A Risk Management Framework for Identifiability in Genomics Research

基因组学研究中可识别性的风险管理框架

• 批准号: 9193769
• 负责人: Bradley A. Malin
• 金额: $ 26.84万
• 依托单位: VANDERBILT UNIVERSITY MEDICAL CENTER
• 依托单位国家: 美国
• 财政年份: 2012
• 资助国家: 美国
• 起止时间: 2012-09-21 至 2020-07-31
• 项目状态: 已结题
• 来源: https://reporter.nih.gov/project-details/9193769
• 关键词: Academic Medical Centers; Accounting; Address; Adopted; Agreement; Back; Behavior; Case Study; Collection; Computerized Medical Record; Contracts; Control Groups; Cost Measures; Data; Data Aggregation; Data Collection; Data Set; Databases; Detection; Foundations; Funding; Genome; Genomic Segment; Genomics; Grant; Health; Individual; Information Systems; Internet; Investigation; Knowledge; Lead; Length; Life; Link; Measures; Medical center; Modeling; Motivation; Names; Paper; Participant; Peer Review; Phase; Play; Policies; Policy Maker; Precision Medicine Initiative; Privacy; Probability; Process; Progress Reports; Publications; Published Database; Publishing; Punishment; Records; Reporting; Research; Research Personnel; Research Project Grants; Resources; Risk; Risk Assessment; Risk Management; Scientist; Services; Societies; System; Theoretical model; Time; Translations; United States National Institutes of Health; Variant; Work; base; cohort; cost; data sharing; database of Genotypes and Phenotypes; design; genomic data; human subject; phenome; precision medicine; repository; risk mitigation; social; socioeconomics; statistics; theories; tool; virtual

The past decade has witnessed numerous demonstrations that genomic data can be traced back to the corresponding named individuals. These attacks exploit various collections, including the NIH Database of Genotypes and Phenotypes (dbGaP), the 1000 Genomes Project, and the Beacon Project of the Global Alliance for Genomics and Health, and are often reported in the popular media. At the same time, research conducted in the first phase of this grant (from 2012-2016) showed that such re-identification attacks often represent worst- case, non-generalizable scenarios. Specifically, it was shown that these attacks often focus on the possibility of attack - and not its probability given the wide range of factors often at play in practice. By focusing on the possible, such investigations can lead policy makers to believe that de-identification is a useless activity. However, our research showed that de-identification is only one part of a larger strategy of deterrents that can be used to manage risk. By intelligently combining de-identification with other technical risk mitigation approaches (e.g., controlled access) and societal constructs (e.g., data use agreements and penalties), genomic data sharing solutions can be developed with appropriate levels of risk and utility for scientists and society. While our research laid the foundation for managing identification risk in genomic data sharing, significant questions remain regarding its translation into practical guidance. In particular, risk management models must be specialized to the type of data that is shared, the types of penalties (or punishments) available, and the costs of adopting and administering deterrence mechanisms. Thus, in the second phase of this research project, we propose to augment risk-based re-identification management frameworks to model and assess the deterrence approaches invoked by existing repositories, such as dbGaP (which holds a collection of smaller historical datasets from completed studies), as well as emerging initiatives, such as the Precision Medicine Initiative. This project will pursue three specific aims, designed to work in harmony, but at the same time sufficiently independent that if one fails, the research will still yield fruitful risk management guidance for genomic databases: 1) Develop game theoretic models to assess re-identification attacks at different levels of detail in genomic data sharing (e.g., aggregate summaries of the proportion of variants in case vs. control groups in association studies); 2) Characterize and measure the costs associated with common re-identification deterrence approaches for genomic data (e.g., physical investigatory reviews and virtual audits of IT system use); and 3) Optimize the parameterization of a deterrence policy (e.g., the amount of damages for violation of a data use agreement or the amount of time to withhold data from an attacker/investigator) given the expected value of genomic data. We will evaluate these approaches with a large repository of de-identified genomic and electronic medical records in use at a large academic medical center, datasets hosted at two federal repositories, and a web system that presents summary statistics from a cohort of 9000 participants.

过去十年见证了无数的证据表明基因组数据可以追溯到 相应命名的个人。这些攻击利用了各种集合，包括 NIH 数据库 基因型和表型 (dbGaP)、千基因组计划和全球联盟的灯塔计划 用于基因组学和健康，并经常在大众媒体上报道。同时，开展了研究 在这笔赠款的第一阶段（从 2012 年至 2016 年）表明，此类重新识别攻击通常代表最糟糕的情况- 案例，不可概括的场景。具体来说，研究表明这些攻击通常集中于以下可能性： 攻击——而不是考虑到实践中经常发挥作用的各种因素，而不是其概率。通过专注于 有可能，此类调查可能会让政策制定者相信去识别化是一项无用的活动。 然而，我们的研究表明，去识别化只是更大威慑战略的一部分，该战略可以 用于管理风险。通过将去身份识别与其他技术风险缓解巧妙地结合起来 方法（例如，受控访问）和社会结构（例如，数据使用协议和处罚）、基因组 可以为科学家和社会开发具有适当风险和效用的数据共享解决方案。尽管 我们的研究为管理基因组数据共享中的识别风险、重大问题奠定了基础 仍将其转化为实际指导。特别是，风险管理模型必须 专门针对共享数据的类型、可用的惩罚（或惩罚）类型以及惩罚的成本 采用和管理威慑机制。因此，在这个研究项目的第二阶段，我们 建议加强基于风险的重新识别管理框架，以建模和评估威慑力 现有存储库调用的方法，例如 dbGaP（它保存了较小的历史记录的集合） 已完成研究的数据集）以及新兴举措，例如精准医学计划。这 项目将追求三个具体目标，旨在协调工作，但同时足够独立 即使失败，该研究仍将为基因组数据库提供富有成效的风险管理指导：1）开发 用于评估基因组数据共享中不同细节级别的重新识别攻击的博弈论模型 （例如，关联研究中病例组与对照组中变异比例的汇总）； 2） 描述并衡量与常见的重新识别威慑方法相关的成本 基因组数据（例如，物理调查审查和 IT 系统使用的虚拟审计）； 3）优化 威慑政策的参数化（例如，违反数据使用协议或 给定基因组数据的预期值，向攻击者/调查者隐瞒数据的时间量）。 我们将使用大量未识别的基因组和电子医疗信息库来评估这些方法 大型学术医疗中心使用的记录、两个联邦存储库托管的数据集以及一个网络系统 它提供了 9000 名参与者的汇总统计数据。