Abstract:Background: Data protection is important for all information systems that deal with human-subjects data. Grid-based systems--such as the cancer Biomedical Informatics Grid (caBIG)--seek to develop new mechanisms to facilitate real-time federation of cancer-relevant data sources, including sources protected under a variety of regulatory laws, such as HIPAA and 21CFR11. These systems embody new models for data sharing, and hence pose new challenges to the regulatory community, and to those who would develop or adopt them. These challenges must be understood by both systems developers and system adopters. In this paper, we describe our work collecting policy statements, expectations, and requirements from regulatory decision makers at academic cancer centers in the United States. We use these statements to examine fundamental assumptions regarding data sharing using data federations and grid computing. Methods: An interview-based study of key stakeholders from a sample of US cancer centers. Interviews were structured, and used an instrument that was developed for the purpose of this study. The instrument included a set of problem scenarios--difficult policy situations that were derived during a full-day discussion of potentially problematic issues by a set of project participants with diverse expertise. Each problem scenario included a set of open-ended questions that were designed to elucidate stakeholder opinions and concerns. Interviews were transcribed verbatim and used for both qualitative and quantitative analysis. For quantitative analysis, data was aggregated at the individual or institutional unit of analysis, depending on the specific interview question. Results: Thirty-one (31) individuals at six cancer centers were contacted to participate. Twenty-four out of thirty-one (24/31) individuals responded to our request- yielding a total response rate of 77%. Respondents included IRB directors and policy-makers, privacy and security officers, directors of offices of research, information security officers and university legal counsel. Nineteen total interviews were conducted over a period of 16 weeks. Respondents provided answers for all four scenarios (a total of 87 questions). Results were grouped by broad themes, including among others: governance, legal and financial issues, partnership agreements, de-identification, institutional technical infrastructure for security and privacy protection, training, risk management, auditing, IRB issues, and patient/subject consent. Conclusion: The findings suggest that with additional work, large scale federated sharing of data within a regulated environment is possible. A key challenge is developing suitable models for authentication and authorization practices within a federated environment. Authentication--the recognition and validation of a person's identity--is in fact a global property of such systems, while authorization - the permission to access data or resources--mimics data sharing agreements in being best served at a local level. Nine specific recommendations result from the work and are discussed in detail. These include: (1) the necessity to construct separate legal or corporate entities for governance of federated sharing initiatives on this scale; (2) consensus on the treatment of foreign and commercial partnerships; (3) the development of risk models and risk management processes; (4) development of technical infrastructure to support the credentialing process associated with research including human subjects; (5) exploring the feasibility of developing large-scale, federated honest broker approaches; (6) the development of suitable, federated identity provisioning processes to support federated authentication and authorization; (7) community development of requisite HIPAA and research ethics training modules by federation members; (8) the recognition of the need for central auditing requirements and authority, and; (9) use of two-protocol data exchange models where possible in the federation.

Balancing Confidentiality and Sharing of Genomic and Phenotypic Data in a Clinical Research System

A framework for sharing of clinical and genetic data for precision medicine applications

Privacy-Preserving Collaborative Genomic Research: A Real-Life Deployment and Vision

Enabling responsible public genomics

Safeguarding Privacy in Genome Research: A Comprehensive Framework for Authors

Towards a Privacy Preserving Cohort Discovery Framework for Clinical Research Networks.

Privacy-preserving record linkage across disparate institutions and datasets to enable a learning health system: The national COVID cohort collaborative (N3C) experience

Hospital-wide access to genomic data advanced pediatric rare disease research and clinical outcomes

GenIA, the Genetic Immunology Advisor database for Inborn Errors of Immunity.

Clinical Informatics Approaches to Facilitate Cancer Data Sharing

INCREASING ANCESTRY DIVERSITY IN PSYCHIATRIC GENOMICS RESEARCH

Controlling my genome with my smartphone: first clinical experiences of the PROMISE system

An Intelligent Search & Retrieval System (IRIS) and Clinical and Research Repository for Decision Support Based on Machine Learning and Joint Kernel-based Supervised Hashing

Abstract A138: Decreasing disparities in inherited cancer syndrome identification through a systems approach, The At-Risk Cancer Genetic Syndrome Identification (ARCAGEN-ID) system

Establishing an infrastructure to optimize the integration of genomics into research: Results from a precision health needs assessment

Confidentiality, privacy, and security of genetic and genomic test information in electronic health records: points to consider

Managing personal health information in distributed research network environments

A framework for employing longitudinally collected multicenter electronic health records to stratify heterogeneous patient populations on disease history

Security and privacy requirements for a multi-institutional cancer research data grid: an interview-based study

Data integration between clinical research and patient care: A framework for context-depending data sharing and in silico predictions

Sharing privacy-sensitive access to neuroimaging and genetics data: a review and preliminary validation