**Scenario 2 -- De-identification**

**Target respondents: IRB members**

Dr. Reddy, director of translational research at your institution calls
you to tell you that they wish to become a part of the caTIES network.
They would like to become a data service provider, meaning that they
would contribute de-identified surgical pathology records to be
available for researchers at your institution and other institutions
that are part of this network of cancer centers.

1.  What kind of IRB protocol would likely be required (e.g. full
    review, expedited, exempt, not human subjects research)?

2.  Does this activity qualify as human subjects research? If you need
    more information to make this determination, what additional
    questions would you want to ask?

3.  If this is considered human subjects research, what specific risks
    (particular harms) are you most concerned about for the human
    subjects of the protocol?

4.  Are there specific standards that must be met by other institutions
    that participate in this network in order for you to approve the
    protocol?

5.  Does it matter whether the data is free-text (e.g. in a pathology
    report)with no primary identifiers (anonimized), as opposed to
    structured data (discrete data elements entered into fields)? How
    would this change your analysis?

6.  Does your institution have an approved process for
    de-identification?

A few weeks later, you receive a protocol from Dr. Reddy which includes
additional details. The software application accesses records that are
de-identified using an automated tool. Records are reviewed and the
occurrence of patient identifiers is extremely low but can occur. No
other method is practical as the number of records is in the hundreds of
thousands. There are additional quality assurance checks of anonymized
records and the algorithm can catch and remove most identifiers.

7.  Under what conditions would you approve this protocol? What concerns
    or questions would you have? What additional information or
    assurances would you need?

8.  What, if anything, would you want to know about the anonymization
    process (algorithm, operation, implementation, oversight,
    auditibility)?

9.  Does it matter whether the data is retrospective (previously
    collected) or prospective (to be collected after the study is
    approved)? How would this change your analysis?

10. The occurrence of identifiers in the documents is rare. However,
    there is some risk, which varies depending on the data element.
    Could you estimate an acceptable risk for each of the elements below
    (e.g. \<1/1000, \<1/10,000)

-   Patient initials (e.g. JKS)

-   Sample accession number (e.g. UD-23123)

-   Doctor's initials (e.g. DSS)

-   Hospital Name

-   City, Town or other location

11. What, if any, role does your IRB have in ensuring that your
    institution complies with the HIPAA Privacy Rule?

12. Does your institution have a more specific definition or
    implementation of de-identification/anonymization processes (for
    example, is removal of data elements in addition to those enumerated
    by HIPAA's "safe harbor" required)?

13. What specific data fields if any do you feel are most likely to
    increase the probability of successful re-identification? How should
    such fields be handled?

Dr Reddy's approved IRB protocol to be a data provider to the network is
general in that it states that he will provide data to all institutions
associated with caBIG. A new US institution (Institution X) joins caBIG
and the caTIES network. Institution X was not a member of the caTIES
network when Dr. Reddy's IRB protocol at your institution was granted.
Therefore Dr. Reddy does not specifically know anything about the
researchers who will be accessing data generated by your institution.

14. How would the entry of Institution X affect your analysis regarding
    de-identification?

15. What assurances would you need in place to continue to approve Dr.
    Reddy's protocol?

A number of participating institutions have felt the need for trust
agreements that would formalize the credentialing of users, and security
policies and procedures to be followed by members of the network.

16. For each element below, please comment on whether a trust agreement
    between institutions which included this element would affect your
    analysis and decision making for the scenario above:

    a.  Level of integrity protections (encryption, physical security,
        etc).

    b.  Statement that users will not attempt to re-identify previously
        de-identified data

    c.  Statement that users will not attempt to use data for purposes
        other than those allowed by the trust agreement

    d.  Liability allocation

    e.  Indemnification (not allowed for federal; usually not allowed
        for state)

    f.  Assurance and/or certification that staff with access to the
        data will receive training, including on privacy and security

    g.  Agreement to participate in defined security incident response
        policies and procedures

    h.  Penalties for breaching the terms of the agreement (please
        specify)

17. What other agreements would you like to see in place in the trust
    agreements?

Dr. Reddy contacts you again. Many researchers would like to use the
caTIES system to determine the number of specimens that are available to
use as preliminary findings in their grant applications. Also, he has
been contacted by at least one person from outside the University who is
interested in using the system to find out what tumors are common and
uncommon. Dr. Reddy would now like to provide aggregate data to the
general public in the form of histograms based on discrete intervals.
For example, he would like to be able to show the number of
Hepatocellular carcinomas over the last twenty years, for patients by
age in 5 year increments. The system will not return anything more
specific than this aggregated data.

18. Do you consider this human subjects research? Under what conditions?

19. If this is considered human subjects research, what specific risks
    (particular harms) are you most concerned about for the human
    subjects of the protocol?

20. Given that the system is available for query, it would be possible
    to maliciously use the system to determine patient information. For
    example, if you know that an 89-year-old patient was diagnosed with
    a brain tumor in the summer of 2004, and there was only one
    89-year-old patient diagnosed with a brain tumor that summer -- it
    might be possible to identify the patient. The number of records in
    an aggregate data set can be considered the "bin size". Do you have
    any specific recommendations about the minimum bin size for
    aggregate data?

Dr. Reddy calls you again a year later. His good friend in the UK would
like to become a member of the caTIES network as well, and UK
researchers would then be able to access the de-identified reports at
your institution.

21. What do you want to see from a foreign partner to approve the
    process going forward?

22. Are there specific international partnerships that you view as
    problematic? Why?