literature describing approaches to protect individual confidentiality when utilizing social-spatial data, peer-reviewed manuscripts displaying identifiable individual point data or quasi-identifiers (attributes associated with the individual or disease that narrow identification) in maps persist, suggesting that knowledge has not been effectively translated into public health research practices. Using sexual and reproductive health as a case study, we explore the extent to which maps appearing in recent peer-reviewed publications risk participant confidentiality. Our scoping review of sexual and reproductive health literature published and indexed in PubMed between January 1, 2013 and September 1, 2015 identified 45 manuscripts displaying participant data in maps as points or small-population geographic units, spanning 26 journals and representing studies conducted in 20 countries. Notably, 56% (13/23) of publications presenting point data on maps either did not describe approaches used to mask data or masked data inadequately. Furthermore, 18% (4/22) of publications displaying data using small-population geographic units included at least two quasi-identifiers. These findings highlight the need for heightened education for researchers, reviewers, and editorial teams. We aim to provide readers with a primer on key confidentiality considerations when utilizing linked social-spatial data for visualizing results. Given the widespread availability of place-based data and the ease of creating maps, it is critically important to raise awareness on when social-spatial data constitute protected health information, best practices for masking geographic identifiers, and methods of balancing disclosure risk and scientific utility. We conclude with recommendations to support the preservation of confidentiality when disseminating results.

User-Friendly Data-Sharing Practices for Fostering Collaboration within a Research Network: Roles of a Vanguard Center for a Community-Based Study

Although various attempts have been made to build collaborative cultures for data sharing, their effectiveness is still questionable. The Jackson Heart Study (JHS) Vanguard Center (JHSVC) at the NIH-funded Research Centers in Minority Institutions (RCMI) Translational Research Network (RTRN) Data Coordinating Center (DCC) may be a new concept in that the data are being shared with a research network where a plethora of scientists/researchers are working together to achieve their common goal. This study describes the current practices to share the JHS data through the mechanism of JHSVC. The JHS is the largest single-site cohort study to prospectively investigate the determinants of cardiovascular disease among African-Americans. It has adopted a formal screened access method through a formalized JHSVC mechanism, in which only a qualified scientist(s) can access the data. The role of the DCC was to help RTRN researchers explore hypothesis-driven ideas to enhance the output and impact of JHS data through customized services, such as feasibility tests, data querying, manuscript proposal development and data analyses for publication. DCC has implemented these various programs to facilitate data utility. A total of 300 investigators attended workshops and/or received training booklets. DCC provided two online and five onsite workshops and developed/distributed more than 250 copies of the booklet to help potential data users understand the structure of and access to the data. Information on data use was also provided through the RTRN website. The DCC efforts led to the production of five active manuscript proposals, seven completed publications, 11 presentations and four NIH grant proposals. These outcomes resulted from activities during the first four years; over the last couple of years, there were few new requests. Our study suggested that DCC-customized services enhanced the accessibility of JHS data and their utility by RTRN researchers and helped to achieve the principal goal of JHSVC of scientific productivity. In order to achieve long-term success, the following, but not limited to these, should be addressed in the current data sharing practices: preparation of new promotional strategies in response to changes in technology and users’ needs, collaboration with the Network statisticians, harmonization of the JHS data with the other local-based heart datasets to meet the needs of the potential users from the broader geographical areas, adoption of the RTRN comprehensive data-sharing policy to broaden the variety of research topics and implementation of an ongoing monitoring program to evaluate its success.

Privacy preserving probabilistic record linkage (P3RL): a novel method for linking existing health-related data and maintaining participant confidentiality

BACKGROUND

Record linkage of existing individual health care data is an efficient way to answer important epidemiological research questions. Reuse of individual health-related data faces several problems: Either a unique personal identifier, like social security number, is not available or non-unique person identifiable information, like names, are privacy protected and cannot be accessed. A solution to protect privacy in probabilistic record linkages is to encrypt these sensitive information. Unfortunately, encrypted hash codes of two names differ completely if the plain names differ only by a single character. Therefore, standard encryption methods cannot be applied. To overcome these challenges, we developed the Privacy Preserving Probabilistic Record Linkage (P3RL) method.

METHODS

In this Privacy Preserving Probabilistic Record Linkage method we apply a three-party protocol, with two sites collecting individual data and an independent trusted linkage center as the third partner. Our method consists of three main steps: pre-processing, encryption and probabilistic record linkage. Data pre-processing and encryption are done at the sites by local personnel. To guarantee similar quality and format of variables and identical encryption procedure at each site, the linkage center generates semi-automated pre-processing and encryption templates. To retrieve information (i.e. data structure) for the creation of templates without ever accessing plain person identifiable information, we introduced a novel method of data masking. Sensitive string variables are encrypted using Bloom filters, which enables calculation of similarity coefficients. For date variables, we developed special encryption procedures to handle the most common date errors. The linkage center performs probabilistic record linkage with encrypted person identifiable information and plain non-sensitive variables.

RESULTS

In this paper we describe step by step how to link existing health-related data using encryption methods to preserve privacy of persons in the study.

CONCLUSION

Privacy Preserving Probabilistic Record linkage expands record linkage facilities in settings where a unique identifier is unavailable and/or regulations restrict access to the non-unique person identifiable information needed to link existing health-related data sets. Automated pre-processing and encryption fully protect sensitive information ensuring participant confidentiality. This method is suitable not just for epidemiological research but also for any setting with similar challenges.

A decade of environmental public health tracking (2002-2012): progress and challenges

BACKGROUND

The creation of the Centers for Disease Control and Prevention Environmental Public Health Tracking Program spawned an invigorating and challenging approach toward implementing the nation's first population-based, environmental disease tracking surveillance system. More than 10 years have passed since its creation and an abundance of peer-reviewed articles have been published spanning a broad variety of public health topics related primarily to the goal of reducing diseases of environmental origin.

OBJECTIVE

To evaluate peer-reviewed literature related to Environmental Public Health Tracking during 2002-2012, recognize major milestones and challenges, and offer recommendations.

DESIGN

A narrative overview was conducted using titles and abstracts of peer-reviewed articles, key word searches, and science-based search engine databases.

MAIN OUTCOMES

Eighty published articles related to "health tracking" were identified and categorized according to 4 crossed-central themes. The Science and Research theme accounted for the majority of published articles, followed by Policy and Practice, Collaborations Among Health and Environmental Programs, and Network Development.

CONCLUSIONS

Overall, progress was reported in the areas of data linkage, data sharing, surveillance methods, and network development. Ongoing challenges included formulating better ways to establish the connections between health and the environment, such as using biomonitoring, public water systems, and private well water data. Recommendations for future efforts include use of data to inform policy and practice and use of electronic health records data for environmental health surveillance.

Medical records confidentiality and public health research: two values at stake? An italian survey focus on individual preferences

In a time when Europe is preparing to introduce new regulations on privacy protection, we conducted a survey among 1700 twins enrolled in the Italian Twin Register about the access and use of their medical records for public health research without explicit informed consent. A great majority of respondents would refuse or are doubtful about the access and use of hospital discharge records or clinical data without their explicit consent. Young and female individuals represent the modal profile of these careful people. As information retrieved from medical records is crucial for progressing knowledge, it is important to promote a better understanding of the value of public health research activities among the general population. Furthermore, public opinions are relevant to policy making, and concerns and preferences about privacy and confidentiality in research can contribute to the design of procedures to exploit medical records effectively and customize the protection of individuals’ medical data.

A systematic review of barriers to data sharing in public health

Background

In the current information age, the use of data has become essential for decision making in public health at the local, national, and global level. Despite a global commitment to the use and sharing of public health data, this can be challenging in reality. No systematic framework or global operational guidelines have been created for data sharing in public health. Barriers at different levels have limited data sharing but have only been anecdotally discussed or in the context of specific case studies. Incomplete systematic evidence on the scope and variety of these barriers has limited opportunities to maximize the value and use of public health data for science and policy.

Methods

We conducted a systematic literature review of potential barriers to public health data sharing. Documents that described barriers to sharing of routinely collected public health data were eligible for inclusion and reviewed independently by a team of experts. We grouped identified barriers in a taxonomy for a focused international dialogue on solutions.

Results

Twenty potential barriers were identified and classified in six categories: technical, motivational, economic, political, legal and ethical. The first three categories are deeply rooted in well-known challenges of health information systems for which structural solutions have yet to be found; the last three have solutions that lie in an international dialogue aimed at generating consensus on policies and instruments for data sharing.

Conclusions

The simultaneous effect of multiple interacting barriers ranging from technical to intangible issues has greatly complicated advances in public health data sharing. A systematic framework of barriers to data sharing in public health will be essential to accelerate the use of valuable information for the global good.

Electronic supplementary material

The online version of this article (doi:10.1186/1471-2458-14-1144) contains supplementary material, which is available to authorized users.

Good intentions and ICH-GCP: Trial conduct training needs to go beyond the ICH-GCP document and include the intention-to-treat principle

BACKGROUND

It is assumed investigators and statisticians fully understand the importance of avoiding missing outcomes and the intention-to-treat principle during design and analysis phases of a randomised controlled trial in order to obtain the most valuable and reliable results. However, many personnel undertaking day-to-day trial conduct and data collection commonly rely exclusively for guidance on the widely implemented, indeed regulated, International Conference on Harmonisation-Good Clinical Practice document as the guideline and standard for trial conduct.

PURPOSE

This article describes adverse consequences of omission of intention-to-treat principles from training for trial personnel and explores the need for training in addition to the International Conference on Harmonisation-Good Clinical Practice guideline document.

METHODS

Data from the Breast Boost Study were used to illustrate a comparison of actual results, where vigilant senior investigators re-enforced intention-to-treat requirements throughout all aspects of trial conduct with results that could easily have occurred if study personnel did not understand the importance of intention-to-treat principles. Experience as a co-ordinating centre for an international trial (Trans-Tasman Radiation Oncology Group 08.06 Breast STARS) acted as an audit of data-management culture regarding intention-to-treat in Australia and New Zealand.

RESULTS

Despite the Breast Boost Study exceeding planned accrual, it was demonstrated that the study, which found a statistically significant result, could have reported a negative or inconclusive result under the scenario of trial conduct personnel having lack of understanding of the importance of avoiding losses to follow-up. Trans-Tasman Radiation Oncology 08.06 co-ordination experience verified that data-management culture in Australia and New Zealand does not adequately recognise intention-to-treat principles, and this is reflected in trial conduct.

LIMITATIONS

Trial data described are limited to two trials and in the Australian and New Zealand setting.

CONCLUSION

To be both scientifically and ethically valid, guidelines for trial conduct should include and stress the importance of the intention-to-treat principle and in particular avoiding missing outcomes. Our discussion highlights the vitally important role played by personnel involved in day-to-day trial conduct. Inclusion of scientific principles in guideline documents and/or training which goes beyond International Conference on Harmonisation-Good Clinical Practice to include intention-to-treat is essential to achieve robust research results. Related aspects of randomised trial consent and ethics are discussed.

Public preferences about secondary uses of electronic health information

IMPORTANCE

As health information technology grows, secondary uses of personal health information offer promise in advancing research, public health, and health care. Public perceptions about sharing personal health data are important for establishing and evaluating ethical and regulatory structures to oversee the use of these data.

OBJECTIVE

To measure patient preferences about sharing their electronic health information for secondary purposes (other than their own health care).

DESIGN, SETTING, AND PARTICIPANTS

In this conjoint analysis study, we surveyed 3336 adults (568 Hispanic, 500 non-Hispanic African American, and 2268 non-Hispanic white); participants were randomized to 6 of 18 scenarios describing secondary uses of electronic health information, constructed with 3 attributes: uses (research, quality improvement, or commercial marketing), users (university hospitals, commercial enterprises, or public health departments), and data sensitivity (whether it included genetic information about their own cancer risk). This design enabled participants to reveal their preferences for secondary uses of their personal health information.

MAIN OUTCOMES AND MEASURES

Participants responded to each conjoint scenario by rating their willingness to share their electronic personal health information on a 1 to 10 scale (1 represents low willingness; 10, high willingness). Conjoint analysis yields importance weights reflecting the contribution of a dimension (use, user, or sensitivity) to willingness to share personal health information.

RESULTS

The use of data was a more important factor in the conjoint analysis (importance weight, 64.3%) than the user (importance weight, 32.6%) and data sensitivity (importance weight, 3.1%). In unadjusted linear regression models, marketing uses (β = -1.55), quality improvement uses (β = -0.51), drug company users (β = -0.80), and public health department users (β = -0.52) were associated with less willingness to share health information than research uses and university hospital users (all P < .001). Hispanics and African Americans differentiated less than whites between uses.

CONCLUSIONS AND RELEVANCE

Participants cared most about the specific purpose for using their health information, although differences were smaller among racial and ethnic minorities. The user of the information was of secondary importance, and the sensitivity was not a significant factor. These preferences should be considered in policies governing secondary uses of health information.

Spatializing health research: what we know and where we are heading

Beyond individual-level factors, researchers have adopted a spatial perspective to explore potentially modifiable environmental determinants of health. A spatial perspective can be integrated into health research by incorporating spatial data into studies or analysing georeferenced data. Given the rapid changes in data collection methods and the complex dynamics between individuals and environment, we argue that geographical information system (GIS) functions have shortcomings with respect to analytical capability and are limited when it comes to visualizing the temporal component in spatio-temporal data. In addition, we maintain that relatively little effort has been made to handle spatial heterogeneity. To that end, health researchers should be persuaded to better justify the theoretical meaning underlying the spatial matrix in analysis, while spatial data collectors, GIS specialists, spatial analysis methodologists and the different breeds of users should be encouraged to work together making health research move forward through addressing these issues.

The risks of absolute medical confidentiality

Some ethicists argue that patient confidentiality is absolute and thus should never be broken. I examine these arguments that when critically scrutinised, become porous. I will explore the concept of patient confidentiality and argue that although, this is a very important medical and bioethical issue, this needs to be wisely delivered to reduce third party harm or even detriment to the patient. The argument for absolute confidentiality is particularly weak when it comes to genetic information and inherited disease.

Observational research with adolescents: a framework for the management of the parental permission

BACKGROUND

Waiving parent permission can be an option in some epidemiological and social research with adolescents. However, exemptions have not been uniformly considered or applied. Our aim is to critically assess the different factors that could be taken into account when making decisions about waiving active parental permission in observational research with adolescents.

DISCUSSION

In some cases alternatives to parental permission could be applied to protect the rights of both adolescents and parents and also to assure the benefits to adolescents as a group that can come from appropriately conducted studies. However, the criteria of ensuring minimal risk can be difficult to define and apply and a distinction between harm and discomfort is reviewed. Waiving active parental permission could be acceptable when the risk of harm is minimal; when the research questions are related to an activity for which adolescents are not legally considered to be children; when the risk of harm or discomfort may increase if parental permission is required; and when risk of discomfort is low because the questionnaire is not potentially offensive for some adolescents and/or for some parents.

SUMMARY

Stringent rules concerning parental permission in some studies could be detrimental to adolescents. A framework and a decision tree guide are proposed to help researchers and Research Ethics Committees in their decisions on whether active parental permission must be obtained.

Privacy by Design at Population Data BC: a case study describing the technical, administrative, and physical controls for privacy-sensitive secondary use of personal information for research in the public interest

Population Data BC (PopData) is an innovative leader in facilitating access to linked data for population health research. Researchers from academic institutions across Canada work with PopData to submit data access requests for projects involving linked administrative data, with or without their own researcher-collected data. PopData and its predecessor-the British Columbia Linked Health Database-have facilitated over 350 research projects analyzing a broad spectrum of population health issues. PopData embeds privacy in every aspect of its operations. This case study focuses on how implementing the Privacy by Design model protects privacy while supporting access to individual-level data for research in the public interest. It explores challenges presented by legislation, stewardship, and public perception and demonstrates how PopData achieves both operational efficiencies and due diligence.

Challenges created by data dissemination and access restrictions when attempting to address community concerns: individual privacy versus public wellbeing

BACKGROUND

Population health data are vital for the identification of public health problems and the development of public health strategies. Challenges arise when attempts are made to disseminate or access anonymised data that are deemed to be potentially identifiable. In these situations, there is debate about whether the protection of an individual's privacy outweighs potentially beneficial public health initiatives developed using potentially identifiable information. While these issues have an impact at planning and policy levels, they pose a particular dilemma when attempting to examine and address community concerns about a specific health problem.

METHODS

Research currently underway in northern Canadian communities on the frequency of Helicobacter pylori infection and associated diseases, such as stomach cancer, is used in this article to illustrate the challenges that data controls create on the ability of researchers and health officials to address community concerns.

RESULTS

Barriers are faced by public health professionals and researchers when endeavouring to address community concerns; specifically, provincial cancer surveillance departments and community-driven participatory research groups face challenges related to data release or access that inhibit their ability to effectively address community enquiries. The resulting consequences include a limited ability to address misinformation or to alleviate concerns when dealing with health problems in small communities.

CONCLUSIONS

The development of communication tools and building of trusting relationships are essential components of a successful investigation into community health concerns. It may also be important to consider that public wellbeing may outweigh the value of individual privacy in these situations. As such, a re-evaluation of data disclosure policies that are applicable in these circumstances should be considered.

Reframing the influence of the Health Insurance Portability and Accountability Act on research

The purpose of this article is to review the Health Insurance Portability and Accountability Act (HIPAA), the Privacy Rule, the Security Rule, and common issues encountered by researchers related to these federal privacy and security requirements. This article discusses the misconceptions that researchers may hold about HIPAA, including the process for reviewing protected health information when preparing to conduct a study, potential constraint on participant recruitment, and application of HIPAA to a researcher's clinical population. We also present ways to reframe the negative connotations associated with this regulation and provide tips for researchers about how to work with HIPAA when planning and conducting a study and reporting on study findings. Finally, we suggest that the principles of HIPAA be considered when conducting studies in international settings.

Informational privacy, public health, and state laws

Developments in information technology that make it possible to rapidly transmit health information also raise questions about the possible inappropriate use and protection of identifiable (or potentially identifiable) personal health information. Despite efforts to improve state laws, adoption of provisions has lagged. We found that half of states have no statutes addressing nondisclosure of personally identifiable health information generally held by public health agencies. Exceptional treatment of HIV, sexually transmitted infections, or tuberculosis-related information was common. Where other provisions were found, there was little consistency in the laws across states. The variation in state laws supports the need to build consensus on the appropriate use and disclosure of public health information among public health practitioners.

Multidimensional point transform for public health practice

BACKGROUND

With increases in spatial information and enabling technologies, location-privacy concerns have been on the rise. A commonly proposed solution in public health involves random perturbation, however consideration for individual dimensions (attributes) has been weak.

OBJECTIVES

The current study proposes a multidimensional point transform (MPT) that integrates the spatial dimension with other dimensions of interest to comprehensively anonymise data.

METHODS

The MPT relies on the availability of a base population, a subset patient dataset, and shared dimensions of interest. Perturbation distance and anonymity thresholds are defined, as are allowable dimensional perturbations. A preliminary implementation is presented using sex, age and location as the three dimensions of interest, with a maximum perturbation distance of 1 kilometre and an anonymity threshold of 20%. A synthesised New York county population is used for testing with 1000 iterations for each of 25, 50, 100, 200 and 400 patient dataset sizes.

RESULTS

The MPT consistently yielded a mean perturbation distance of 46 metres with no sex or age perturbation required. Displacement of the spatial mean decreased with patient dataset size and averaged 5.6 metres overall.

CONCLUSIONS

The MPT presents a flexible, customisable and adaptive algorithm for perturbing datasets for public health, allowing tweaking and optimisation of the trade-offs for different datasets and purposes. It is not, however, a substitute for secure and ethical conduct, and a public health framework for the appropriate disclosure, use and dissemination of data containing personal identifiable information is required. The MPT presents an important component of such a framework.

Recruitment of representative samples for low incidence cancer populations: do registries deliver?

Background

Recruiting large and representative samples of adolescent and young adult (AYA) cancer survivors is important for gaining accurate data regarding the prevalence of unmet needs in this population. This study aimed to describe recruitment rates for AYAs recruited through a cancer registry with particular focus on: active clinician consent protocols, reasons for clinicians not providing consent and the representativeness of the final sample.

Methods

Adolescents and young adults aged 14 to19 years inclusive and listed on the cancer registry from January 1 2002 to December 31 2007 were identified. An active clinician consent protocol was used whereby the registry sent a letter to AYAs primary treating clinicians requesting permission to contact the survivors. The registry then sent survivors who received their clinician's consent a letter seeking permission to forward their contact details to the research team. Consenting AYAs were sent a questionnaire which assessed their unmet needs.

Results

The overall consent rate for AYAs identified as eligible by the registry was 7.8%. Of the 411 potentially eligible survivors identified, just over half (n = 232, 56%) received their clinician's consent to be contacted. Of those 232 AYAs, 65% were unable to be contacted. Only 18 AYAs (7.8%) refused permission for their contact details to be passed on to the research team. Of the 64 young people who agreed to be contacted, 50% (n = 32) completed the questionnaire.

Conclusions

Cancer registries which employ active clinician consent protocols may not be appropriate for recruiting large, representative samples of AYAs diagnosed with cancer. Given that AYA cancer survivors are highly mobile, alternative methods such as treatment centre and clinic based recruitment may need to be considered.