Data privacy, medical record confidentiality, and research in the interest of public health

Development of a web service for analysis in a distributed network

Objective:

We describe functional specifications and practicalities in the software development process for a web service that allows the construction of the multivariate logistic regression model, Grid Logistic Regression (GLORE), by aggregating partial estimates from distributed sites, with no exchange of patient-level data.

Background:

We recently developed and published a web service for model construction and data analysis in a distributed environment. This recent paper provided an overview of the system that is useful for users, but included very few details that are relevant for biomedical informatics developers or network security personnel who may be interested in implementing this or similar systems. We focus here on how the system was conceived and implemented.

Methods:

We followed a two-stage development approach by first implementing the backbone system and incrementally improving the user experience through interactions with potential users during the development. Our system went through various stages such as concept proof, algorithm validation, user interface development, and system testing. We used the Zoho Project management system to track tasks and milestones. We leveraged Google Code and Apache Subversion to share code among team members, and developed an applet-servlet architecture to support the cross platform deployment.

Discussion:

During the development process, we encountered challenges such as Information Technology (IT) infrastructure gaps and limited team experience in user-interface design. We figured out solutions as well as enabling factors to support the translation of an innovative privacy-preserving, distributed modeling technology into a working prototype.

Conclusion:

Using GLORE (a distributed model that we developed earlier) as a pilot example, we demonstrated the feasibility of building and integrating distributed modeling technology into a usable framework that can support privacy-preserving, distributed data analysis among researchers at geographically dispersed institutes.

Protecting patient privacy by quantifiable control of disclosures in disseminated databases

One of the fundamental rights of patients is to have their privacy protected by health care organizations, so that information that can be used to identify a particular individual is not used to reveal sensitive patient data such as diagnoses, reasons for ordering tests, test results, etc. A common practice is to remove sensitive data from databases that are disseminated to the public, but this can make the disseminated database useless for important public health purposes. If the degree of anonymity of a disseminated data set could be measured, it would be possible to design algorithms that can assure that the desired level of confidentiality is achieved. Privacy protection in disseminated databases can be facilitated by the use of special ambiguation algorithms. Most of these algorithms are aimed at making one individual indistinguishable from one or more of his peers. However, even in databases considered "anonymous", it may still be possible to obtain sensitive information about some individuals or groups of individuals with the use of pattern recognition algorithms. In this article, we study the problem of determining the degree of ambiguation in disseminated databases and discuss its implications in the development and testing of "anonymization" algorithms.

Monitoring outcomes of pregnancy following drug exposure: a company-based pregnancy registry program

Women who discover they are pregnant after exposure to a drug and pregnant women who have a condition that requires continued treatment during pregnancy are told to balance the benefits and risks of the exposure to justify continuation of treatment, discontinuation of treatment or, possibly, pregnancy termination. However, there are limited data available to inform decision-making. The Merck Pregnancy Registry Program is a company-run pregnancy registry whose objective is to acquire and analyse information on drug exposures and pregnancy outcomes to better describe the safety profile of Merck products used during pregnancy. Information is collected from women and healthcare providers who call to report drug exposure during pregnancy. Prospective pregnancies are followed up to outcome and data are collected via questionnaires, telephone calls and a review of medical records. Reports are classified as prospective (information received prior to knowledge of pregnancy outcome) or retrospective (received after the outcome is known). Congenital anomaly reports are assessed for timing of exposure, maternal age and medical history, biological plausibility and concomitant medication exposures. Rates of pregnancy outcomes and birth defects in the prospective cohort are computed and confidence intervals are calculated to reflect the strength of the finding based on the sample size. Rates of pregnancy outcomes in the Pregnancy Registry are compared with the rates of pregnancy outcomes in the general US population and, if available, in subpopulations with the relevant disease states. The limitations of post-marketing surveillance are well known as voluntary reporting of individuals and healthcare professionals is known to be subject to various types of bias. Small sample size is another major limitation. However, the strength of the registry lies in its ability to gather pregnancy outcome reports early in the life of a product and to recognise and analyse unusual birth defects. Our data suggest that pregnancy registries can be used to review human exposure data in a systematic fashion so that useful information can be shared with women and their healthcare providers. The use of the pregnancy registry design has allowed for the collection and analysis of data on the effects of drug exposures on human pregnancies that have otherwise been difficult to obtain.