Differential privacy in health research: A scoping review

Body Surface Potential Mapping: A Perspective on High-Density Cutaneous Electrophysiology

The electrophysiological signals recorded by cutaneous electrodes, known as body surface potentials (BSPs), are widely employed biomarkers in medical diagnosis. Despite their widespread application and success in detecting various conditions, the poor spatial resolution of traditional BSP measurements poses a limit to their diagnostic potential. Advancements in the field of bioelectronics have facilitated the creation of compact, high-quality, high-density recording arrays for cutaneous electrophysiology, allowing detailed spatial information acquisition as BSP maps (BSPMs). Currently, the design of electrode arrays for BSP mapping lacks a standardized framework, leading to customizations for each clinical study, limiting comparability, reproducibility, and transferability. This perspective proposes preliminary design guidelines, drawn from existing literature, rooted solely in the physical properties of electrophysiological signals and mathematical principles of signal processing. These guidelines aim to simplify and generalize the optimization process for electrode array design, fostering more effective and applicable clinical research. Moreover, the increased spatial information obtained from BSPMs introduces interpretation challenges. To mitigate this, two strategies are outlined: observational transformations that reconstruct signal sources for intuitive comprehension, and machine learning-driven diagnostics. BSP mapping offers significant advantages in cutaneous electrophysiology with respect to classic electrophysiological recordings and is expected to expand into broader clinical domains in the future.

Synthetic Breast Ultrasound Images: A Study to Overcome Medical Data Sharing Barriers

The vast potential of medical big data to enhance healthcare outcomes remains underutilized due to privacy concerns, which restrict cross-center data sharing and the construction of diverse, large-scale datasets. To address this challenge, we developed a deep generative model aimed at synthesizing medical data to overcome data sharing barriers, with a focus on breast ultrasound (US) image synthesis. Specifically, we introduce CoLDiT, a conditional latent diffusion model with a transformer backbone, to generate US images of breast lesions across various Breast Imaging Reporting and Data System (BI-RADS) categories. Using a training dataset of 9,705 US images from 5,243 patients across 202 hospitals with diverse US systems, CoLDiT generated breast US images without duplicating private information, as confirmed through nearest-neighbor analysis. Blinded reader studies further validated the realism of these images, with area under the receiver operating characteristic curve (AUC) scores ranging from 0.53 to 0.77. Additionally, synthetic breast US images effectively augmented the training dataset for BI-RADS classification, achieving performance comparable to that using an equal-sized training set comprising solely real images (P = 0.81 for AUC). Our findings suggest that synthetic data, such as CoLDiT-generated images, offer a viable, privacy-preserving solution to facilitate secure medical data sharing and advance the utilization of medical big data.

Privacy preservation for federated learning in health care

Artificial intelligence (AI) shows potential to improve health care by leveraging data to build models that can inform clinical workflows. However, access to large quantities of diverse data is needed to develop robust generalizable models. Data sharing across institutions is not always feasible due to legal, security, and privacy concerns. Federated learning (FL) allows for multi-institutional training of AI models, obviating data sharing, albeit with different security and privacy concerns. Specifically, insights exchanged during FL can leak information about institutional data. In addition, FL can introduce issues when there is limited trust among the entities performing the compute. With the growing adoption of FL in health care, it is imperative to elucidate the potential risks. We thus summarize privacy-preserving FL literature in this work with special regard to health care. We draw attention to threats and review mitigation approaches. We anticipate this review to become a health-care researcher's guide to security and privacy in FL.

User perceptions and experiences of an AI-driven conversational agent for mental health support

Background

The increasing prevalence of artificial intelligence (AI)-driven mental health conversational agents necessitates a comprehensive understanding of user engagement and user perceptions of this technology. This study aims to fill the existing knowledge gap by focusing on Wysa, a commercially available mobile conversational agent designed to provide personalized mental health support.

Methods

A total of 159 user reviews posted between January, 2020 and March, 2024, on the Wysa app's Google Play page were collected. Thematic analysis was then used to perform open and inductive coding of the collected data.

Results

Seven major themes emerged from the user reviews: "a trusting environment promotes wellbeing", "ubiquitous access offers real-time support", "AI limitations detract from the user experience", "perceived effectiveness of Wysa", "desire for cohesive and predictable interactions", "humanness in AI is welcomed", and "the need for improvements in the user interface". These themes highlight both the benefits and limitations of the AI-driven mental health conversational agents.

Conclusions

Users find that Wysa is effective in fostering a strong connection with its users, encouraging them to engage with the app and take positive steps towards emotional resilience and self-improvement. However, its AI needs several improvements to enhance user experience with the application. The findings contribute to the design and implementation of more effective, ethical, and user-aligned AI-driven mental health support systems.

Legal aspects of privacy-enhancing technologies in genome-wide association studies and their impact on performance and feasibility

Genomic data holds huge potential for medical progress but requires strict safety measures due to its sensitive nature to comply with data protection laws. This conflict is especially pronounced in genome-wide association studies (GWAS) which rely on vast amounts of genomic data to improve medical diagnoses. To ensure both their benefits and sufficient data security, we propose a federated approach in combination with privacy-enhancing technologies utilising the findings from a systematic review on federated learning and legal regulations in general and applying these to GWAS.

A data-driven approach to choosing privacy parameters for clinical trial data sharing under differential privacy

OBJECTIVES

Clinical trial data sharing is crucial for promoting transparency and collaborative efforts in medical research. Differential privacy (DP) is a formal statistical technique for anonymizing shared data that balances privacy of individual records and accuracy of replicated results through a "privacy budget" parameter, ε. DP is considered the state of the art in privacy-protected data publication and is underutilized in clinical trial data sharing. This study is focused on identifying ε values for the sharing of clinical trial data.

MATERIALS AND METHODS

We analyzed 2 clinical trial datasets with privacy budget ε ranging from 0.01 to 10. Smaller values of ε entail adding greater amounts of random noise, with better privacy as a result. Comparison of rates, odds ratios, means, and mean differences between the original clinical trial datasets and the empirical distribution of the DP estimator was performed.

RESULTS

The DP rate closely approximated the original rate of 6.5% when ε > 1. The DP odds ratio closely aligned with the original odds ratio of 0.689 when ε ≥ 3. The DP mean closely approximated the original mean of 164.64 when ε ≥ 1. As ε increased to 5, both the minimum and maximum DP means converged toward the original mean.

DISCUSSION

There is no consensus on how to choose the privacy budget ε. The definition of DP does not specify the required level of privacy, and there is no established formula for determining ε.

CONCLUSION

Our findings suggest that the application of DP holds promise in the context of sharing clinical trial data.

Harnessing the power of synthetic data in healthcare: innovation, application, and privacy

Data-driven decision-making in modern healthcare underpins innovation and predictive analytics in public health and clinical research. Synthetic data has shown promise in finance and economics to improve risk assessment, portfolio optimization, and algorithmic trading. However, higher stakes, potential liabilities, and healthcare practitioner distrust make clinical use of synthetic data difficult. This paper explores the potential benefits and limitations of synthetic data in the healthcare analytics context. We begin with real-world healthcare applications of synthetic data that informs government policy, enhance data privacy, and augment datasets for predictive analytics. We then preview future applications of synthetic data in the emergent field of digital twin technology. We explore the issues of data quality and data bias in synthetic data, which can limit applicability across different applications in the clinical context, and privacy concerns stemming from data misuse and risk of re-identification. Finally, we evaluate the role of regulatory agencies in promoting transparency and accountability and propose strategies for risk mitigation such as Differential Privacy (DP) and a dataset chain of custody to maintain data integrity, traceability, and accountability. Synthetic data can improve healthcare, but measures to protect patient well-being and maintain ethical standards are key to promote responsible use.

Population monitoring of trisomy 21: problems and approaches

Trisomy 21 (Down syndrome) is the most common autosomal aneuploidy among newborns. About 90% result from meiotic nondisjunction during oogenesis, which occurs around conception, when also the most profound epigenetic modifications take place. Thus, maternal meiosis is an error prone process with an extreme sensitivity to endogenous factors, as exemplified by maternal age. This contrasts with the missing acceptance of causal exogenous factors. The proof of an environmental agent is a great challenge, both with respect to ascertainment bias, determination of time and dosage of exposure, as well as registration of the relevant individual health data affecting the birth prevalence. Based on a few exemplary epidemiological studies the feasibility of trisomy 21 monitoring is illustrated. In the nearer future the methodical premises will be clearly improved, both due to the establishment of electronic health registers and to the introduction of non-invasive prenatal tests. Down syndrome is a sentinel phenotype, presumably also with regard to other congenital anomalies. Thus, monitoring of trisomy 21 offers new chances for risk avoidance and preventive measures, but also for basic research concerning identification of relevant genomic variants involved in chromosomal nondisjunction.

Artificial intelligence in uveitis: A comprehensive review

Uveitis is a disease complex characterized by intraocular inflammation of the uvea that is an important cause of blindness and social morbidity. With the dawn of artificial intelligence (AI) and machine learning integration in healthcare, their application in uveitis creates an avenue to improve screening and diagnosis. Our review identified the use of artificial intelligence in studies of uveitis and classified them as diagnosis support, finding detection, screening, and standardization of uveitis nomenclature. The overall performance of models is poor, with limited datasets and a lack of validation studies and publicly available data and codes. We conclude that AI holds great promise to assist with the diagnosis and detection of ocular findings of uveitis, but further studies and large representative datasets are needed to guarantee generalizability and fairness.

Privacy-preserving patient clustering for personalized federated learning

Federated Learning (FL) is a machine learning framework that enables multiple organizations to train a model without sharing their data with a central server. However, it experiences significant performance degradation if the data is non-identically independently distributed (non-IID). This is a problem in medical settings, where variations in the patient population contribute significantly to distribution differences across hospitals. Personalized FL addresses this issue by accounting for site-specific distribution differences. Clustered FL, a Personalized FL variant, was used to address this problem by clustering patients into groups across hospitals and training separate models on each group. However, privacy concerns remained as a challenge as the clustering process requires exchange of patient-level information. This was previously solved by forming clusters using aggregated data, which led to inaccurate groups and performance degradation. In this study, we propose Privacy-preserving Community-Based Federated machine Learning (PCBFL), a novel Clustered FL framework that can cluster patients using patient-level data while protecting privacy. PCBFL uses Secure Multiparty Computation, a cryptographic technique, to securely calculate patient-level similarity scores across hospitals. We then evaluate PCBFL by training a federated mortality prediction model using 20 sites from the eICU dataset. We compare the performance gain from PCBFL against traditional and existing Clustered FL frameworks. Our results show that PCBFL successfully forms clinically meaningful cohorts of low, medium, and high-risk patients. PCBFL outperforms traditional and existing Clustered FL frameworks with an average AUC improvement of 4.3% and AUPRC improvement of 7.8%.

COMMUTE: Communication-efficient transfer learning for multi-site risk prediction

OBJECTIVES

We propose a communication-efficient transfer learning approach (COMMUTE) that effectively incorporates multi-site healthcare data for training a risk prediction model in a target population of interest, accounting for challenges including population heterogeneity and data sharing constraints across sites.

METHODS

We first train population-specific source models locally within each site. Using data from a given target population, COMMUTE learns a calibration term for each source model, which adjusts for potential data heterogeneity through flexible distance-based regularizations. In a centralized setting where multi-site data can be directly pooled, all data are combined to train the target model after calibration. When individual-level data are not shareable in some sites, COMMUTE requests only the locally trained models from these sites, with which, COMMUTE generates heterogeneity-adjusted synthetic data for training the target model. We evaluate COMMUTE via extensive simulation studies and an application to multi-site data from the electronic Medical Records and Genomics (eMERGE) Network to predict extreme obesity.

RESULTS

Simulation studies show that COMMUTE outperforms methods without adjusting for population heterogeneity and methods trained in a single population over a broad spectrum of settings. Using eMERGE data, COMMUTE achieves an area under the receiver operating characteristic curve (AUC) around 0.80, which outperforms other benchmark methods with AUC ranging from 0.51 to 0.70.

CONCLUSION

COMMUTE improves the risk prediction in a target population with limited samples and safeguards against negative transfer when some source populations are highly different from the target. In a federated setting, it is highly communication efficient as it only requires each site to share model parameter estimates once, and no iterative communication or higher-order terms are needed.

The effect of differential privacy on Medicaid participation among racial and ethnic minority groups

OBJECTIVE

To investigate how county and state-level estimates of Medicaid enrollment among the total, non-Hispanic White, non-Hispanic Black or African American, and Hispanic or Latino/a population are affected by Differential Privacy (DP), where statistical noise is added to the public decennial US census data to protect individual privacy.

DATA SOURCES

We obtained population counts from the final version of the US Census Bureau Differential Privacy Demonstration Products from 2010 and combined them with Medicaid enrollment data.

STUDY DESIGN

We compared 2010 county and state-level population counts released under the traditional disclosure avoidance techniques and the ones produced with the proposed DP procedures.

DATA COLLECTION/EXTRACTION METHODS

Not applicable.

PRINCIPAL FINDINGS

We find the DP method introduces errors up to 10% into counts and proportions of Medicaid participation rate accuracy at the county level, especially for small subpopulations and racial and ethnic minority groups. The effect of DP on Medicaid participation rate accuracy is only small and negligible at the state level.

CONCLUSIONS

The implementation of DP in the 2020 census can affect the analyses of health disparities and health care access and use among different subpopulations in the United States. The planned implementation of DP in other census-related surveys such as the American Community Survey can misrepresent Medicaid participation rates for small racial and ethnic minority groups. This can affect Medicaid funding decisions.

Towards effective data sharing in ophthalmology: data standardization and data privacy

PURPOSE OF REVIEW

The purpose of this review is to provide an overview of updates in data standardization and data privacy in ophthalmology. These topics represent two key aspects of medical information sharing and are important knowledge areas given trends in data-driven healthcare.

RECENT FINDINGS

Standardization and privacy can be seen as complementary aspects that pertain to data sharing. Standardization promotes the ease and efficacy through which data is shared. Privacy considerations ensure that data sharing is appropriate and sufficiently controlled. There is active development in both areas, including government regulations and common data models to advance standardization, and application of technologies such as blockchain and synthetic data to help tackle privacy issues. These advancements have seen use in ophthalmology, but there are areas where further work is required.

SUMMARY

Information sharing is fundamental to both research and care delivery, and standardization/privacy are key constituent considerations. Therefore, widespread engagement with, and development of, data standardization and privacy ecosystems stand to offer great benefit to ophthalmology.

SinGAN-Seg: Synthetic training data generation for medical image segmentation

Analyzing medical data to find abnormalities is a time-consuming and costly task, particularly for rare abnormalities, requiring tremendous efforts from medical experts. Therefore, artificial intelligence has become a popular tool for the automatic processing of medical data, acting as a supportive tool for doctors. However, the machine learning models used to build these tools are highly dependent on the data used to train them. Large amounts of data can be difficult to obtain in medicine due to privacy reasons, expensive and time-consuming annotations, and a general lack of data samples for infrequent lesions. In this study, we present a novel synthetic data generation pipeline, called SinGAN-Seg, to produce synthetic medical images with corresponding masks using a single training image. Our method is different from the traditional generative adversarial networks (GANs) because our model needs only a single image and the corresponding ground truth to train. We also show that the synthetic data generation pipeline can be used to produce alternative artificial segmentation datasets with corresponding ground truth masks when real datasets are not allowed to share. The pipeline is evaluated using qualitative and quantitative comparisons between real data and synthetic data to show that the style transfer technique used in our pipeline significantly improves the quality of the generated data and our method is better than other state-of-the-art GANs to prepare synthetic images when the size of training datasets are limited. By training UNet++ using both real data and the synthetic data generated from the SinGAN-Seg pipeline, we show that the models trained on synthetic data have very close performances to those trained on real data when both datasets have a considerable amount of training data. In contrast, we show that synthetic data generated from the SinGAN-Seg pipeline improves the performance of segmentation models when training datasets do not have a considerable amount of data. All experiments were performed using an open dataset and the code is publicly available on GitHub.

Membership inference attacks against synthetic health data

Synthetic data generation has emerged as a promising method to protect patient privacy while sharing individual-level health data. Intuitively, sharing synthetic data should reduce disclosure risks because no explicit linkage is retained between the synthetic records and the real data upon which it is based. However, the risks associated with synthetic data are still evolving, and what seems protected today may not be tomorrow. In this paper, we show that membership inference attacks, whereby an adversary infers if the data from certain target individuals (known to the adversary a priori) were relied upon by the synthetic data generation process, can be substantially enhanced through state-of-the-art machine learning frameworks, which calls into question the protective nature of existing synthetic data generators. Specifically, we formulate the membership inference problem from the perspective of the data holder, who aims to perform a disclosure risk assessment prior to sharing any health data. To support such an assessment, we introduce a framework for effective membership inference against synthetic health data without specific assumptions about the generative model or a well-defined data structure, leveraging the principles of contrastive representation learning. To illustrate the potential for such an attack, we conducted experiments against synthesis approaches using two datasets derived from several health data resources (Vanderbilt University Medical Center, the All of Us Research Program) to determine the upper bound of risk brought by an adversary who invokes an optimal strategy. The results indicate that partially synthetic data are vulnerable to membership inference at a very high rate. By contrast, fully synthetic data are only marginally susceptible and, in most cases, could be deemed sufficiently protected from membership inference.