gms | German Medical Science

Introduction: Within the MIRACUM (Medical Informatics in Research and Care in University Medicine) consortium, data integration centers (DIC) will be established within the hospital IT-infrastructure of 10 university hospitals with the goal to make their data accessible for medical care and research [1]. The consortium develops a diagnosis support system for Rare Diseases (DISERDIS), which performs a similarity analysis on existing datasets of diagnosed patients in the DICs of the MIRACUM sites. The goal is to show the physician patients with similar clinical characteristics. This search result serves as an indication of possible diagnoses. The objective of this work is to present a concept for how patient data can be shared in the context of similarity analysis, while retaining the affected patients’ privacy.

Implementation: To keep patients identifiable while protecting their privacy, we use the open source pseudonymization service “Mainzelliste” [2], [3]. It assigns unique personal identifiers (PID) to identifying attributes (name, date of birth etc.) and ensures, by a record linkage algorithm, that always the same identifier is returned for one patient even if he is entered several times. For creating pseudonyms, Mainzelliste is able to manage an arbitrary number of pseudonym domains (called “ID types”) for permanent pseudonyms, to each of which a distinct ID generator (i.e. a configured algorithm to create pseudonym strings) is assigned. As requirements within DISERDIS, we defined the possibility to create, edit and delete patients and corresponding pseudonyms in Mainzelliste. In addition, it must also be possible to create temporary patient pseudonyms and pseudonym domains. Based on these requirements, we created a description of the extension of the existing system architecture.

When a patient record is created at a MIRACUM location, a permanent patient pseudonym is generated by Mainzelliste and stored together with his medical data. This pseudonym is reserved for internal use at the MIRACUM location. So, whenever patients need to be identifiable externally, a special export pseudonym is needed. This is the case when DISERDIS receives a request to find similar patients to a given case from another MIRACUM location. A similarity analysis is then performed on the local database, which retrieves all patients matching the search criteria. Before the search result (pseudonyms and medical data) is returned to the requesting site, every permanent pseudonym is replaced by an export pseudonym within a temporary pseudonym domain, which is created exclusively for the scope of this search. The temporary pseudonym allows to identify a patient in discussion and possible data exchange about the patient case between the involved MIRACUM sites without revealing identifying data or internal pseudonyms.

Conclusion: This paper shows the conception of the pseudonymization service Mainzelliste for the MIRACUM diagnosis support system DISERDIS. In the next step, the concrete implementation of this scenario is aimed. Furthermore, a consent management system must be established to use the patient data for similarity analysis.

The authors declare that they have no competing interests.

The authors declare that an ethics committee vote is not required.