Search

Supplemental Table 1: Comparison of epidemiological risk factors in Barrett patients (n= 587) and population controls (n= 587) matched by gender and age

Endoscopic screening for Barrett's esophagus as the major precursor lesion for esophageal adenocarcinoma is mostly offered to patients with symptoms of gastroesophageal reflux disease (GERD). However, other epidemiologic risk factors might affect the development of Barrett's esophagus and esophageal adenocarcinoma. Therefore, efforts to improve the efficiency of screening to find the Barrett's esophagus population “at risk” compared with the normal population are needed. In a cross-sectional analysis, we compared 587 patients with Barrett's esophagus from the multicenter German BarrettNET registry to 1976 healthy subjects from the population-based German KORA cohort, with and without GERD symptoms. Data on demographic and lifestyle factors, including age, gender, smoking, alcohol consumption, body mass index, physical activity, and symptoms were collected in a standardized epidemiologic survey. Increased age, male gender, smoking, heavy alcohol consumption, low physical activity, low health status, and GERD symptoms were significantly associated with Barrett's esophagus. Surprisingly, among patients stratified for GERD symptoms, these associations did not change. Demographic, lifestyle, and clinical factors as well as GERD symptoms were associated with Barrett's esophagus development in Germany, suggesting that a combination of risk factors could be useful in developing individualized screening efforts for patients with Barrett's esophagus and GERD in Germany.

Background Heterozygous familial hypercholesterolemia (FH) represents the most frequent monogenic disorder with an estimated prevalence of 1:250 in the general population. Diagnosis during childhood enables early initiation of preventive measures, reducing the risk of severe consecutive atherosclerotic manifestations. Nevertheless, population-based screening programs for FH are scarce. Methods In the VRONI study, children aged 5–14 years in Bavaria are invited to participate in an FH screening program during regular pediatric visits. The screening is based on low-density lipoprotein cholesterol measurements from capillary blood. If exceeding 130 mg/dl (3.34 mmol/l), i.e. the expected 95th percentile in this age group, subsequent molecular genetic analysis for FH is performed. Children with FH pathogenic variants enter a registry and are treated by specialized pediatricians. Furthermore, qualified training centers offer FH-focused training courses to affected families. For first-degree relatives, reverse cascade screening is recommended to identify and treat affected family members. Results Implementation of VRONI required intensive prearrangements for addressing ethical, educational, data safety, legal and organizational aspects, which will be outlined in this article. Recruitment started in early 2021, within the first months, more than 380 pediatricians screened over 5200 children. Approximately 50 000 children are expected to be enrolled in the VRONI study until 2024. Conclusions VRONI aims to test the feasibility of a population-based screening for FH in children in Bavaria, intending to set the stage for a nationwide FH screening infrastructure. Furthermore, we aim to validate genetic variants of unclear significance, detect novel causative mutations and contribute to polygenic risk indices (DRKS00022140; August 2020).

Clinical and translational data warehouses are important infrastructure building blocks for modern data-driven approaches in medical research. These analytics-oriented databases have been designed to integrate heterogeneous biomedical datasets from different sources and to support use cases such as cohort selection and ad-hoc data analyses. However, the lack of clear definitions of source data and controlled data collection procedures often raises concerns about the quality of data provided in such environments and, consequently, about the evidence level of related findings. To address these problems, we present an architecture that helps to monitor data quality issues when importing data into warehousing solutions using ETL (Extraction, Transformation, Load) processes. Our approach provides software developers with an API (Application Programming Interface) for logging detailed and structured information about data quality issues encountered. This information can then be displayed in dynamic dashboards, the evolution of data quality can be monitored over time, and quality issues can be traced back to their source. Our architecture supports several well-known data quality dimensions, addressing conformance, completeness, and plausibility. We present an open-source implementation, which is compatible with common clinical and translational data warehousing platforms, such as i2b2 and tranSMART, and which can be used in conjunction with many ETL environments.

Overcoming the COVID-19 crisis requires new ideas and strategies. Rapid testing of a large number of subjects is essential to monitor, and delay, the spread of SARS-CoV-2 to mitigate the consequences of the pandemic. People not knowing that they are infected may not stay in quarantine and, thus, are a risk for infecting others. Unfortunately, the massive number of COVID-19 tests performed is challenging for both laboratories and the units that take the throat swab and have to communicate test results. Here, we present a secure tracking system (CTest) to report COVID-19 test results online as soon as they become available. The system can be integrated into the clinical workflow with very modest effort and avoids excessive load to telephone hotlines. With this open-source and browser-based online tracking system, we aim to minimize the time required to inform the tested person but also the test units, e.g. hospitals or the public healthcare system. Instead of personal calls, CTest updates the status of the test automatically when the test results are available. Test reports are published on a secured web-page enabling regular status checks also by patients not using smartphones with dedicated mobile apps which has some importance as smartphone usage diminishes with age.The source code, as well as further information to integrate CTest into the IT environment of other clinics or test-centres, are freely available from https://github.com/sysbio-bioinf/CTest under the Eclipse Public License v2.0 (EPL2).

Background Hospital staff are at high risk of infection during the coronavirus disease (COVID-19) pandemic. We analysed the exposure characteristics, efficacy of protective measures, and transmission dynamics in this hospital-wide prospective seroprevalence study. Methods and Findings Overall, 4554 individuals were tested for anti-severe acute respiratory syndrome coronavirus 2 (SARS-CoV-2) IgG antibodies using a chemiluminescent immunoassay. Individual risk factors, use of personal protective equipment (PPE), occupational exposure, previous SARS-CoV-2 infection, and symptoms were assessed using a questionnaire and correlated to anti-SARS-CoV-2 IgG antibody titres and PCR testing results. Odds ratios with corresponding exact 95% confidence intervals were used to evaluate associations between individual factors and seropositivity. Spatio-temporal trajectories of SARS-CoV-2-infected patients and staff mobility within the hospital were visualised to identify local hotspots of virus transmission. The overall seroprevalence of anti-SARS-CoV-2-IgG antibody was 2.4% [95% CI 1.9–2.9]. Patient-facing staff, including those working in COVID-19 areas, had a similar probability of being seropositive as non-patient-facing staff. Prior interaction with SARS-CoV-2-infected co-workers or private contacts and unprotected exposure to COVID-19 patients increased the probability of seropositivity. Loss of smell and taste had the highest positive predictive value for seropositivity. The rate of asymptomatic SARS-CoV-2 infections was 25.9%, and higher anti-SARS-CoV-2 IgG antibody titres were observed in symptomatic individuals. Spatio-temporal hotspots of SARS-CoV-2-positive staff and patients only showed partial overlap. Conclusions Patient-facing work in a healthcare facility during the SARS-CoV-2 pandemic may be safe if adequate PPE and hygiene measures are applied. The high numbers of asymptomatic SARS-CoV-2 infections that escaped detection by symptomatic testing underline the value of cross-sectional seroprevalence studies. Unprotected contact is a major risk factor for infection and argues for the rigorous implementation of hygiene measures.

Endoscopic screening for Barrett's esophagus as the major precursor lesion for esophageal adenocarcinoma is mostly offered to patients with symptoms of gastroesophageal reflux disease (GERD). However, other epidemiologic risk factors might affect the development of Barrett's esophagus and esophageal adenocarcinoma. Therefore, efforts to improve the efficiency of screening to find the Barrett's esophagus population “at risk” compared with the normal population are needed. In a cross-sectional analysis, we compared 587 patients with Barrett's esophagus from the multicenter German BarrettNET registry to 1976 healthy subjects from the population-based German KORA cohort, with and without GERD symptoms. Data on demographic and lifestyle factors, including age, gender, smoking, alcohol consumption, body mass index, physical activity, and symptoms were collected in a standardized epidemiologic survey. Increased age, male gender, smoking, heavy alcohol consumption, low physical activity, low health status, and GERD symptoms were significantly associated with Barrett's esophagus. Surprisingly, among patients stratified for GERD symptoms, these associations did not change. Demographic, lifestyle, and clinical factors as well as GERD symptoms were associated with Barrett's esophagus development in Germany, suggesting that a combination of risk factors could be useful in developing individualized screening efforts for patients with Barrett's esophagus and GERD in Germany.

SUMMARYRisk stratification in patients with Barrett's esophagus (BE) to prevent the development of esophageal adenocarcinoma (EAC) is an unsolved task. The incidence of EAC and BE is increasing and patients are still at unknown risk. BarrettNET is an ongoing multicenter prospective cohort study initiated to identify and validate molecular and clinical biomarkers that allow a more personalized surveillance strategy for patients with BE. For BarrettNET participants are recruited in 20 study centers throughout Germany, to be followed for progression to dysplasia (low-grade dysplasia or high-grade dysplasia) or EAC for >10 years. The study instruments comprise self-administered epidemiological information (containing data on demographics, lifestyle factors, and health), as well as biological specimens, i.e., blood-based samples, esophageal tissue biopsies, and feces and saliva samples. In follow-up visits according to the individual surveillance plan of the participants, sample collection is repeated. The standardized collection and processing of the specimen guarantee the highest sample quality. Via a mobile accessible database, the documentation of inclusion, epidemiological data, and pathological disease status are recorded subsequently. Currently the BarrettNET registry includes 560 participants (23.1% women and 76.9% men, aged 22–92 years) with a median follow-up of 951 days. Both the design and the size of BarrettNET offer the advantage of answering research questions regarding potential causes of disease progression from BE to EAC. Here all the integrated methods and materials of BarrettNET are presented and reviewed to introduce this valuable German registry.

The known challenge of underutilization of data and biological material from biorepositories as potential resources formedical research has been the focus of discussion for over a decade. Recently developed guidelines for improved data availability and reusability—entitled FAIR Principles (Findability, Accessibility, Interoperability, and Reusability)—are likely to address only parts of the problem. In this article,we argue that biologicalmaterial and data should be viewed as a unified resource. This approach would facilitate access to complete provenance information, which is a prerequisite for reproducibility and meaningful integration of the data. A unified view also allows for optimization of long-term storage strategies, as demonstrated in the case of biobanks.Wepropose an extension of the FAIR Principles to include the following additional components: (1) quality aspects related to research reproducibility and meaningful reuse of the data, (2) incentives to stimulate effective enrichment of data sets and biological material collections and its reuse on all levels, and (3) privacy-respecting approaches for working with the human material and data. These FAIR-Health principles should then be applied to both the biological material and data. We also propose the development of common guidelines for cloud architectures, due to the unprecedented growth of volume and breadth of medical data generation, as well as the associated need to process the data efficiently., peer-reviewed

The sharing of sensitive personal health data is an important aspect of biomedical research. Methods of data de-identification are often used in this process to trade the granularity of data off against privacy risks. However, traditional approaches, such as HIPAA safe harbor or $k$ -anonymization, often fail to provide data with sufficient quality. Alternatively, data can be de-identified only to a degree which still allows us to use it as required, e.g., to carry out specific analyses. Controlled environments, which restrict the ways recipients can interact with the data, can then be used to cope with residual risks. The contributions of this article are twofold. First, we present a method for implementing controlled data sharing environments and analyze its privacy properties. Second, we present a de-identification method which is specifically suited for sanitizing health data which is to be shared in such environments. Traditional de-identification methods control the uniqueness of records in a dataset. The basic idea of our approach is to reduce the probability that a record in a dataset has characteristics which are unique within the underlying population. As the characteristics of the population are typically not known, we have implemented a pragmatic solution in which properties of the population are modeled with statistical methods. We have further developed an accompanying process for evaluating and validating the degree of protection provided. The results of an extensive experimental evaluation show that our approach enables the safe sharing of high-quality data and that it is highly scalable.

Summary Background: Data sharing is a central aspect of modern biomedical research. It is accompanied by significant privacy concerns and often data needs to be protected from re-identification. With methods of de-identification datasets can be transformed in such a way that it becomes extremely difficult to link their records to identified individuals. The most important challenge in this process is to find an adequate balance between an increase in privacy and a decrease in data quality. Objectives: Accurately measuring the risk of re-identification in a specific data sharing scenario is an important aspect of data de-identification. Overestimation of risks will significantly deteriorate data quality, while underestimation will leave data prone to attacks on privacy. Several models have been proposed for measuring risks, but there is a lack of generic methods for risk-based data de-identification. The aim of the work described in this article was to bridge this gap and to show how the quality of de-identified datasets can be improved by using risk models to tailor the process of de-identification to a concrete context. Methods: We implemented a generic de-identification process and several models for measuring re-identification risks into the ARX de-identification tool for biomedical data. By integrating the methods into an existing framework, we were able to automatically transform datasets in such a way that information loss is minimized while it is ensured that re-identification risks meet a user-defined threshold. We performed an extensive experimental evaluation to analyze the impact of using different risk models and assumptions about the goals and the background knowledge of an attacker on the quality of de-identified data. Results: The results of our experiments show that data quality can be improved significantly by using risk models for data de-identification. On a scale where 100 % represents the original input dataset and 0 % represents a dataset from which all information has been removed, the loss of information content could be reduced by up to 10 % when protecting datasets against strong adversaries and by up to 24 % when protecting datasets against weaker adversaries. Conclusions: The methods studied in this article are well suited for protecting sensitive biomedical data and our implementation is available as open-source software. Our results can be used by data custodians to increase the information content of de-identified data by tailoring the process to a specific data sharing scenario. Improving data quality is important for fostering the adoption of de-identification methods in biomedical research.

This article gives an overview of informatics challenges arising in the context of translational medical research. This research concept, which has developed during the last years, aims at transferring scientific knowledge from foundational (“bench”) to clinical research and further to clinical and medical practice (“bedside”). The reverse direction is also important: clinical data are needed for feedback and as stimuli for the generation of research hypotheses. To achieve this, collaboration is needed between separate domains with differing “cultures”, regulations and IT requirements. From the informatics perspective, novel and unique questions arise. While the scientific areas involved, biochemistry, molecular biology, medicine, statistics, epidemiology, and others, have been using informatics methods for many years, their concepts differ and communication is restricted. We will summarize the challenges in this rapidly evolving domain and present recent developments, focusing on integration architectures and concepts, on security and privacy, and on software engineering.

Display Omitted We study a frequently recommended transformation model for health data anonymization.We prove that common assumptions about privacy models do not hold in this context.As a consequence, existing approaches provide only sub-optimal data quality.We show that a simple alternative method is inefficient in terms of execution times.We propose a novel approach to overcome these limitations. ObjectiveWith the ARX data anonymization tool structured biomedical data can be de-identified using syntactic privacy models, such as k-anonymity. Data is transformed with two methods: (a) generalization of attribute values, followed by (b) suppression of data records. The former method results in data that is well suited for analyses by epidemiologists, while the latter method significantly reduces loss of information. Our tool uses an optimal anonymization algorithm that maximizes output utility according to a given measure. To achieve scalability, existing optimal anonymization algorithms exclude parts of the search space by predicting the outcome of data transformations regarding privacy and utility without explicitly applying them to the input dataset. These optimizations cannot be used if data is transformed with generalization and suppression. As optimal data utility and scalability are important for anonymizing biomedical data, we had to develop a novel method. MethodsIn this article, we first confirm experimentally that combining generalization with suppression significantly increases data utility. Next, we proof that, within this coding model, the outcome of data transformations regarding privacy and utility cannot be predicted. As a consequence, existing algorithms fail to deliver optimal data utility. We confirm this finding experimentally. The limitation of previous work can be overcome at the cost of increased computational complexity. However, scalability is important for anonymizing data with user feedback. Consequently, we identify properties of datasets that may be predicted in our context and propose a novel and efficient algorithm. Finally, we evaluate our solution with multiple datasets and privacy models. ResultsThis work presents the first thorough investigation of which properties of datasets can be predicted when data is anonymized with generalization and suppression. Our novel approach adopts existing optimization strategies to our context and combines different search methods. The experiments show that our method is able to efficiently solve a broad spectrum of anonymization problems. ConclusionOur work shows that implementing syntactic privacy models is challenging and that existing algorithms are not well suited for anonymizing data with transformation models which are more complex than generalization alone. As such models have been recommended for use in the biomedical domain, our results are of general relevance for de-identifying structured biomedical data.

Background Collaborative collection and sharing of data have become a core element of biomedical research. Typical applications are multi-site registries which collect sensitive person-related data prospectively, often together with biospecimens. To secure these sensitive data, national and international data protection laws and regulations demand the separation of identifying data from biomedical data and to introduce pseudonyms. Neither the formulation in laws and regulations nor existing pseudonymization concepts, however, are precise enough to directly provide an implementation guideline. We therefore describe core requirements as well as implementation options for registries and study databases with sensitive biomedical data. Methods We first analyze existing concepts and compile a set of fundamental requirements for pseudonymized data management. Then we derive a system architecture that fulfills these requirements. Next, we provide a comprehensive overview and a comparison of different technical options for an implementation. Finally, we develop a generic software solution for managing pseudonymized data and show its feasibility by describing how we have used it to realize two research networks. Results We have found that pseudonymization models are highly heterogeneous, already on a conceptual level. We have compiled a set of requirements from different pseudonymization schemes. We propose an architecture and present an overview of technical options. Based on a selection of technical elements, we suggest a generic solution. It supports the multi-site collection and management of biomedical data. Security measures are multi-tier pseudonymity and physical separation of data over independent backend servers. Integrated views are provided by a web-based user interface. Our approach has been successfully used to implement a national and an international rare disease network. Conclusions We were able to identify a set of core requirements out of several pseudonymization models. Considering various implementation options, we realized a generic solution which was implemented and deployed in research networks. Still, further conceptual work on pseudonymity is needed. Specifically, it remains unclear how exactly data is to be separated into distributed subsets. Moreover, a thorough risk and threat analysis is needed. Electronic supplementary material The online version of this article (doi:10.1186/s12911-015-0222-y) contains supplementary material, which is available to authorized users.

The sharing of sensitive personal data has become a core element of biomedical research. To protect privacy, a broad spectrum of techniques must be implemented, including data anonymization. In this article, we present ARX, an anonymization tool for structured data which supports a broad spectrum of methods for statistical disclosure control by providing (1) models for analyzing re-identification risks, (2) risk-based anonymization, (3) syntactic privacy criteria, such as k-anonymity, l-diversity, t-closeness and δ-presence, (4) methods for automated and manual evaluation of data utility, and (5) an intuitive coding model using generalization, suppression and microaggregation. ARX is highly scalable and allows for anonymizing datasets with several millions of records on commodity hardware. Moreover, it offers a comprehensive graphical user interface with wizards and visualizations that guide users through different aspects of the anonymization process. ARX is not just a toolbox, but a fully-fledged application, meaning that all implemented methods have been harmonized and integrated with each other. It is well understood that balancing privacy and data utility requires user feedback. To facilitate this interaction, ARX is highly configurable and provides various methods for exploring the solution space.

Collaboration and data sharing have become core elements of biomedical research. At the same time, there is a growing understanding of privacy threats related to data sharing, especially when sensitive data from distributed sources become available for linkage. Statistical disclosure control comprises well-known data anonymization techniques that allow the protection of data by introducing fuzziness. To protect datasets from different types of threats, different privacy criteria are commonly implemented. Data anonymization is an important measure, but it is computationally complex, and it can significantly reduce the expressiveness of data. To attenuate these problems, a number of algorithms has been proposed, which aim at increasing data quality or improving efficiency. Previous evaluations of such algorithms lack a systematic approach, as they focus on specific algorithms, specific privacy criteria, and specific runtime environments. Therefore, it is difficult for decision makers to decide which algorithm is best suited for their requirements. As a first step towards a comprehensive and systematic evaluation of anonymity algorithms, we report on our ongoing efforts for providing an open source benchmark. In this contribution, we focus on optimal algorithms utilizing global recoding with full-domain generalization. We present a systematic evaluation of domain-specific algorithms and generic search methods for a broad set of privacy criteria, including k-anonymity, l-diversity, t-closeness and d-presence, and their use in multiple real-world datasets. Our results show that there is no single solution fitting all needs, and that generic search methods can outperform highly specialized algorithms.

Sensitive biomedical data is often collected from distributed sources, involving different information systems and different organizational units. Local autonomy and legal reasons lead to the need of privacy preserving integration concepts. In this article, we focus on anonymization, which plays an important role for the re-use of clinical data and for the sharing of research data. We present a flexible solution for anonymizing distributed data in the semi-honest model. Prior to the anonymization procedure, an encrypted global view of the dataset is constructed by means of a secure multi-party computing (SMC) protocol. This global representation can then be anonymized. Our approach is not limited to specific anonymization algorithms but provides pre- and postprocessing for a broad spectrum of algorithms and many privacy criteria. We present an extensive analytical and experimental evaluation and discuss which types of methods and criteria are supported. Our prototype demonstrates the approach by implementing k-anonymity, ℓ-diversity, t-closeness and δ-presence with a globally optimal de-identification method in horizontally and vertically distributed setups. The experiments show that our method provides highly competitive performance and offers a practical and flexible solution for anonymizing distributed biomedical datasets.

K-anonymization is an important technique for the de-identification of sensitive datasets. In this paper, we briefly describe an implementation framework which has been carefully engineered to meet the needs of an important class of k-anonymity algorithms. We have implemented and evaluated two major well-known algorithms within this framework and show that it allows for highly efficient implementations. Regarding their runtime behaviour, we were able to closely reproduce the results from previous publications but also found some algorithmic limitations. Furthermore, we propose a new algorithm that achieves very good performance by implementing a novel strategy and exploiting different aspects of our implementation framework. In contrast to the current state-of-the-art, our algorithm offers algorithmic stability, with execution time being independent of the actual representation of the input data. Experiments with different real-world datasets show that our solution clearly outperforms the previous algorithms.

The incorporation of sensor readings into RFID tags creates a significant potential for applications which require environment monitoring as well as asset management and tracking, such as blood storage and management, and on-board aircraft part maintenance. On one hand, the environment history is essential in evaluating health and integrity of objects to be protected, such as blood and aircraft part. On the other hand, the periodic sensing information stored in RFID enables identifying the events of displacing and removal of the objects. However, the benefits of integrating RFID with sensor data are achieved only when the authenticity and integrity of data written to and stored at RFID are ensured. In this paper, we present challenges on secure integration of sensor readings and RFID, and compare security solutions of data integrity and authenticity for resource-constrained RFID tags. For mutual authentication between RFID tags and sensors (or readers), the public key based approaches proves efficient and feasible. We further evaluate different public key based approaches in terms of storage and communication efficiency.

Distributed processing of RFID information enables new RFID applications where tags, readers and processing systems belong to different administrative domains and where multiple RFDD applications are realized using a common reader and processing infrastructure. A novel distributed RFID processing architecture supporting various future eEnabled airplane applications based on RFID technology is described. In a particularly challenging application environment, RFID readers are installed on-board airplanes and connected dynamically by wireless communication with various ground system at airports and during maintenance. The airplane RFDD reader infrastructure has to be dynamically integrated with different ground systems. The security requirements caused by this temporal integration within different administrative domains and corresponding solution approaches are described.

Bootstrapping refers to the process of creating state (typically security associations, configuration and authorization information) between two or more entities based on a trust relationship between a trusted third party and two or more entities. The term bootstrapping has been recently introduced to denote solutions to configuration problems, such as those present in Mobile IP. This paper describes a novel service authorization and bootstrapping architecture in order to distribute keying material, to perform authorization and to make configuration information available.