Kald Abdallah

	There is a recognition within the research community that the re-analysis of clinical trials data can provide new insights compared to the original publications.

 In addition, the increasing complexity of science requires multiple teams to collaborate and analyze the same data set from different perspectives, pool data sets, and link multiple data sets.

	Regulators at the European Medicines Agency (EMA) have also issued a policy on the release of clinical study reports (CSRs) for drugs receiving marketing authorization.

 A manufacturer is expected to provide the agency with the full CSR as normal, and a de-identified copy, which the agency will then release. There is an expectation that in the coming years another policy from the EMA on the release of individual participant data (IPD) from these clinical trials will be issued as well. To achieve the benefits of data sharing, and in anticipation of a policy on IPD from the EMA, manufacturers have already started implementing the infrastructure and mechanisms to release IPD.

	Whether we are referring to CSRs or to IPD, the personal information of the trial participants needs to be de-identified. De-identification means that the probability of determining the identity of an individual in the data set is very small. In this article, we will describe the methods that can be used to de-identify clinical trial data, and their relative strengths and weaknesses.

	Manufacturers may select trials that they wish to share data for, and then de-identify the data sets in advance of any data request for all of these selected trials. When a request for a data set is received, the prepared data set is then provided. Another approach is to only de-identify a data set after a request has been made and approved.

	The former approach ensures an expeditious response to data requests, but has a number of disadvantages. The first is that it assumes that all selected trials data sets will at some point be requested. This is not necessarily going to be the case. Therefore, data sets may be de-identified that are never shared. The second disadvantage is that the de-identification is not calibrated to the needs of the data requestor. For example, a de-identification exercise may generalize the geography from country to continent, but the data analyst may wish to do country-by-country comparisons or include country as a covariate in their analysis. This would not be possible if the data had already been de-identified in advance without geography at the country level.

	Therefore, the choice of approach is a trade-off between responsiveness, efficiency, and data quality. There are examples of each approach being employed in practice. This trade-off applies to both CSR and IPD de-identification.

	For sharing IPD, there are two commonly used mechanisms: (a) microdata, and (b) a portal. Under the former mechanism, individual participant records are released (microdata) to the data recipient, such as the 

 This could be in the format of SAS files, a set of simple comma separated variable files, or some other format. Alternatively, the manufacturer may provide access to the data through a portal. This second option does not allow the data recipient to download the raw data and all analysis is performed through the portal. The portal would have common statistical and graphing software pre-installed allowing the data recipient to perform the necessary analysis wholly within the portal environment.

	It is important to keep in mind that de-identification is a legal requirement in many jurisdictions. That means that it is not permissible to share personal information without consent where the probability of identifying an individual is high. If a manufacturer does so then there may be negative legal, financial, and reputational consequences. These negative consequences may accrue directly from regulators, litigation, and bad media coverage.

	There are a number of plausible risks and attack vectors on a clinical trial data set. One risk to consider is that of a study participant filing a complaint with their regulator. This may be a data protection authority in the European Union (EU), or a privacy commissioner in Canada, for example. In such a case, the regulator must make a determination of whether the data set was truly de-identified. If the determination was that the data was not properly de-identified, then the data release would be considered a data breach. Some manufacturers can attempt to preempt such a risk by obtaining support from their regulator in advance of data sharing. However, such support would be needed from every jurisdiction from where data is being collected.

	If the mechanism of data release is a microdata set, then there are three plausible re-identification attacks on the data by an adversary that need to be protected against, as summarized in Table 1 below.

 To mitigate against these attacks, it is necessary to: (a) have the data recipients sign a contract or agree to terms-of-use prohibiting re-identification, (b) the contract needs to impose strong security and privacy practices on the data recipient, and (c) the data itself needs to be modified to reduce the risk of re-identification.

In the case where the data release mechanism is a portal, then the portal operator can implement many of the security controls, but the data recipient still needs to implement some practices at their end as well (e.g., from basic things like not share their passwords for the portal, to security measures on the machines they use to access the portal). In addition, portal operators almost always require some kind of contract or terms-of-use. Therefore, the main risk for when using a portal to share data is from an inadvertent re-identification by a data user, which still requires the data to be modified. Therefore, defensible de-identification needs to be deployed in a manner that will satisfy multiple regulators, and irrespective of whether the data is being shared as microdata files or through a portal.

	In general, no consent for data sharing was sought from historical trials, and, therefore, de-identification would be a legal requirement for sharing those data. Prospectively, it would be possible to ask new participants for consent. However, consent to share is typically accompanied by assurances that the data sharing will be of de-identified data and that responsible practices will be employed.

	There are two general approaches to de-identification exemplified by the two methods stipulated in the Privacy Rule of the US Health Insurance Portability and Accountability Act (HIPAA) of 1996:

 (a) Safe Harbor, and (b) Expert Determination.

	A Safe Harbor approach requires that a specific pre-defined and fixed set of variables or information types are removed or generalized in all clinical trial data sets. It is a simpler approach, and has been adopted by some manufacturers. This approach has a number of disadvantages:

		The Safe Harbor method is only legally accepted in the U.S. and not in any other jurisdiction. Furthermore, its empirical foundation was based on an analysis of US census data. This method has no empirical basis in other jurisdictions.

		Assuming a fixed set of variables upfront will not account for all cases where there may be more variables that need to be de-identified nor does it account for changes in technology where additional variables become risky over time from a re-identification perspective.

		It is known that data sets, which meet the Safe Harbor standard, can still have a high risk of re-identification.

	In order to have defensible de-identification practices, they need to meet some basic principles (which are derived from the Expert Determination method under the HIPAA Privacy Rule):

		Use generally accepted statistical and computational practices in the disclosure control community to de-identify data.

		Ensure that the risk of re-identification is very small.

		The de-identification should be performed by an analyst with appropriate knowledge of these de-identification practices.

		Document the methods used and their results.

	De-identification results in the loss of information in the data, or in a reduction in data utility. This means that the data is perturbed in some manner (various techniques will be described ahead). The amount of perturbation should not be severe, otherwise the conclusions drawn from the analysis of the de-identified data may be different from the conclusions drawn from the analysis of the original data. It would not be acceptable, and indeed could be quite problematic, if the conclusions on de-identified data from the same analysis are materially different from those in published studies. Although, it has been argued that a re-analysis that does nothing but confirm the original conclusions probably has little scientific value and would not be publishable anyway.

	On the other hand, when preparing a de-identified data set, the amount of perturbation cannot be so minimal that the probability of identifying an individual participant remains high. Therefore, a balance must be reached between the two objectives: high utility data and an acceptably low probability of re-identification.

	In practice, simply stating that the probability of re-identification is small will not be sufficient. It is necessary to have objective evidence demonstrating that the probability of re-identification is small. The primary reasons are that a simple statement may not be convincing to a regulator investigating a complaint from a trial participant, a regulator investigating a breach, or in litigation about whether personal information was disclosed.

	Let us explore a de-identification example in which the date of birth of participants in a clinical trial data set is changed to year of birth, and no other variables in the dataset are altered. The analyst performing the de-identification states and believes that the risk of re-identification is acceptably small. Imagine then there is a data breach, a complaint to a privacy regulator about data sharing by one of the trial participants, or litigation arguing that the shared data is not de-identified properly. The only evidence that the manufacturer has to support its claim that the data is indeed de-identified is the analyst’s statements. These may be countered by another analyst’s claims on the plaintiff’s side. Without objective data demonstrating that the risk is small, the manufacturer’s claims can be easily discounted or cast into doubt. This is not an issue to be taken lightly by manufacturers or those developing de-identification standards.

	Consequently, it is important to consider methods to measure the probability of re-identification and to demonstrate that the risk of re-identification is indeed acceptably small.

	This basic principle is applicable to the de-identification of CSRs and IPD. Since both of these types of information pertain to the same study, it would not be appropriate to have more personal information included in a shared CSR but less in an IPD, or vice versa. Doing so could leak personal information unintentionally on a systematic basis. The level of de-identification needs to be consistent for both.

Personal information in a clinical trial data set

	A data set has two types of variables that can leak personally identifying information: direct identifiers and quasi-identifiers. Direct identifiers are features like names, telephone numbers, full addresses, social security numbers, clinical trial participant numbers, and medical device serial numbers. That kind of information is considered to easily identify trial participants and is either removed from a de-identified file that is shared, or in the case of unique identifiers, pseudonymized. A classification of variables into direct and quasi-identifiers for clinical trials has been completed by a PhUSE (Pharmaceutical Users Software Exchange) working group.

	Sometimes it is necessary to disclose unique identifiers, such as a clinical trials participant number or subject ID. Such unique identifiers are important to allow the linking of records that belong to the same individual. While some may argue that it is hard to re-identify individuals using this type of number, it is explicitly mentioned by regulators as a direct identifier, for example, in the HIPAA de-identification guidelines.

 These types of unique identifiers would be converted into pseudonyms to allow multiple records that belong to the same participant to be linked together. There are established standards for such pseudonymization.

	The second type of variable, the quasi-identifiers, consists mostly of dates, location information, demographics, and socio-economic information. Rare diagnoses, concomitant illnesses and medications, and serious adverse events such as death, hospitalization, and birth defects would also be considered quasi-identifiers.

	This type of information can identify individuals in a data set: All known re-identification attacks (on non-genetic data) have been performed using only these quasi-identifiers.

 Therefore, it is important to deal with quasi-identifiers. However, we cannot just remove them as these variables are very useful for the analysis. More sophisticated techniques need to be applied to retain the value of these variables but also reduce the probability that these variables can re-identify participants.

	Manipulations of direct identifiers effectively eliminate the risk of re-identification from that information. Specific issues do arise, however.

	Most direct identifiers, such as participant names, are rarely transmitted to the sponsor. However, such information may be included in free-form text fields.

	Many manufacturers simply remove free-form text fields. This may result in some key information being removed (such as a narrative about why a participant withdrew from a study). There is a general belief that text fields cannot be easily de-identified. That is not necessarily the case. There are good automated techniques that will detect direct and quasi-identifiers in free form text.

 To the extent that text information is useful for the analysis of trial data, this data can be de-identified as well.

	One challenge of free-form text information is when it is inserted in the incorrect fields. For example, a field that may expect dosage information may have participant identifying information in it. With modern electronic data entry systems, validation is typically performed at the point of data entry for many fields, but some are still left open. Furthermore, such validation may not have been in place for older trials with less sophisticated data entry systems. This would not be anticipated a priori by the de-identification team and may result in identifying information being exposed.

	It is, therefore, necessary to run a PHI discovery tool on the data set to identify the fields and records that may potentially contain PHI. A discovery tool processes all of the text and flags records or documents that may contain PHI by using information extraction techniques.

 Once the discovery phase is completed, then these rogue text comments can be redacted.

	All unique participant identifiers, such as participant IDs, need to be pseudonymized.

Unique identifiers sometimes are made up of a site number, patient initials, and patient date of birth. All of these elements can increase the probability of re-identification. Even if that is not the case, at least in the U.S., there is a regulatory issue to consider as well which clarifies the status of a record identifier and the ability to assign an identity to it by a covered entity (e.g., the hospital providing the data). Under the HIPAA Privacy Rule (45 CFR 164.514 (c)) it states:

A covered entity may assign a code or other means of record identification to allow information deidentified under this section to be reidentified by the covered entity, provided that:

(1) Derivation. The code or other means of record identification is not derived from or related to information about the individual and is not otherwise capable of being translated so as to identify the individual; and

(2) Security. The covered entity does not use or disclose the code or other means of record identification for any other purpose, and does not disclose the mechanism for re-identification.

	A subject ID would not meet this requirement because it is clearly a code or other means of record identification that would allow re-identification by a covered entity that is “derived,” and disclosure of a subject ID by itself reveals the method of re-identification (i.e., match against the medical records system).

	If that code was encrypted, then it would still be considered derived. However, the HHS guidance

 clarifies item (c)(1) by stating that a code can be a cryptographic pseudonym provided that the keys associated with such functions are not disclosed, including to the recipients of the de-identified information. But unless a subject ID is pseudonymized using a cryptographic function then this clarification would not be applicable.

	Furthermore, a subject ID is used quite extensively in the context of site operations. The subject ID will show up on case report forms (CRFs) and all other trial documentation, including adverse event reports and billing records. The covered entity will clearly use and disclose the subject ID for other purposes quite extensively. Therefore, it should always be the case that a subject ID is treated as a direct identifier and pseudonymized.

	Another type of unique identifier would be an ID automatically generated by a database that is used only to track records within the database. While this is still a unique identifier it is not used outside the database. The fact that this ID is only used within the database means that the only way to re-identify individuals is if an adversary already has access to the database. Therefore, unlike subject IDs, these types of machine IDs would not necessarily be considered direct identifiers since their access and use are quite different from subject IDs in a trial.

	Unique identifiers that are pseudonymized should have a uniform distribution (e.g., one value per participant). Otherwise they are susceptible to a frequency analysis. This is elaborated upon further ahead. Where the same patient is included in a sub-study, then the same pseudonym can be used in the sub-study as well.

	Is it necessary to remove all of the personal information (the direct identifiers) about the clinicians and site staff who took part in the trial? This information will typically be the name and contact information of these clinicians and trial staff. That information may be in the structured data or in the CSRs. The answer will depend on the jurisdiction.

	In the U.S., under the HIPAA Privacy Rule, information about participants or of relatives, employers, or household members of the participants needs to be considered when de-identifying a data set. In this case, it is not necessary to remove the provider information. However, HIPAA also has the minimum necessary requirement, which states that protected health information should not be used or disclosed when it is not necessary to satisfy a particular purpose or carry out a function. If the provider information is not going to serve any purpose when disclosed, then it should not be disclosed.

	One should also be cognizant that, even if not required by regulation, if identifiable data about a provider is shared, there is the risk that the provider may initiate litigation on an invasion-of-privacy claim. Consequently, it is advisable not to share provider information, especially if it does not serve a purpose.

	In Canada, the issue of disclosing personal information about providers has come up in the context of the disclosure of prescription data. It has been determined that in this case the disclosure of prescriber identity is not considered a disclosure of personal information and is permitted.

	Unlike in Canada, in the EU prescriber information is considered personal information about the provider, even if the patient is de-identified.

 The Article 29 Working Party states that “providing information about prescriptions written by identified or identifiable doctors […] constitutes a communication of personal data to third-party recipients in the meaning of the Directive.”

 Arguably then, the same logic applies to providers and site staff in clinical trials.

	Therefore, given that clinical trials data will be coming from multiple jurisdictions, it will be more prudent to actively remove provider and site staff personal information from the data. Removing provider information has another advantage: Provider information can reveal where a participant lives. Since it is easy to determine the practice location for providers if their identity is known, this can lead to predicting the residence location of patients.

	One way to manipulate the probability of re-identification is to change the granularity of the quasi-identifiers. For example, a date of birth can be changed to a year of birth. Or an exact income, for example, may be changed to an income range. This is a form of generalization.

	It may also be necessary to suppress specific values in the data. For example, there may be something about a trial participant’s demographics or medical history that makes them an outlier. That particular piece of information may be suppressed in the shared data set so that they are no longer such an outlier. Alternatively, whole patients maybe removed. Although because the number of participants in many trials is not large, the removal of participants would have a nontrivial impact on data utility. Suppression may also be vertical where a whole field is suppressed and not shared at all.

	Other disclosure control techniques, such as sub-sampling, would generally not be applicable for clinical trials data because the data sets are already small. A sub-sample would affect statistical power and possibly affect the conclusions drawn from the study.

	The amount of modification that needs to be applied to the quasi-identifiers depends on the context of the data release (see Figure 1). 

	This context-based approach is consistent with guidelines from regulators.

		The data recipient (the security and privacy controls that they have in place, as well as their motives and financial resources to re-identify the data).

		The data (the sensitivity of the data, the potential harm to the participants if there is a re-identification, and the extent to which the participants consented or have been informed about the data sharing when the data was collected or since then).

		The contract (the existence and strength of the contractual clauses limiting re-identification attempts).

	Once the amount of de-identification that needs to be applied has been determined, specific generalization and suppression techniques can be applied on the data. Beyond that, there are some factors that are somewhat unique to clinical trials data sets that add complexity but also introduce opportunities to create high utility data sets.

	One of the pieces of information that increases the probability of re-identification significantly are dates. In many instances the exact dates are not critical for analyses, but rather the time since enrolment or randomization in a study is sufficient. For example, it is important to know how many days after visit 2 a participant experienced an adverse


	reaction. This can be achieved by using the enrollment date as an anchor and computing all dates as intervals since then. This is illustrated in Table 2.

	This approach works well if the recruitment period is spread out over a long interval. If recruitment is happening over a short interval, then it is easy to determine the anchor date for many participants. For example, this is typically the case for vaccine trials.

Also, if the recruitment period for a trial site or a country can be determined from public sources (e.g., trial registration websites), then it would also be possible to determine the anchor date or approximate it. If an adversary can determine the anchor date, then the anchoring scheme is not going to protect privacy. For example, if it is known that all recruitment occurred in the second half of January then the first visit date can only be between Feb. 5 and Feb. 21. Whether this two-week range for the first visit date is acceptable or not needs to be assessed more thoroughly. But the point is that trying to protect the first visit date is constrained by the known recruitment interval.

	Another point to note with dates is that the visits tend to follow a well-defined pattern. This means that for the majority of participants, their interval between visits tends to be the same (or varies a little around the value in the protocol) and predictable from the protocol. Therefore, manipulating or perturbing inter-visit intervals is futile because they can be easily reverse-engineered.

	If it is desirable to have dates instead of intervals, then an actual 

Articles

Whether we are referring to CSRs or to IPD, the personal information of trial participants needs to be de-identified prior to release. This article will describe the available methods for de-identifying clinical trial data, and the relative strengths and weaknesses of each.

De-identifying Data in Clinical Trials

	There are a number of plausible risks and attack vectors on a clinical trial data set. One risk to consider is that of a study participant filing a complaint with their regulator. This may be a data protection authority in the European Union (EU), or a privacy commissioner in Canada, for example. In such a case, the regulator must make a determination of whether the data set was truly de-identified. If the determination was that the data was not properly de-identified, then the data release would be considered a data breach. Some manufacturers can attempt to pre-empt such a risk by obtaining support from their regulator in advance of data sharing. However, such support would be needed from every jurisdiction from where data is being collected.

	If the mechanism of data release is a microdata set, then there are three plausible re-identification attacks on the data by an adversary that need to be protected against, as summarized in Table 1.

	In the case where the data release mechanism is a portal, then the portal operator can implement many of the security controls, but the data recipient still needs to implement some practices at their end as well (e.g., from basic things like not share their passwords for the portal, to security measures on the machines they use to access the portal). In addition, portal operators almost always require some kind of contract or terms-of-use. Therefore, the main risk for when using a portal to share data is from an inadvertent re-identification by a data user, which still requires the data to be modified.

	Therefore, defensible de-identification needs to be deployed in a manner that will satisfy multiple regulators, and irrespective of whether the data is being shared as microdata files or through a portal.

		The Safe Harbor method is only legally accepted in the US and not in any other jurisdiction. Furthermore, its empirical foundation was based on an analysis of US census data. This method has no empirical basis in other jurisdictions.

	This basic principle is applicable to the de-identification of CSRs and IPD. Since both of these types of information pertain to the same study, it would not be appropriate to have more personal information included in a shared CSR but less in an IPD, or vice versa. Doing so could leak personal information unintentionally on a systematic basis. The level of de-identification needs to be consistent for both.
	 

	Manipulations of direct identifiers effectively eliminate the risk of re-identification from that information. Specific issues do arise, however.
	 

 Once the discovery phase is completed, then these rogue text comments can be redacted.
	 

 We will explain the reasoning behind this below.

	Unique identifiers sometimes are made up of a site number, patient initials, and patient date of birth. All of these elements can increase the probability of re-identification. Even if that is not the case, at least in the US, there is a regulatory issue to consider as well which clarifies the status of a record identifier and the ability to assign an identity to it by a covered entity (e.g., the hospital providing the data). Under the HIPAA Privacy Rule (45 CFR 164.514 (c)) it states:
	 

	Furthermore, a subject ID is used quite extensively in the context of site operations. The subject ID will show up on case report forms (CRFs) and all other trial documentation, including adverse event reports and billing records. The covered entity will clearly use and disclose the subject ID for other purposes quite extensively.

	Therefore, it should always be the case that a subject ID is treated as a direct identifier and pseudonymized.

	Unique identifiers that are pseudonymized should have a uniform distribution (e.g., one value per participant). Otherwise they are susceptible to a frequency analysis. This is elaborated upon further ahead.

	Where the same patient is included in a sub-study, then the same pseudonym can be used in the sub-study as well.

	In the U.S. under the HIPAA Privacy Rule, information about participants or of relatives, employers, or household members of the participants needs to be considered when de-identifying a data set. In this case, it is not necessary to remove the provider information. However, HIPAA also has the minimum necessary requirement, which states that protected health information should not be used or disclosed when it is not necessary to satisfy a particular purpose or carry out a function. If the provider information is not going to serve any purpose when disclosed, then it should not be disclosed.

	Therefore, given that clinical trials data will be coming from multiple jurisdictions, it will be more prudent to actively remove provider and site staff personal information from the data.

	Removing provider information has another advantage: Provider information can reveal where a participant lives. Since it is easy to determine the practice location for providers if their identity is known, this can lead to predicting the residence location of patients.

	The amount of modification that needs to be applied to the quasi-identifiers depends on the context of the data release (see Figure 1). This context-based approach is consistent with guidelines from regulators.

Kald Abdallah

Articles

De-identifying Data in Clinical Trials

De-identifying Clinical Trials Data