A Risk Management Framework for Identifiability in Genomics Research

基因组学研究中可识别性的风险管理框架

• 批准号: 9360125
• 负责人: Bradley A. Malin
• 金额: $ 24.96万
• 依托单位: VANDERBILT UNIVERSITY MEDICAL CENTER
• 依托单位国家: 美国
• 财政年份: 2012
• 资助国家: 美国
• 起止时间: 2012-09-21 至 2020-07-31
• 项目状态: 已结题
• 来源: https://reporter.nih.gov/project-details/9360125
• 关键词: Academic Medical Centers; Address; Adopted; Agreement; Back; Behavior; Case Study; Collection; Computerized Medical Record; Contracts; Control Groups; Cost Measures; Data; Data Aggregation; Data Collection; Data Security; Data Set; Databases; Detection; Foundations; Funding; Genome; Genomic Segment; Genomic approach; Genomics; Grant; Health; Individual; Information Systems; Internet; Investigation; Knowledge; Lead; Length; Life; Link; Measures; Medical center; Modeling; Motivation; Names; Paper; Participant; Peer Review; Phase; Play; Policies; Policy Maker; Precision Medicine Initiative; Privacy; Probability; Process; Progress Reports; Publications; Published Database; Publishing; Punishment; Records; Reporting; Research; Research Personnel; Research Project Grants; Resources; Risk; Risk Assessment; Risk Management; Scientist; Services; Societies; System; Theoretical model; Time; Translations; United States National Institutes of Health; Variant; Work; base; cohort; cost; data sharing; database of Genotypes and Phenotypes; design; genomic data; human subject; phenome; phenotypic data; precision medicine; repository; risk mitigation; social; socioeconomics; statistics; theories; tool; virtual

The past decade has witnessed numerous demonstrations that genomic data can be traced back to the corresponding named individuals. These attacks exploit various collections, including the NIH Database of Genotypes and Phenotypes (dbGaP), the 1000 Genomes Project, and the Beacon Project of the Global Alliance for Genomics and Health, and are often reported in the popular media. At the same time, research conducted in the first phase of this grant (from 2012-2016) showed that such re-identification attacks often represent worst- case, non-generalizable scenarios. Specifically, it was shown that these attacks often focus on the possibility of attack - and not its probability given the wide range of factors often at play in practice. By focusing on the possible, such investigations can lead policy makers to believe that de-identification is a useless activity. However, our research showed that de-identification is only one part of a larger strategy of deterrents that can be used to manage risk. By intelligently combining de-identification with other technical risk mitigation approaches (e.g., controlled access) and societal constructs (e.g., data use agreements and penalties), genomic data sharing solutions can be developed with appropriate levels of risk and utility for scientists and society. While our research laid the foundation for managing identification risk in genomic data sharing, significant questions remain regarding its translation into practical guidance. In particular, risk management models must be specialized to the type of data that is shared, the types of penalties (or punishments) available, and the costs of adopting and administering deterrence mechanisms. Thus, in the second phase of this research project, we propose to augment risk-based re-identification management frameworks to model and assess the deterrence approaches invoked by existing repositories, such as dbGaP (which holds a collection of smaller historical datasets from completed studies), as well as emerging initiatives, such as the Precision Medicine Initiative. This project will pursue three specific aims, designed to work in harmony, but at the same time sufficiently independent that if one fails, the research will still yield fruitful risk management guidance for genomic databases: 1) Develop game theoretic models to assess re-identification attacks at different levels of detail in genomic data sharing (e.g., aggregate summaries of the proportion of variants in case vs. control groups in association studies); 2) Characterize and measure the costs associated with common re-identification deterrence approaches for genomic data (e.g., physical investigatory reviews and virtual audits of IT system use); and 3) Optimize the parameterization of a deterrence policy (e.g., the amount of damages for violation of a data use agreement or the amount of time to withhold data from an attacker/investigator) given the expected value of genomic data. We will evaluate these approaches with a large repository of de-identified genomic and electronic medical records in use at a large academic medical center, datasets hosted at two federal repositories, and a web system that presents summary statistics from a cohort of 9000 participants.

过去十年见证了许多证明基因组数据可以追溯到 对应的命名个人。这些攻击利用了各种集合，包括 基因型和表型（DBGAP），1000个基因组项目和全球联盟的灯塔项目 对于基因组学和健康，经常在流行媒体上进行报道。同时，研究进行了 在这笔赠款的第一阶段（从2012年至2016年开始）表明，这种重新识别攻击通常代表最坏 案例，不可用的场景。具体来说，已经表明，这些攻击通常集中在 攻击 - 鉴于在实践中经常发挥作用的各种因素，而不是其概率。通过关注 这种调查可能会导致政策制定者相信去识别是一项无用的活动。 但是，我们的研究表明，去识别只是更大的威慑策略的一部分，可以 用于管理风险。通过明智地结合识别与其他技术风险的相结合 方法（例如，受控访问）和社会结构（例如，数据使用协议和惩罚），基因组 可以为科学家和社会提供适当水平的风险和效用，可以开发数据共享解决方案。尽管 我们的研究奠定了管理基因组数据共享识别风险的基础 关于将其转化为实际指导。特别是，风险管理模型必须是 专门针对共享数据类型，可用的处罚类型（或可用的惩罚）以及 采用和管理威慑机制。因此，在该研究项目的第二阶段，我们 建议增加基于风险的重新识别管理框架以建模和评估威慑 现有存储库所调用的方法，例如DBGAP（其中包含较小历史的集合 来自完整的研究的数据集）以及新兴的计划，例如Precision Medicine Initiative。这 项目将追求三个特定的目标，旨在和谐，但同时足够独立 如果一个人失败，研究仍将为基因组数据库产生富有成果的风险管理指导：1）发展 游戏理论模型，以评估基因组数据共享中不同细节的重新识别攻击 （例如，在关联研究中与对照组相比，变体比例的总摘要）； 2） 表征并衡量与常见重新识别威慑方法相关的成本 基因组数据（例如，物理研究评论和对IT系统使用的虚拟审核）； 3）优化 威慑政策的参数化（例如，违反数据使用协议或 鉴于基因组数据的预期值，从攻击者/研究者中隐瞒数据的时间。 我们将使用大量的去识别基因组和电子医学的存储库来评估这些方法 在一个大型学术医学中心使用的记录，数据集托管在两个联邦存储库和一个网络系统 这介绍了来自9000名参与者的队列的摘要统计数据。