Geospatial cryptography: enabling researchers to access private, spatially referenced, human subjects data for cancer control and prevention

As the volume, accuracy and precision of digital geographic information have increased, concerns regarding individual privacy and confidentiality have come to the forefront. Not only do these challenge a basic tenet underlying the advancement of science by posing substantial obstacles to the sharing of data to validate research results, but they are obstacles to conducting certain research projects in the first place. Geospatial cryptography involves the specification, design, implementation and application of cryptographic techniques to address privacy, confidentiality and security concerns for geographically referenced data. This article defines geospatial cryptography and demonstrates its application in cancer control and surveillance. Four use cases are considered: (1) national-level de-duplication among state or province-based cancer registries; (2) sharing of confidential data across cancer registries to support case aggregation across administrative geographies; (3) secure data linkage; and (4) cancer cluster investigation and surveillance. A secure multi-party system for geospatial cryptography is developed. Solutions under geospatial cryptography are presented and computation time is calculated. As services provided by cancer registries to the research community, de-duplication, case aggregation across administrative geographies and secure data linkage are often time-consuming and in some instances precluded by confidentiality and security concerns. Geospatial cryptography provides secure solutions that hold significant promise for addressing these concerns and for accelerating the pace of research with human subjects data residing in our nation's cancer registries. Pursuit of the research directions posed herein conceivably would lead to a geospatially encrypted geographic information system (GEGIS) designed specifically to promote the sharing and spatial analysis of confidential data. Geospatial cryptography holds substantial promise for accelerating the pace of research with spatially referenced human subjects data.

A Protocol for the secure linking of registries for HPV surveillance

INTRODUCTION

In order to monitor the effectiveness of HPV vaccination in Canada the linkage of multiple data registries may be required. These registries may not always be managed by the same organization and, furthermore, privacy legislation or practices may restrict any data linkages of records that can actually be done among registries. The objective of this study was to develop a secure protocol for linking data from different registries and to allow on-going monitoring of HPV vaccine effectiveness.

METHODS

A secure linking protocol, using commutative hash functions and secure multi-party computation techniques was developed. This protocol allows for the exact matching of records among registries and the computation of statistics on the linked data while meeting five practical requirements to ensure patient confidentiality and privacy. The statistics considered were: odds ratio and its confidence interval, chi-square test, and relative risk and its confidence interval. Additional statistics on contingency tables, such as other measures of association, can be added using the same principles presented. The computation time performance of this protocol was evaluated.

RESULTS

The protocol has acceptable computation time and scales linearly with the size of the data set and the size of the contingency table. The worse case computation time for up to 100,000 patients returned by each query and a 16 cell contingency table is less than 4 hours for basic statistics, and the best case is under 3 hours.

DISCUSSION

A computationally practical protocol for the secure linking of data from multiple registries has been demonstrated in the context of HPV vaccine initiative impact assessment. The basic protocol can be generalized to the surveillance of other conditions, diseases, or vaccination programs.

Predominant VNTR family of strains of Mycobacterium tuberculosis isolated from South Asian patients

SETTING

Despite the low incidence of tuberculosis in the UK, some minority ethnic groups, particularly those originating from South Asia, experience very high incidence rates.

OBJECTIVE

Comparison of the variable number tandem repeat (VNTR) profiles of strains of Mycobacterium tuberculosis circulating in an immigrant community in the UK with those found in the country of ethnic origin.

DESIGN

Isolates of M. tuberculosis were collected from samples obtained from patients attending clinics in Leeds and Bradford, UK and Rawalpindi, Pakistan. Strains were compared using VNTR analysis and mixed-linker PCR.

RESULTS

Comparison of VNTR profiles found that one profile (42235) represented 37% of patient isolates from Rawalpindi and 23% of patient isolates in Leeds and Bradford, where it was associated exclusively with patients with South Asian names. A second profile (02235) represented 15% of patient isolates in Leeds and Bradford, and was also exclusively associated with the South Asian community. These profiles could be subdivided by mixed-linker PCR analysis.

CONCLUSION

The VNTR profile 42235 may represent a family of strains commonly found in communities associated with South Asia.