RAPID: Collaborative: A Privacy Risk Assessment Framework for Person-Level Data Sharing During Pandemics

2019冠状病毒病大流行表明，共享数据对于建立更好的流行病学统计模型、促进政策决策（公共和私营部门）以及确保公众健康至关重要。此外，情况发展迅速，表明需要反复和及时地进行数据共享。到目前为止，已经发生的大部分数据共享都集中在汇总统计数据上（例如，虽然这些数据是基于事件计数的，但一些最重要的数据是在个人层面上的，这对于提供关于合并症如何影响健康结果的直觉并从时空角度对疾病的轨迹进行建模至关重要。这些数据被大量希望支持这些努力的服务提供商捕获，但他们担心这样做会侵犯相应个人的隐私权，特别是他们的匿名权。为了能够及时、有用和保护隐私地发布患者特定的COVID-19数据，该项目旨在开发和传播新的隐私风险评估技术，并在工作软件中实施，以帮助数据管理人员以及公共卫生官员推理隐私风险（根据现行法律，重点是重新识别）和公共数据效用之间的权衡。该项目将提供共享有关确诊或疑似COVID-19患者的特定数据所需的最佳实践和工具。该项目将通过考虑不断变化的隐私风险和数据效用，开发新颖的动态隐私风险评估模型，用于披露支持流行病学调查（特别是大流行病）的数据。在这样做的过程中，所提出的模型将被定制，以能够披露地理、人口统计和临床相关的现象（例如，基于药物处方或购买的健康指标），通过对更丰富的数据属性空间进行建模，特别是对与生物制剂（如COVID-19）相关的流行病学风险因素建模非常重要的数据属性空间。为了模拟不断变化的隐私风险，将开发考虑多种类型的潜在重新识别攻击和用于发布多个版本相同数据的数据编辑的隐私风险估计模型。此外，拟议的模型将面向支持特定于生物监测工作的效用函数，包括为COVID-19建模和响应而出现的效用函数。最后，为了确保拟议的方法可以广泛使用和重复使用，一个开放源码软件工具，使数据保管人，特别是公共卫生当局能够在共享数据时作出明智的决定，适当平衡公共卫生目标和个人隐私，该奖项反映了NSF的法定使命，并通过使用基金会的智力价值进行评估，更广泛的影响审查标准。

The COVID-19 pandemic has demonstrated that sharing data is critical to building better statistical epidemiological models, enabling policy decisions (in the public and private sector), and assuring the health of the public. Moreover, the situation has evolved quickly, indicating that data sharing needs to take place repeatedly and in a timely manner. To date, much of the data sharing that has taken place has focused on aggregate statistics (e.g., counts of events), yet some of the most important data is at the person-level, which is critical to providing intuition into how comorbidities influence health outcomes and model the trajectory of the disease in a temporal-spatial perspective. This data is captured by a large number of service providers who wish to support these endeavors, but are concerned that doing so will infringe upon the privacy rights of the corresponding individuals, particularly their anonymity. To enable timely, useful and privacy-preserving releases of patient specific COVID-19 data, this project aims to develop and disseminate novel privacy-risk assessment techniques, implemented in working software, to assist data managers, as well as public health officials, to reason about the tradeoffs between privacy risks (with a focus on re-identification, according to current law) and public data utility. The project will provide the best practices and tools needed for sharing patient-specific data about individuals diagnosed with, or suspected of, COVID-19. This project will develop novel, and dynamic privacy risk assessment models for disclosing data in support of epidemiological investigations (and particularly pandemics) by considering evolving privacy risks and data utility. In doing so, the proposed models will be tailored to enable the disclosure of geographic-, demographic-, and clinically-relevant phenomena (e.g., health indications based on pharmaceutical prescriptions or purchases) by modeling a much richer data attribute space, specifically one that is important for modeling epidemiologic risk factors associated with biological agents, such as COVID-19. To model evolving privacy risks, privacy risk estimation models that consider multiple types of potential re-identification attacks and data redactions used to release multiple versions of the same data will be developed. Furthermore, the proposed models will be oriented to support utility functions that are specific to bio-surveillance efforts, including those which have emerged for COVID-19 modeling and response. Finally, to ensure that the proposed approach is accessible and reusable widely, an open source software tool, that enables data custodians, and particularly public health authorities, to make informed decisions appropriately balancing public health goals with personal privacy when sharing data, will be released.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.