Shadow health records meet new data privacy laws

Heteronanostructured Field-Effect Transistors for Enhancing Entropy and Parameter Space in Electrical Unclonable Primitives

Hardware security is not a new problem but is ever-growing in consumer and medical domains owing to hyperconnectivity. A physical unclonable function (PUF) offers a promising hardware security solution for cryptographic key generation, identification, and authentication. However, electrical PUFs using nanomaterials or two-dimensional (2D) transition metal dichalcogenides (TMDCs) often have limited entropy and parameter space sources, both of which increase the vulnerability to attacks and act as bottlenecks for practical applications. We report an electrical PUF with enhanced entropy as well as parameter space by incorporating 2D TMDC heteronanostructures into field-effect transistors (FETs). Lateral heteronanostructures of 2D molybdenum disulfide and tungsten disulfide serve as a potent entropy source. The variable feature of FETs is further leveraged to enhance the parameter space that provides multiple challenge-response pairs, which are essential for PUFs. This combination results in stably repeatable yet highly variable FET characteristics as alternative electrical PUFs. Comprehensive PUF performance analyses validate the bit uniformity, reproducibility, uniqueness, randomness, false rates, and encoding capacity. The 2D material heteronanostructure-driven electrical PUFs with strong FET-to-FET variability can potentially be augmented as an immediately deployable and scalable security solution for various hardware devices.

Principles for Health Information Collection, Sharing, and Use: A Policy Statement From the American Heart Association

The evolution of the electronic health record, combined with advances in data curation and analytic technologies, increasingly enables data sharing and harmonization. Advances in the analysis of health-related and health-proxy information have already accelerated research discoveries and improved patient care. This American Heart Association policy statement discusses how broad data sharing can be an enabling driver of progress by providing data to develop, test, and benchmark innovative methods, scalable insights, and potential new paradigms for data storage and workflow. Along with these advances come concerns about the sensitive nature of some health data, equity considerations about the involvement of historically excluded communities, and the complex intersection of laws attempting to govern behavior. Data-sharing principles are therefore necessary across a wide swath of entities, including parties who collect health information, funders, researchers, patients, legislatures, commercial companies, and regulatory departments and agencies. This policy statement outlines some of the key equity and legal background relevant to health data sharing and responsible management. It then articulates principles that will guide the American Heart Association's engagement in public policy related to data collection, sharing, and use to continue to inform its work across the research enterprise, as well as specific examples of how these principles might be applied in the policy landscape. The goal of these principles is to improve policy to support the use or reuse of health information in ways that are respectful of patients and research participants, equitable in impact in terms of both risks and potential benefits, and beneficial across broad and demographically diverse communities in the United States.

Differentially private knowledge transfer for federated learning

Extracting useful knowledge from big data is important for machine learning. When data is privacy-sensitive and cannot be directly collected, federated learning is a promising option that extracts knowledge from decentralized data by learning and exchanging model parameters, rather than raw data. However, model parameters may encode not only non-private knowledge but also private information of local data, thereby transferring knowledge via model parameters is not privacy-secure. Here, we present a knowledge transfer method named PrivateKT, which uses actively selected small public data to transfer high-quality knowledge in federated learning with privacy guarantees. We verify PrivateKT on three different datasets, and results show that PrivateKT can maximally reduce 84% of the performance gap between centralized learning and existing federated learning methods under strict differential privacy restrictions. PrivateKT provides a potential direction to effective and privacy-preserving knowledge transfer in machine intelligent systems.

Guidelines for genetic ancestry inference created through roundtable discussions

The use of genetic and genomic technology to infer ancestry is commonplace in a variety of contexts, particularly in biomedical research and for direct-to-consumer genetic testing. In 2013 and 2015, two roundtables engaged a diverse group of stakeholders toward the development of guidelines for inferring genetic ancestry in academia and industry. This report shares the stakeholder groups' work and provides an analysis of, commentary on, and views from the groundbreaking and sustained dialogue. We describe the engagement processes and the stakeholder groups' resulting statements and proposed guidelines. The guidelines focus on five key areas: application of genetic ancestry inference, assumptions and confidence/laboratory and statistical methods, terminology and population identifiers, impact on individuals and groups, and communication or translation of genetic ancestry inferences. We delineate the terms and limitations of the guidelines and discuss their critical role in advancing the development and implementation of best practices for inferring genetic ancestry and reporting the results. These efforts should inform both governmental regulation and self-regulation.

FAIR human neuroscientific data sharing to advance AI driven research and applications: Legal frameworks and missing metadata standards

Modern AI supported research holds many promises for basic and applied science. However, the application of AI methods is often limited because most labs cannot, on their own, acquire large and diverse datasets, which are best for training these methods. Data sharing and open science initiatives promise some relief to the problem, but only if the data are provided in a usable way. The FAIR principles state very general requirements for useful data sharing: they should be findable, accessible, interoperable, and reusable. This article will focus on two challenges to implement the FAIR framework for human neuroscience data. On the one hand, human data can fall under special legal protection. The legal frameworks regulating how and what data can be openly shared differ greatly across countries which can complicate data sharing or even discourage researchers from doing so. Moreover, openly accessible data require standardization of data and metadata organization and annotation in order to become interpretable and useful. This article briefly introduces open neuroscience initiatives that support the implementation of the FAIR principles. It then reviews legal frameworks, their consequences for accessibility of human neuroscientific data and some ethical implications. We hope this comparison of legal jurisdictions helps to elucidate that some alleged obstacles for data sharing only require an adaptation of procedures but help to protect the privacy of our most generous donors to research … our study participants. Finally, it elaborates on the problem of missing standards for metadata annotation and introduces initiatives that aim at developing tools to make neuroscientific data acquisition and analysis pipelines FAIR by design. While the paper focuses on making human neuroscience data useful for data-intensive AI the general considerations hold for other fields where large amounts of openly available human data would be helpful.

The Issues of Interoperability and Data Connectedness for Public Health

An unprecedented amount of data is being collected across a diversity of sectors, which, if harnessed, could transform public health decision-making. Yet significant challenges stand in the way of such a vision, including the need to establish standards of data sharing and interoperability, the need for innovation in both methodological approaches and workforce models, and the need for data stewardship and governance models to ensure the protection and integrity of the public health data system. As with other articles in this supplement, this article builds from a literature review, environmental scan, and deliberations from the National Commission to Transform Public Health Data Systems. The article summarizes some of the challenges around data sharing and reuse and identifies where the technology and data sectors can contribute to fill current gaps to promote interoperability and data stewardship.

Bringing machine learning to research on intellectual and developmental disabilities: taking inspiration from neurological diseases

Intellectual and Developmental Disabilities (IDDs), such as Down syndrome, Fragile X syndrome, Rett syndrome, and autism spectrum disorder, usually manifest at birth or early childhood. IDDs are characterized by significant impairment in intellectual and adaptive functioning, and both genetic and environmental factors underpin IDD biology. Molecular and genetic stratification of IDDs remain challenging mainly due to overlapping factors and comorbidity. Advances in high throughput sequencing, imaging, and tools to record behavioral data at scale have greatly enhanced our understanding of the molecular, cellular, structural, and environmental basis of some IDDs. Fueled by the "big data" revolution, artificial intelligence (AI) and machine learning (ML) technologies have brought a whole new paradigm shift in computational biology. Evidently, the ML-driven approach to clinical diagnoses has the potential to augment classical methods that use symptoms and external observations, hoping to push the personalized treatment plan forward. Therefore, integrative analyses and applications of ML technology have a direct bearing on discoveries in IDDs. The application of ML to IDDs can potentially improve screening and early diagnosis, advance our understanding of the complexity of comorbidity, and accelerate the identification of biomarkers for clinical research and drug development. For more than five decades, the IDDRC network has supported a nexus of investigators at centers across the USA, all striving to understand the interplay between various factors underlying IDDs. In this review, we introduced fast-increasing multi-modal data types, highlighted example studies that employed ML technologies to illuminate factors and biological mechanisms underlying IDDs, as well as recent advances in ML technologies and their applications to IDDs and other neurological diseases. We discussed various molecular, clinical, and environmental data collection modes, including genetic, imaging, phenotypical, and behavioral data types, along with multiple repositories that store and share such data. Furthermore, we outlined some fundamental concepts of machine learning algorithms and presented our opinion on specific gaps that will need to be filled to accomplish, for example, reliable implementation of ML-based diagnosis technology in IDD clinics. We anticipate that this review will guide researchers to formulate AI and ML-based approaches to investigate IDDs and related conditions.

How NFTs could transform health information exchange

[Figure: see text].

Addressing Online Health Privacy Risks for Older Adults: A Perspective on Ethical Considerations and Recommendations

The rise in online health information seeking among older adults promises significant benefits but also presents potentially serious privacy risks. In light of these risks, we argue that ongoing research and advocacy aimed at promoting online health information seeking among older adults must be coupled with efforts to identify and address threats to their online privacy. We first detail how internet users reveal sensitive health information to third parties through seemingly innocuous web browsing. We then describe ethical concerns raised by the inadvertent disclosure of health information, which include the potential for dignitary harms, subjective injuries, online health scams, and discrimination. After reviewing ways in which existing privacy laws fail to meet the needs of older adults, we provide recommendations for individual and collective action to protect the online privacy of older adults.

Data Sharing of Imaging in an Evolving Health Care World: Report of the ACR Data Sharing Workgroup, Part 1: Data Ethics of Privacy, Consent, and Anonymization

Radiology is at the forefront of the artificial intelligence transformation of health care across multiple areas, from patient selection to study acquisition to image interpretation. Needing large data sets to develop and train these algorithms, developers enter contractual data sharing agreements involving data derived from health records, usually with postacquisition curation and annotation. In 2019 the ACR convened a Data Sharing Workgroup to develop philosophies around best practices in the sharing of health information. The workgroup identified five broad domains of activity important to collaboration using patient data: privacy, informed consent, standardization of data elements, vendor contracts, and data valuation. This is Part 1 of a Report on the workgroup's efforts in exploring these issues.

Data Sharing Under the General Data Protection Regulation: Time to Harmonize Law and Research Ethics?

Supplemental Digital Content is available in the text.

The General Data Protection Regulation (GDPR) became binding law in the European Union Member States in 2018, as a step toward harmonizing personal data protection legislation in the European Union. The Regulation governs almost all types of personal data processing, hence, also, those pertaining to biomedical research. The purpose of this article is to highlight the main practical issues related to data and biological sample sharing that biomedical researchers face regularly, and to specify how these are addressed in the context of GDPR, after consulting with ethics/legal experts. We identify areas in which clarifications of the GDPR are needed, particularly those related to consent requirements by study participants. Amendments should target the following: (1) restricting exceptions based on national laws and increasing harmonization, (2) confirming the concept of broad consent, and (3) defining a roadmap for secondary use of data. These changes will be achieved by acknowledged learned societies in the field taking the lead in preparing a document giving guidance for the optimal interpretation of the GDPR, which will be finalized following a period of commenting by a broad multistakeholder audience. In parallel, promoting engagement and education of the public in the relevant issues (such as different consent types or residual risk for re-identification), on both local/national and international levels, is considered critical for advancement. We hope that this article will open this broad discussion involving all major stakeholders, toward optimizing the GDPR and allowing a harmonized transnational research approach.

A Policy and Practice Review of Consumer Protections and Their Application to Hospital-Sourced Data Aggregation and Analytics by Third-Party Companies

The Office of the National Coordinator for Health Information Technology estimates that 96% of all U.S. hospitals use a basic electronic health record, but only 62% are able to exchange health information with outside providers. Barriers to information exchange across EHR systems challenge data aggregation and analysis that hospitals need to evaluate healthcare quality and safety. A growing number of hospital systems are partnering with third-party companies to provide these services. In exchange, companies reserve the rights to sell the aggregated data and analyses produced therefrom, often without the knowledge of patients from whom the data were sourced. Such partnerships fall in a regulatory grey area and raise new ethical questions about whether health, consumer, or health and consumer privacy protections apply. The current opinion probes this question in the context of consumer privacy reform in California. It analyzes protections for health information recently expanded under the California Consumer Privacy Act ("CA Privacy Act") in 2020 and compares them to protections outlined in the Health Information Portability and Accountability Act ("Federal Privacy Rule"). Four perspectives are considered in this ethical analysis: 1) standards of data deidentification; 2) rights of patients and consumers in relation to their health information; 3) entities covered by the CA Privacy Act; 4) scope and complementarity of federal and state regulations. The opinion concludes that the CCPA is limited in its application when health information is processed by a third-party data aggregation company that is contractually designated as a business associate; when health information is deidentified; and when hospital data are sourced from publicly owned and operated hospitals. Lastly, the opinion offers practical recommendations for facilitating parity between state and federal health data privacy laws and for how a more equitable distribution of informational risks and benefits from the sale of aggregated hospital data could be fostered and presents ways both for-profit and nonprofit hospitals can sustain patient trust when negotiating partnerships with third-party data aggregation companies.

Protecting health privacy even when privacy is lost

The standard approach to protecting privacy in healthcare aims to control access to personal information. We cannot regain control of information after it has been shared, so we must restrict access from the start. This 'control' conception of privacy conflicts with data-intensive initiatives like precision medicine and learning health systems, as they require patients to give up significant control of their information. Without adequate alternatives to the control-based approach, such data-intensive programmes appear to require a loss of privacy. This paper argues that the control view of privacy is shortsighted and overlooks important ways to protect health information even when widely shared. To prepare for a world where we no longer control our data, we must pursue three alternative strategies: obfuscate health data, penalise the misuse of health data and improve transparency around who shares our data and for what purposes. Prioritising these strategies is necessary when health data are widely shared both within and outside of the health system.

Genetic Data Aren't So Special: Causes and Implications of Reidentification

Genetic information is widely thought to pose unique risks of reidentifying individuals. Genetic data reveals a great deal about who we are and, the standard view holds, should consequently be treated differently from other types of data. Contrary to this view, we argue that the dangers of reidentification for genetic and nongenetic data-including health, financial, and consumer information-are more similar than has been recognized. Before different requirements are imposed around sharing genetic information, proponents of the standard view must show that they are in fact necessary. We further argue that the similarities between genetic and nongenetic information have important implications for communicating risks during consent for health care and research. While patients and research participants need to be more aware of pervasive data-sharing practices, consent forms are the wrong place to provide this education. Instead, health systems should engage with patients throughout patient care to educate them about data-sharing practices.

Rethinking the Importance of the Individual within a Community of Data

The Covid-19 crisis has underscored the importance of the collection and analysis of clinical and research data and specimens for ongoing work. The federal government recently completed a related revision of the human subjects research regulations, founded in the traditional principles of research ethics, but in this commentary, we argue that the analysis underpinning this revision overemphasized the importance of informed consent, given the low risks of secondary research. Governing the interests of a community is different from governing the interests of individuals, and here we suggest that, moving forward, the analyses of the risks of secondary research protocols be assessed from the perspective of the former.

"My Research Is Their Business, but I'm Not Their Business": Patient and Clinician Perspectives on Commercialization of Precision Oncology Data

BACKGROUND

Genetic sequencing and precision oncology have supported clinical breakthroughs but depend upon access to vast arrays of research specimens and data. One way for academic medical centers to fund such infrastructure and research is "commercialization" of access to specimens and data to industry. Here we explore patient and clinician perspectives regarding cancer specimen and data commercialization with the goal of improving such processes in the future.

MATERIALS AND METHODS

This qualitative analysis was embedded within a prospective precision oncology sequencing study of adults with head and neck cancer. Via semistructured dyadic interviews with patients with cancer and their doctors, we assessed understanding and concerns regarding potential commercialization, opinions regarding investment of profits, and perspectives regarding the return of information directly to participants from industry.

RESULTS

Several patient- and clinician-participants did not understand that the consent form already permitted commercialization of patient genetic data and expressed concerns regarding who would profit from the data, how profits would be used, and privacy and access. Patients were generally more comfortable with commercialization than clinicians. Many patients and clinicians were comfortable with investing profits back into research, but clinicians were more interested in investment in head and neck cancer research specifically. Patients generally supported potential return-of-results from a private entity, but their clinicians were more skeptical.

CONCLUSION

Our results illustrate the limitations of mandatory disclosures in the informed consent process. The voices of both patients and their doctors are critical to mitigate violations of privacy and a degradation of trust as stakeholders negotiate the terms of academic and commercial engagement.

IMPLICATIONS FOR PRACTICE

Further education is needed regarding how and why specimens and data in precision oncology research may be commercialized for both patients and providers alike. This process will require increased transparency, comprehension, and engagement of involved stakeholders.

Hospitals should act now to notify patients about research use of their data and biospecimens

Private industry is increasingly soliciting hospitals to sell or share health data and biospecimens, but current laws offer more disclosure and consent protections for research participants than for patients receiving clinical care. Hospitals can offer more protections than required by law, however, and should move toward greater transparency with their patients about the research use of clinical health data and biospecimens to respect patients and avoid distrust.

Navigating ethical quandaries with the privacy dilemma of biomedical datasets

With decreasing cost of biomedical technologies, the scale of the genetic and healthcare data have exponentially increased and become available to wider audiences. Hence, privacy of patients and study participants has garnered the attention of researchers and regulators alike. Availability of genetic and health care information for uses not anticipated at the time of collection gives rise to privacy concerns such that people suffer dignitary harm when their data is used in ways they did not desire or intend, even if no concrete economic damage results. In this workshop, we explore the issues surrounding data use to advance human health from a privacy perspective. Broadly this field can be considered in two encompassing areas: (1) Ethics and regulation of privacy: The ethical and regulatory frames through which we can consider privacy, the existing regulations regarding privacy and what is on the horizon, and implementation of such ethical considerations for data with the new Common Rule. (2) Approaches to ensuring privacy using technology: The technologies that allow responsible use and sharing of data such as encryption and the quantification of privacy leakages in publicly available data through privacy attacks for better risk-assessment tools.

Ethical and legal challenges of artificial intelligence-driven healthcare

This chapter will map the ethical and legal challenges posed by artificial intelligence (AI) in healthcare and suggest directions for resolving them. Section 1 will briefly clarify what AI is and Section 2 will give an idea of the trends and strategies in the United States (US) and Europe, thereby tailoring the discussion to the ethical and legal debate of AI-driven healthcare. This will be followed in Section 3 by a discussion of four primary ethical challenges, namely, (1) informed consent to use, (2) safety and transparency, (3) algorithmic fairness and biases, and (4) data privacy. Section 4 will then analyze five legal challenges in the US and Europe: (1) safety and effectiveness, (2) liability, (3) data protection and privacy, (4) cybersecurity, and (5) intellectual property law. Finally, Section 5 will summarize the major conclusions and especially emphasize the importance of building an AI-driven healthcare system that is successful and promotes trust and the motto Health AIs for All of Us.

Fourth Amendment Protections of Health Information After Carpenter v. United States: The Devil's In The Database

Every day, companies collect health information from customers and analyze it for commercial purposes. This poses a significant threat to privacy, particularly as the Fourth Amendment protection of this deeply personal information is limited. Generally, law enforcement officers do not need probable cause and a warrant to access these private health information databases; only a subpoena is required, and sometimes nothing at all. The Fourth Amendment protections for health information may, however, have changed after the Supreme Court's 2018 decision in Carpenter v. United States, which held that the Fourth Amendment protects people from warrantless searches of historical cell-site location information possessed by their cell phone providers. The Court explained that, because of the nature of historical cell-site location information, individuals retain a reasonable expectation of privacy despite the information being in the possession of a third party. In reaching its holding, the Supreme Court considered the type of data, the uniqueness of cell-site location information, the impact of technological advancement on privacy, the voluntariness of the disclosure, and the property rights associated with the records. Many of these factors could support heightened Fourth Amendment protection for health information. This Article argues that Carpenter v. United States provides additional protections for future searches of health information in private databases.