1. Grid Security/Edinburgh 5 th & 6 th December 2002 Confidentiality, Consent & Access Peter Singleton - Cambridge Health Informatics

2. CLEF CLinical e-Science Framework Supported by MRC Funding To capture broad medical information Render it safe/confidential and useful/ accessible for research community Develop exemplar approaches for confidentiality and security Bring together new technologies for managing complex data-sets and formats

3. CLEF Consortium University of Manchester CHIME/University College London University of Brighton University of Sheffield Cambridge University Health Started 1 st October 2002

4. Cambridge University Health Team Prof. Don Detmer Dennis Gillings Professor of Healthcare Management, Judge Institute, University of Cambridge Peter Singleton Senior Associate, Judge Institute/Cambridge Health Informatics

5. Past Related Work Detmer –Chair, Board of Regents, National Library of Medicine, NIH (1989-91) –Chair, National Cttee on Vital & Health Statistics, DHHS (1996-98) –Chair, IOM Cttee: The Computer-based Patient Record (1991 & 1997) –Review Information for Health UK Undersecretary for State, 2000 –IOM Committee Member, Crossing the Quality Chasm, 2002 Singleton –DoH: Gaining Patient Consent to Disclosure (2000) –DoH: Confidentiality Code of Practice (2002) –NHS LifeHouse: Confidentiality & Security paper (2002) –NHS IA – Security & Confidentiality in ERDIP Programme –N&Mid Hants – Confidentiality Policy –S. Staffs. HA – Public Awareness Campaign

6. RMH UCLH Clinical records Narrative record (letters, reports) Structured data Original EHR Data Pseudonymisation One-way key encrypt Patient information from Royal Marsden, UCLH and cancer network....is pseudonymised with one way key encryption....to derive a repository of patient information, with data held in original form.

7. RMH UCLH Clinical records Narrative record (letters, reports) Structured data Original EHR Data Pseudonymisation One-way key encrypt G R I D Derived encoded and generated text National Service Framework and minimum dataset Idealised domain ontology metadata Text encoding / Information Extraction template Generated feedback text The structure of the EHR will be informed by an idealised ontology of the domain (VUM), which in turn will be derived by examining the original data.....with data transfer via the GRID.. The original data will then be processed using information extraction technology (Sheffield).....and the extraction templates also informed by the ontology. A separate repository, derived from the first, will be constructed, comprising encoded and extracted data....and also text generated from the structured data (Brighton)...and the NSF for Cancer. archetypes

8. G R I D Queries E-scientist Clinical Trials Case-based NHS management for cancer W o r k b e n c h S e r v i c e s Generated bullet point summaries - for patients ? Trial recruitment Outcomes Protocol Choice An e-Science workbench will be constructed, with which researchers can query the derived repository.. Data will be transfered via the GRID....with controlled and audited access..for a variety of research tasks. Reports are generated for the benefit of patients. Access Control Audit Trail Decode the key Data managers ? Generated text & coding is fed back to the original sites....to help existing data managers. RMH UCLH Clinical records Narrative record (letters, reports) Structured data Original EHR Data Pseudonymisation One-way key encrypt G R I D Derived encoded and generated text National Service Framework and minimum dataset Idealised domain ontology metadata Text encoding / Information Extraction template Generated feedback text archetypes Encoded entries & Generated text

9. SAFETY Verify pseudonymisation Represent patient wishes on disclosure ? Governance Security issues will be addressed at key points....including verifying the pseudonymisation. G R I D Queries E-scientist Clinical Trials Case-based NHS management for cancer W o r k b e n c h S e r v i c e s Generated bullet point summaries - for patients ? Trial recruitment Outcomes Protocol Choice Access Control Audit Trail Decode the key Data managers ? RMH UCLH Clinical records Narrative record (letters, reports) Structured data Original EHR Data Pseudonymisation One-way key encrypt G R I D Derived encoded and generated text National Service Framework and minimum dataset Idealised domain ontology metadata Text encoding / Information Extraction template Generated feedback text archetypes Encoded entries & Generated text

10. De-identification computer Import into EHR Clinical coding of narratives Text generation from codes CLEF Anonymised Data Repository Ad hoc queries Detailed queries Record extracts Define classes of EPR data to be excluded, or to be marked as sensitive Identify patients for CLEF Strike-out Patient Name in narratives Extract relevant EPR data Ethics Committee approved Includes restricted data May drill down to individuals Only includes narratives if specifically approved Ethics Committee approved Includes restricted data May only access aggregate data May not drill down to individuals Recognised research or health care organisation Excludes restricted data May only access aggregate data May not drill down to individuals RMH EPR system Royal Marsden Hospital UCL Brighton, Manchester, Sheffield Research community Access control filter Audit trail CLEF Anonymised Data Repository Structured data only Advice on security and confidentiality issues Cambridge University Health Remove any remaining identifiers Create CLEF 'patient' ID Manually review all narratives Encrypt data Transfer securely to UCL Decrypt data Label sensitive data items as restricted Label narratives as very restricted [Mark up codes and generated text are not restricted, but original narratives remain very restricted