RAPID: Collaborative: A Privacy Risk Assessment Framework for Person-Level Data Sharing During Pandemics

新冠肺炎大流行表明，共享数据对于建立更好的统计流行病学模型、(在公共和私营部门)做出政策决策以及确保公众健康至关重要。此外，情况发展迅速，表明数据共享需要反复和及时地进行。到目前为止，已进行的大部分数据共享侧重于汇总统计数据(例如，事件计数)，但一些最重要的数据是个人一级的，这对于直观了解共病如何影响健康结果并从时空角度模拟疾病的发展轨迹至关重要。这些数据被大量希望支持这些努力的服务提供商捕获，但他们担心这样做会侵犯相应个人的隐私权，特别是他们的匿名性。为了能够及时、有用和保护隐私地发布患者特定的新冠肺炎数据，该项目旨在开发和传播在工作软件中实施的新的隐私风险评估技术，以帮助数据经理和公共卫生官员分析隐私风险(根据现行法律，重点是重新识别)和公共数据效用之间的权衡。该项目将提供共享有关被诊断为或怀疑患有新冠肺炎的患者的特定数据所需的最佳实践和工具。该项目将开发新的、动态的隐私风险评估模型，通过考虑不断变化的隐私风险和数据效用来披露数据，以支持流行病学调查(特别是流行病)。为此，建议的模型将进行量身定制，以便通过对更丰富的数据属性空间进行建模，从而能够披露与地理、人口统计和临床相关的现象(例如，基于药品处方或购买的健康指征)，特别是对于对与生物制剂(如新冠肺炎)相关的流行病学风险因素进行建模的属性空间。为了模拟不断演变的隐私风险，将开发考虑多种类型的潜在重新识别攻击和用于发布同一数据的多个版本的数据密文的隐私风险估计模型。此外，拟议的模型将面向支持特定于生物监测工作的效用函数，包括已出现的用于新冠肺炎建模和响应的函数。最后，为了确保建议的方法可广泛访问和重复使用，将发布一个开源软件工具，使数据托管人员，特别是公共卫生当局能够在共享数据时适当地平衡公共卫生目标和个人隐私做出明智的决定。这一奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

The COVID-19 pandemic has demonstrated that sharing data is critical to building better statistical epidemiological models, enabling policy decisions (in the public and private sector), and assuring the health of the public. Moreover, the situation has evolved quickly, indicating that data sharing needs to take place repeatedly and in a timely manner. To date, much of the data sharing that has taken place has focused on aggregate statistics (e.g., counts of events), yet some of the most important data is at the person-level, which is critical to providing intuition into how comorbidities influence health outcomes and model the trajectory of the disease in a temporal-spatial perspective. This data is captured by a large number of service providers who wish to support these endeavors, but are concerned that doing so will infringe upon the privacy rights of the corresponding individuals, particularly their anonymity. To enable timely, useful and privacy-preserving releases of patient specific COVID-19 data, this project aims to develop and disseminate novel privacy-risk assessment techniques, implemented in working software, to assist data managers, as well as public health officials, to reason about the tradeoffs between privacy risks (with a focus on re-identification, according to current law) and public data utility. The project will provide the best practices and tools needed for sharing patient-specific data about individuals diagnosed with, or suspected of, COVID-19. This project will develop novel, and dynamic privacy risk assessment models for disclosing data in support of epidemiological investigations (and particularly pandemics) by considering evolving privacy risks and data utility. In doing so, the proposed models will be tailored to enable the disclosure of geographic-, demographic-, and clinically-relevant phenomena (e.g., health indications based on pharmaceutical prescriptions or purchases) by modeling a much richer data attribute space, specifically one that is important for modeling epidemiologic risk factors associated with biological agents, such as COVID-19. To model evolving privacy risks, privacy risk estimation models that consider multiple types of potential re-identification attacks and data redactions used to release multiple versions of the same data will be developed. Furthermore, the proposed models will be oriented to support utility functions that are specific to bio-surveillance efforts, including those which have emerged for COVID-19 modeling and response. Finally, to ensure that the proposed approach is accessible and reusable widely, an open source software tool, that enables data custodians, and particularly public health authorities, to make informed decisions appropriately balancing public health goals with personal privacy when sharing data, will be released.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.