A Protocol for the Secure Linking of Registries for HPV Surveillance

Abstract

IntroductionIn order to monitor the effectiveness of HPV vaccination in Canada the linkage of multiple data registries may be required. These registries may not always be managed by the same organization and, furthermore, privacy legislation or practices may restrict any data linkages of records that can actually be done among registries. The objective of this study was to develop a secure protocol for linking data from different registries and to allow on-going monitoring of HPV vaccine effectiveness.MethodsA secure linking protocol, using commutative hash functions and secure multi-party computation techniques was developed. This protocol allows for the exact matching of records among registries and the computation of statistics on the linked data while meeting five practical requirements to ensure patient confidentiality and privacy. The statistics considered were: odds ratio and its confidence interval, chi-square test, and relative risk and its confidence interval. Additional statistics on contingency tables, such as other measures of association, can be added using the same principles presented. The computation time performance of this protocol was evaluated.ResultsThe protocol has acceptable computation time and scales linearly with the size of the data set and the size of the contingency table. The worse case computation time for up to 100,000 patients returned by each query and a 16 cell contingency table is less than 4 hours for basic statistics, and the best case is under 3 hours.DiscussionA computationally practical protocol for the secure linking of data from multiple registries has been demonstrated in the context of HPV vaccine initiative impact assessment. The basic protocol can be generalized to the surveillance of other conditions, diseases, or vaccination programs.

Linking Canadian Population Health Data: Maximizing the Potential of Cohort and Administrative Data

“…New protocols for data encryption and analysis of distributed databases can also offer solutions to the issue of sharing individual-level data across institutions and across jurisdictions. [10][11][12] Toronto workshop participants generally agreed that the challenges are surmountable, and that the important public health benefits of an effective linkage process would indeed justify the efforts required to put it in place. A five-point action plan was therefore What Is Data Linkage?…”

Rmind: A Tool for Cryptographically Secure Statistical Analysis

“…Some provide secure integer arithmetic [46,14,32,27,20,3,42], floating point arithmetic [17,26], shuffling and sorting [29] and linking [25], but, to our knowledge, only the Sharemind framework provides all the operations integrated into a single implementation [10,44,43,38,8].…”

“…Another recent implementation with similar goals is by El Emam et al [25]. They provide protocols for only linking and the computation of χ 2 tests, odds ratio and relative risk.…”

A Survey of Privacy-Preserving Techniques for Reuse of Distributed Health Data (Preprint)

“…This protocol is based on the naïve computation model in which each input party, in turn, encrypts the identifier values of all records of both input parties using its private key, and then, the encrypted identifiers are compared with each other. El Emam et al [79] also proposed a similar two-party protocol with the aid of a set of STTPs in which at the end of the record linkage each STTP learns the partial linkage result such that the number of matching records is hidden as long as the STTPs do not collude.…”

“…The protocols in [78][79][80] require the exchange of a long list of encrypted identifiers between the computing parties that incurs significant communication overhead when the number of records at each data custodian increases. In addition, the protocols require communication round that is quadratic with the number of data custodians.…”