Abstract:Background: Data protection is important for all information systems that deal with human-subjects data. Grid-based systems--such as the cancer Biomedical Informatics Grid (caBIG)--seek to develop new mechanisms to facilitate real-time federation of cancer-relevant data sources, including sources protected under a variety of regulatory laws, such as HIPAA and 21CFR11. These systems embody new models for data sharing, and hence pose new challenges to the regulatory community, and to those who would develop or adopt them. These challenges must be understood by both systems developers and system adopters. In this paper, we describe our work collecting policy statements, expectations, and requirements from regulatory decision makers at academic cancer centers in the United States. We use these statements to examine fundamental assumptions regarding data sharing using data federations and grid computing. Methods: An interview-based study of key stakeholders from a sample of US cancer centers. Interviews were structured, and used an instrument that was developed for the purpose of this study. The instrument included a set of problem scenarios--difficult policy situations that were derived during a full-day discussion of potentially problematic issues by a set of project participants with diverse expertise. Each problem scenario included a set of open-ended questions that were designed to elucidate stakeholder opinions and concerns. Interviews were transcribed verbatim and used for both qualitative and quantitative analysis. For quantitative analysis, data was aggregated at the individual or institutional unit of analysis, depending on the specific interview question. Results: Thirty-one (31) individuals at six cancer centers were contacted to participate. Twenty-four out of thirty-one (24/31) individuals responded to our request- yielding a total response rate of 77%. Respondents included IRB directors and policy-makers, privacy and security officers, directors of offices of research, information security officers and university legal counsel. Nineteen total interviews were conducted over a period of 16 weeks. Respondents provided answers for all four scenarios (a total of 87 questions). Results were grouped by broad themes, including among others: governance, legal and financial issues, partnership agreements, de-identification, institutional technical infrastructure for security and privacy protection, training, risk management, auditing, IRB issues, and patient/subject consent. Conclusion: The findings suggest that with additional work, large scale federated sharing of data within a regulated environment is possible. A key challenge is developing suitable models for authentication and authorization practices within a federated environment. Authentication--the recognition and validation of a person's identity--is in fact a global property of such systems, while authorization - the permission to access data or resources--mimics data sharing agreements in being best served at a local level. Nine specific recommendations result from the work and are discussed in detail. These include: (1) the necessity to construct separate legal or corporate entities for governance of federated sharing initiatives on this scale; (2) consensus on the treatment of foreign and commercial partnerships; (3) the development of risk models and risk management processes; (4) development of technical infrastructure to support the credentialing process associated with research including human subjects; (5) exploring the feasibility of developing large-scale, federated honest broker approaches; (6) the development of suitable, federated identity provisioning processes to support federated authentication and authorization; (7) community development of requisite HIPAA and research ethics training modules by federation members; (8) the recognition of the need for central auditing requirements and authority, and; (9) use of two-protocol data exchange models where possible in the federation.

Sharing sensitive data in life sciences: an overview of centralized and federated approaches

Sharing Medical Big Data While Preserving Patient Confidentiality in Innovative Medicines Initiative: A Summary and Case Report from BigData@Heart

Privacy-preserving data sharing infrastructures for medical research: systematization and comparison

Bridging the European Data Sharing Divide in Genomic Science

Data Sharing Under the General Data Protection Regulation: Time to Harmonize Law and Research Ethics?

Unlocking biomedical data sharing: A structured approach with digital twins and artificial intelligence (AI) for open health sciences

What Do We Mean by Sharing of Patient Data? DaSH - A Data Sharing Hierarchy of Privacy and Ethical Challenges

A guide to sharing open healthcare data under the General Data Protection Regulation

Security and privacy requirements for a multi-institutional cancer research data grid: an interview-based study

Enabling Global Image Data Sharing in the Life Sciences

What ethical approaches are used by scientists when sharing health data? An interview study

Fresh takes on five health data sharing domains: Quality, privacy, equity, incentives, and sustainability

Responsible data sharing in international health research: a systematic review of principles and norms

A Global Analysis of Approaches to Sharing Clinical Data with Patients

Making sense of big data in health research: Towards an EU action plan

Germany's Approach for the Secondary Use of Federated Real-World Data in the German Portal for Medical Research Data

Health Data Sharing towards Knowledge Creation

Clinical Informatics Approaches to Facilitate Cancer Data Sharing

Modelling and enforcing privacy for medical data disclosure across Europe

Privacy Policy and Technology in Biomedical Data Science.

Data sharing policies across health research globally: Cross‐sectional meta‐research study