Considerations for Social Networks and Health Data Sharing: An Overview

Abstract

The use of network analysis as a tool has increased exponentially as more clinical researchers see the benefits of network data for modeling of infectious disease transmission or translational activities in a variety of areas, including patient-caregiving teams, provider networks, patient-support networks, and adoption of health behaviors or treatments, to name a few. Yet, relational data such as network data carry a higher risk of deductive disclosure. Cases of reidentification have occurred and this is expected to become more common as computational ability increases. Recent data sharing policies aim to promote reproducibility, support replicability, and protect federal investment in the effort to collect these research data by making them available for secondary analyses. However, typical practices to protect individual-level clinical research data may not be sufficiently protective of participant privacy in the case of network data, nor in some cases do they permit secondary data analysis. When sharing data, researchers must balance security, accessibility, reproducibility, and adaptability (suitability for secondary analyses). Here, we provide background about applying network analysis to health and clinical research, describe the pros and cons of applying typical practices for sharing clinical data to network data, and provide recommendations for sharing network data.

INTRODUCTION

Over the last 40+ years, network analysis has established itself as a prominent data-intensive area of research.^1–3 Federal research investment in the field has grown dramatically: in 2022, the National Science Foundation (NSF) invested nearly 26 million dollars in 74 projects covering social, mathematical, statistical and related programs using network analysis. During this same period, the National Institutes of Health (NIH) invested over 93 million dollars in 209 projects (Figure 1). Similar investment trends can be seen at the Centers for Disease Control and Prevention (CDC) and US Department of Defense (DoD) [for security in particular, see the Future Directions of Network Science report⁴].

Figure 1.

illustrates grant funders ongoing interest and investment in projects that include network data and analysis.

Network analysis studies the relations between entities, often people, organizations, or political entities, and how those relations affect behaviors and outcomes.⁵ Relationships between people in a network often include but are not limited to social, sexual, familial, or economic ties.^6,7 For example, a common network study would proceed from data that asked students in schools to name their closest friends.^8–11 Network analysis has produced novel and significant insights in fields such as health sciences,^5,12–16 social and economic modeling,¹⁷ environmental modeling,^18,19 security studies,^20,21 and education²² among others. For example, patient networks influence disease contagion,²³ physician networks impact care quality and prescribing behavior,^24–27 and community healthcare networks shape care delivery,²⁸ which in turn impact health disparities,²⁹ health analytics, and precision medicine. Social networks shape markets (both hiring and performance)³⁰ and propel innovation (ideas and investments)³¹ as well as its diffusion.^32–35 Education and innovation hinge on cross-linked social networks of scientists,³⁶ teacher networks support school performance,³⁷ and student networks affect each other’s academic performance.^38–41 Network methods have also been central to major agenda-setting government reports, such as the U.S. Surgeon General’s 2023 advisory on the healing effects of social connection.⁴²

Effective January 25, 2023, NIH’s new Data Management and Sharing (DMS) policy emphasizes data sharing and requires a DMS plan for all submissions for funding,⁴³ as part of NIH’s increased focus on rigor and reproducibility. The DMS plan describes the scientific data generated from NIH funding, its management, and a plan for sharing the data with other researchers. As of December 2024, none of the sample DMS plans on NIH’s DMS page pertain to network data.⁴⁴

Yet, network data present uniquely problematic cases for sharing. By definition, network data is relational, with a correspondingly distinctive format consisting of an individual-level dataset describing each study member’s relevant characteristics and measures along with a relational dataset describing the connections between study population members. Egocentric networks describe relationships between a focal respondent (called the ego) and their named contacts (called alters), alter and relationship characteristics, and alter-alter relations,⁴⁵ representing the linkages within the ego’s immediate personal network (e.g., caregiving, social support, or needle-sharing networks, etc.). Sociocentric networks describe the relationships between all actors (called nodes) in a given context of interest (classroom, hospital, city, sexual network, etc.). In both types of network data, characteristics of the actors and their connections are typically collected, in addition to information describing the nature of the relationships.^46,47

Consequently, there is a high risk for deductive disclosure of confidential information with network data, as the relational information makes it easier to reidentify participants.^47,48 Deductive disclosure occurs whenever one can reidentify unique individuals based on attributes,⁴⁹ even if explicit identifiers are removed. In the case of network data, a banal set of attributes which may not be sufficient to identify any single individual become more distinguishing once the relations between individuals are known, such as household members, romantic partners, or co-workers, and this risk increases with each additional person and their relationship linked into the egocentric or sociocentric network. Re-identification of people in network datasets has been shown to be possible,⁴⁸ potentially revealing private attributes such as income, sexual identity, or drug use. Sociocentric network studies pose deductive disclosure risk because the analytic sample is a census of the relevant context, meaning that anyone with some knowledge of setting actors can use that knowledge to identify study members and then learn any confidential information included in the survey. Ego-network data has the advantage of sampling from populations (leading to inclusion ambiguity), but often includes clusters of close contacts with identifying attributes since each respondent provides detailed information about their alters and their connections. These uniquely elevated risks require enhanced data security when sharing network data.

The risk of deductive disclosure for relational data is compounded by another feature of network data – that subjects provide both their own data and data about the relationships (edges) elicited from them, often supplying information about people who may not have consented to their participation in the study, including various types of potentially identifying information such as names or initials. This proxy reporting process is a necessary feature of sociocentric and longitudinal egocentric data collection, where it is essential to be able to link or match individuals across participants or across time. As such, the typical individual-oriented consent procedures for collecting, storing, and sharing data must evolve to meet these unique cases.

As issues with re-identification of network members have largely occurred in computational and social science spaces, clinical scientists have yet to thoroughly grapple with it. However, this is now a pressing issue in light of NIH’s new data sharing policy, as more clinical researchers see the benefits of network data for translational activities in a variety of areas.

As a community of researchers, we have to balance potentially competing ethical duties. On one hand, it is imperative to protect the privacy of our research participants, who provide intimate information about private health, economic, and social behaviors. On the other hand, we have an obligation to scientific integrity and inquiry that is best served by open and transparent analytic practice.^50,51 This generally requires making data available to other researchers for independent inspection. As we describe in the next section, many traditional practices for protecting privacy while openly sharing research data cannot be directly applied to network data without compromising its utility or increasing the risk of privacy violations.

To address these challenges, we review common data sharing practices and their applicability when sharing network data and suggest that the best strategy for ethically sharing sensitive network data requires a multi-level access approach that leverages the utility-privacy tradeoff inherent in identifiability. At one extreme, we provide guidelines for minimal data sharing that allows simple analyses but hides much of the attribute data that poses re-identification risk. At the other extreme, full data can be shared, enhancing replicability and secondary data analysis but increasing risk of privacy loss for participants and the individuals about whom proxy data were provided. Several proposed techniques aim to balance privacy and data utility, though determining a standard practice is complicated by variation across networks.^52–55 Ideally, these techniques should balance security (protection of privacy), accessibility (openness to the other researchers), reproducibility (sharing to ensure good practices), and adaptability (a protection of the investment made to collect the data in such a way that secondary analyses can be conducted). However, balancing these four features can be complicated in practice.

APPLICABILITY OF DATA SHARING PRACTICES TO NETWORK DATA

The aforementioned NIH policy targets analytical replicability, yet the resulting practices also facilitate sharing data to address questions beyond their original purpose. Common practices to ensure safe clinical data sharing practices come with different implications when sharing network data.⁵⁶ The clinical data sharing practices we cover include aggregate reporting, partial reporting, reducing data sensitivity, perturbing the data or adding noise, or sharing via a repository. We describe these practices, provide examples, discuss the advantages and disadvantages of applying these strategies to network data, and provide actionable recommendations to balance security, accessibility, reproducibility, and adaptability (SARA) when sharing network data.

Aggregated Data

As with other data types, reporting aggregate network data – or summarized statistics about the network as a whole derived from information about relationships, or the individual nodes or alters – provides the highest level of security and accessibility. For networks, aggregated statistics often appear in research publications and provide an idea of the network’s structure (such as the number of nodes and edges, density, connectivity, composition, centralization, or the modularity of communities / groups).^45,57 These statistics may also summarize node-level attributes across the network, such as the proportion of nodes with specific characteristics or differences in network statistics by group characteristics of interest (e.g., gender, race).^58,59 Aggregated statistics are commonly used in standard regression models or in building network-based simulations.

While commonly used, aggregated network statistics share disadvantages with other types of aggregate reporting. Analyses are not reproducible, and the richness of the data is lost, reducing potential for adaptability.⁶⁰ This is particularly important in sociocentric datasets that consist of a single network, where analyses of individual nodes are often required to understand how the behavior or outcomes of those nodes are influenced by the broader network structure and a person’s position in it.⁵ Such analyses are typically not possible using aggregated sociocentric network data. Thus, using aggregated sociocentric data for novel research questions generally requires simulation of networks tuned to the set of network statistics provided.^61–64 Moreover, given the probabilistic nature of simulations, full replication of published research findings using node-level data may not be possible.

In contrast, egocentric network analysis allows researchers to access hundreds or thousands of independent networks.⁴⁵ Thus, aggregated network statistics are more commonly used to simplify statistical modeling because much of the useful information about the networks, especially network structure, is contained in the aggregate. Nonetheless, certain kinds of egocentric analyses, such as multilevel modeling of the behavior of alters within ego networks, are not feasible with aggregated data. In some cases, broader “global” structures in which the egocentric networks exist can be simulated from the available information.^65,66

Partial Reporting

Partial reporting, or depositing a dataset with some individuals omitted, is another technique often used to reduce the risk of identifying participants and provide a structure to promote accessibility. Partial reporting is one of the recommendations for sharing genetic or pathogen genomic sequences⁶⁷ [a 2014 Genomic Data Sharing Policy requires sharing of human and non-human genomic data generated from NIH funding via the appropriate genomic data repository⁶⁸]. The goal of partial reporting is to reduce the risk of deductive disclosure by leaving some of the potentially linked sample members out of the dataset. However, the suitability of this practice for network data is unclear because it may still be possible to identify egos and alters based on the combination of attributes among reported nodes in both egocentric and sociocentric networks. This is compounded for persons with rare nodal, relational, or dyad-level attributes.

While this strategy promotes high accessibility, it hinders the reproducibility and adaptability of network datasets where the strength is in identifying and measuring relationships between people. There is an inverse relationship between security and adaptability/reproducibility dependent on the amount of data reported; for network data in which the richness lies in the combination of attributes and relations, holding back enough data to enhance security may reduce adaptability or reproducibility. Reproducibility is particularly affected if overall network statistics or positions are skewed.

Partial reporting of network data can change the broader structure of sociocentric networks depending on which nodes or edges are kept out of the reported dataset (Figure 2). Removing nodes or edges which affect the degree distribution or motif distribution (dyad/triad census) affects reproducibility in sociocentric networks.^69–71 Furthermore, the possibility for partial reporting could selectively remove relational information, rather than “sampling” for deletion from the individuals; this difference in (multiple) units of analysis is one of the unique considerations to appropriately sharing network data.

Figure 2. Potential loss of relational information in partially reported data.

Panel a) represents a network with full reporting of nodes and edges. Panels b), c), and d) illustrate the same network with two nodes randomly omitted in partial reporting. One sees that the removal of select nodes can lead to different measures and interpretations of the same network, with negative consequences for reproducibility.

In egocentric networks, removing alters can change the structural (e.g., network size or density) or compositional (e.g., proportion women, mean tie strength) properties of networks, though this problem is minimized if the research adheres to proper procedures regarding randomization and number of alters dropped.⁷² Adaptability is impeded if the relationships between nodes or if the broad network structure is altered. Additionally, partial reporting may not fully promote security. The risk of deductive disclosure is not minimized in the case of ego networks retained in the reported dataset if few of the alters are probabilistically selected to be left out of the shared data. Leaving out a sample of complete egocentric networks also does not protect the privacy of the remaining reported egocentric networks since egos are typically sampled from a population and thus independent.

Reducing Data Sensitivity

Reducing data sensitivity involves adjusting coding schemas, such as removing dates or changing continuous variables like age to categorical ones. There are similar ways that data can be categorized or generalized in ways to reduce sensitivity that operates at the relational level (e.g., illicit affairs) without acting on individual-level data sensitivity. The goal is to create a dataset with limited sensitivity that can still be used for statistical analyses. Accessibility remains unaffected so long as data are made publicly available or shared by the initial principal investigator or primary data collector (hereafter “primary user” as this is the person likely to be responsible for decisions about data sharing). Depending on the analysis, this strategy may still enable reproducibility — but often only for questions that have already been addressed or that require levels of measurement anticipated by the primary user. Adaptability is then inhibited, especially if new analytic questions rely on continuous comparison between subjects or finely detailed measurements. This strategy may also obscure some of the salient features driving connections, for instance age differences between sexual partners in a network^73,74 or designating relations as kin vs. non-kin in an egocentric network.⁷⁵ From a security standpoint, identification of network members may still be possible with rare outcomes since the addition of relations between people adds a new dimension through which to identify cohort members. Reducing data sensitivity may minimize the precision of measurements linked to specific individuals, but providing a coded or limited dataset can still put network members at risk of re-identification, especially when there are rare nodal, relational, or dyad-level attributes which can still lead to re-identification (e.g., relations across age bands).

Data Perturbation

Data perturbation consists of adding “noise” to measurements in a dataset to reduce the risk of deductive disclosure. For network data, noise is added by changing a percentage of edges (relationships)⁷⁶ – for instance, moving a certain percentage of edges from one pair of nodes to another or within a partition⁷⁷ in ways that preserve estimates of network structure, thereby curtailing network re-identification and promoting security. As with reducing data sensitivity, accessibility depends on the willingness of primary users to make data publicly available.

In other fields which use relational data, such as geospatial analysis, introducing noise has been shown to be protective while adding little bias.⁷⁸ However, this approach may have negative consequences for network data depending on the extent of perturbation. Data perturbation can induce significant bias in network data specifically, although methods to improve network estimates after adding noise have been developed⁷⁹ and differential privacy approaches to balance privacy and utility can be applied at local or centralized levels.⁵² Relatedly, it can negatively affect reproducibility if path structures, motif distributions, or degree distributions change. This is evident with sociocentric data depending on the goal of analysis: changes to path structures can affect diffusion, especially at the levels needed to protect privacy, and changes to the motif or degree distribution can affect network description.⁸⁰ Perturbing egocentric data – particularly dropping/adding edges between alters or perturbing alter attributes – can also affect reproducibility, especially when modeling the network. Adaptability may still be high in both cases depending on the magnitudes and types of changes and whether overall network structure is impacted.

An alternative approach to preserve reproducibility and promote adaptability, permuting node attributes, can reduce this bias, though it risks hiding these attributes’ relationships to tie formation and other outcomes of interest. Moreover, data perturbation may still permit identification of nodes with rare attributes or relationships, or in a network with high population depending on the data access level. A perturbation method that increases security and supports accessibility and adaptability includes permuting some critical node-level attributes and applying an exponential random graph model to the permuted data to create a faux network based on the empirical data.^81,82 However, this method only reproduces past analyses insofar as the network generated resembles its empirical counterpart.

Data Sharing via Data Repositories

Specialized data repositories are adapted to distinct formats and sensitivity risks. Examples include the genomic data repositories (Gene Expression Omnibus (GEO),⁸³ Sequence Read Archive (SRA),⁸⁴ GenBank,⁸⁵ Los Alamos National Laboratory (LANL),⁸⁶ etc.) listed in the 2014 NIH Genomic Data Sharing Policy as well as a set of generalist or domain-specific NIH-supported scientific data repositories adhering to the FAIR (Findable, Accessible, Interoperable, and Reusable) principles.⁸⁷ However, many of these repositories maximize accessibility by significantly limiting personal identifiers and, consequently, limit adaptability for secondary research. Existing repositories for network data include the Stanford Large Network Dataset Collection (SNAP),⁸⁸ Network Data Repository,⁸⁹ Colorado Index of Complex Networks (ICON),⁹⁰ and IEEE DataPort.⁹¹ These repositories typically list important measures associated with each dataset to help users determine which one is appropriate for their needs. However, most network data sets in these repositories have limited personal information.

Some domain-specific repositories follow set processes to share fuller network data, opting to maximize reproducibility and adaptability. Commonly, prior to data deposit, the primary user can set criteria for who can request the data and how they can be used, as with the Inter-university Consortium for Political and Social Research (ICPSR).⁹² Institutional review board (IRB) approval is communicated to the repository owner and if the data requestors meet the requirements of the primary users then the data will be shared. Limitations of sharing full network data via a repository echo those for other types of data: it relies on the data requestor to protect the highly sensitive data shared. Full data sharing of many network data sets carries a significant security risk, and when repositories do prioritize security, accessibility becomes a function of whether there are processes in place to facilitate secure sharing.

Several network studies, including Add Health, share data in this manner through restricted-use contractual data sharing.⁹³ Such processes typically exist as formal agreements between the primary user and requestor, facilitated by the data requestor’s IRB to approve secondary analyses of the data, provided that a data requestor fits criteria set by the primary user. IRB approval is communicated to the primary user before the dataset is shared with the requestor. This process puts the onus of security on the stringency of the IRB and leverages trust in ethical practices to share and protect data for analysis. Data use agreements (DUAs) are generated and stored by the primary user. This process is frequently manual rather than automated and thus inefficient and difficult to scale, which can be burdensome and inadvertently limit accessibility.

Other limitations of online repositories have implications for accessibility and security even when users follow best practices. Online data repositories are frequently hosted within a specific institution; if the institution changes investments in a way that threatens the continuity of the repository then accessibility is affected while the primary users re-submit data to an alternative repository. Another limitation emerges from the potential for credential counterfeiting or user credential phishing; these potential security concerns are distinctive to online settings and should be appropriately considered.

Despite these limitations, full datasets hosted in repositories may be the best solution for network data. Many older datasets now exist electronically, can be shared easily with no restriction on number of copies, and could exist in perpetuity. Accordingly, online repositories may be the most effective path to sharing secure and versatile network data provided security can be assured. Furthermore, as computing power increases, and as relational social media data becomes more ubiquitous, re-identification of individuals in these data may be possible via methods that did not exist when the data were collected, forcing a duty to consider the future ramifications of present data sharing. Thoughtfulness and care are needed regarding collecting, storing, and sharing these data regardless of their ability to foster reproducibility and adaptability. Such repositories could achieve this by following the practices of repositories for other types of data,^94,95 including stringent DUAs, relying on the ethical practices to which we as a community of researchers are bound. DUAs in this vein include restrictions on use to what is specified in the agreement and by whom, restrictions on sharing, a time-limited period of data use, instructions for both storage and destruction of data upon close of the agreed-upon analyses, and a requirement of IRB oversight. Ideally, electronic repositories will utilize an automated DUA with an honest data broker to ease the burden and facilitate accessibility.

Effects of Data Sharing Practices by Network Type

Egocentric and sociocentric network data have distinct structure and analysis goals, leading to different considerations for sharing practices. Each practice varies in its ability to ensure the security, accessibility, reproducibility, and adaptability by network type. Figure 3 provides an overview of how these practices promote each of these qualities.

Figure 3.

Current data sharing practices and their efficacy in promoting Security, Accessibility, Reproducibility, and Adaptability for network data

Considerations and Recommendations Specific to Egocentric Data

As the most accessible option, aggregated data at the ego network level can be provided with minimal risk to security. This includes summary statistics for the structural and compositional characteristics of each ego network. However, a DUA is recommended for sharing alter-level data to ensure that these more sensitive data, which carry a possibility of deductive disclosure for a person who has not consented, are not identifiable. Strategies to protect alters’ confidentiality should always include removing any alter names, including first names or initials, and using only numeric identifiers to link alters across waves of data. Moreover, security can be further enhanced by either providing only aggregated information at the network level for alter demographics or reducing sensitivity by broadly categorizing or dichotomizing information (e.g., relationship as kin/non-kin, education as college/non-college). Exceptions to these alter-level data sharing guidelines arise when including egocentric network data collected in a small, knowable, or at-risk community could make individuals identifiable (e.g., drug use networks in a rural community);⁹⁶ in such cases, alter-level characteristics should not be provided regardless of a DUA.

Considerations and Recommendations Specific to Sociocentric Data

As with egocentric data, we recommend that sociocentric aggregated data and network statistics be made publicly available.⁹⁷ Restrictions are not needed unless the aggregated statistics are combined in such a way that a small or rare group could be identified.⁹⁸ Beyond DUA standards, one must consider both the identification issues alongside the potential uses of shared data. While individual-level protections are important, given the “complete” population nature of sociocentric network studies, the implications of these considerations must be addressed at both the collective and individual level. To this end, sociocentric network data sharing must address protections for the metadata about the study context, protections of nodal attribute and relational information, as well as appropriate uses at the analytic level. With the exception of individual attribute data (which in the case of sociocentric data is typically self-provided), each of these require network-specific considerations beyond the “standard” operating procedures.

CONCLUSION

Network data have unique features that do not adhere to typical conceptualizations of data privacy associated with traditional (non-relational) data, resulting in a significantly higher risk of deductive disclosure. Best practices at a minimum should include protocols to protect privacy (security), clear guidelines for data depositors and requestors (accessibility, reproducibility), an automated process to ease sharing (also accessibility), and provision of the data for robust secondary analyses (adaptability). Maximizing reproducibility and adaptability protects investments and promotes open science.⁹⁹ Balancing all four principles requires a clear pipeline for data depositors to share their data in the fullest form possible depending on sensitivity. As with other types of clinical or public health data, a data repository can have different protocols to deposit and share network data based on sensitivity. Sharing network data is crucial for transparency in science and maximizing federal research investments. To achieve these goals, sharing data in its full form while protecting security and sensitive information is essential. To that end, a centralized data repository designed specifically for network data would provide a focal point for searching and sharing network data, protecting the investment made to collect the data.