...

Action: Review the Interim Report and email David Clunie your comments.

February 8, 2022 Meeting

Interim Report Best Practices And Recommendations Extract as of 20220107

ITEM 6

• A paper in BMJ and Trials in which the editor said it's okay to keep three patient characteristics, but more than that requires serious analysis.
• For this report, David C. is leaning towards saying that if any characteristics are retained, a serious analysis should be performed.
• Fred asks what the risk threshold we are comfortable with. David says we need the analysis first, then compare that against the risk threshold.
• David recommends this for the report: Do the analysis, choose a risk threshold, and share your data based upon that analysis.
• Is this a reasonable recommendation given that none of us are doing the statistical analysis routinely?
• David Gutman: Studies that leave out age and sex are not interesting.
• Some TCIA collections are useful even without age and sex.
• HIPAA Safe Harbor is only useful in the US. We are trying to do more than these 18 elements when it comes to de-id.
• In radiology we have traditionally just relied on lists.
• Information can be derived or approximated from images. If pixel data render the data unique, change it to make it less recognizable or delete it. The analysis can lead you to a decision on how to handle this.
• We would be better off recommending this and then over the next several years, hopefully there will be more research into practical ways of doing this. 
• Invite selected people from the statistical disclosure community to comment on this and say which tools they use. 
• In Europe, GDPR has gotten to the point where you can't share any data. Do we want to go that route?
• Rather than get so extreme, maybe just leave age out of this data, or change it to meet the risk threshold.
• Is there a scalable way to do this?
• Radiology has been immature about this and has not considered existing research into approaches.
• David C. recommends that we read the CAR papers.
• David G: I realize this is a nuance.. but if we recommend X, and many of the people on this group don't currently do X because it's extremely difficult/nebulous. do we shoot ourselves in the foot? bone density?
• Fred: Hospitals in different countries. Multiple ethics review boards in the same country. Need a threshold that is agreed upon if you are going to de-id anything.
• The risk is finite, so we need to pick a threshold.
• Threshold: Probability of re-id based on threat model. Pick the most conservative one and compute the probability. 
• Justin: I'd be very interested to try applying one or two of these automated tools David mentioned against a couple of TCIA datasets to see what happens and help inform the recommendation in the report.
• David C: Yes, let's try this.
• People need to balance utility and risk and insure themselves in the meantime.
• Brian: Utility has zero value to legal people. Risk is always increasing because technology gets better and better.
• Countermeasures which hopefully will keep everything balanced. With released data, unless you are going to pull it back and not release it, the risk always goes up.
• Should we get a guest speaker for the next meeting? Group says yes.

ITEM 8

• For clinical data elements, the general principles in the PHUSE for CDISC SDTM should be applied.
• https://www.pharmasug.org/proceedings/2015/DS/PharmaSUG-2015-DS10.pdf
• https://advance.phuse.global/display/WEL/PHUSE+De-identification+Standards
• Ying asked if there is any overlap between these two standards. David says yes but doesn't know if they are conflicting. Someone should do a gap analysis.
• In general, if you're dealing with non-DICOM data, you should apply DICOM elements to it.

ITEM 9

• This is an obvious item that should be stated.
• David is undecided how to deal with stratification. Do people agree that it's fine to stratify images and not check each one?
• Brian checks each one because the metadata is not reliable enough to stratify it. Others agree with looking at everything and not stratifying.

Actions:

• David Clunie will recruit a statistician with the right expertise to speak with us at the March 8 meeting.
• David will continue refining the Interim Report.
• All Task Group members are welcome to email David your comments on the report.