Ensuring privacy in the study of pathogen genetics

Abstract

Rapid growth in the genetic sequencing of pathogens in recent years has led to the creation of large sequence databases. This aggregated sequence data can be very useful for tracking and predicting epidemics of infectious diseases. However, the balance between the potential public health benefit and the risk to personal privacy for individuals whose genetic data (personal or pathogen) are included in such work has been difficult to delineate, because neither the true benefit nor the actual risk to participants has been adequately defined. Existing approaches to minimise the risk of privacy loss to participants are based on de-identification of data by removal of a predefined set of identifiers. These approaches neither guarantee privacy nor protect the usefulness of the data. We propose a new approach to privacy protection that will quantify the risk to participants, while still maximising the usefulness of the data to researchers. This emerging standard in privacy protection and disclosure control, which is known as differential privacy, uses a process-driven rather than data-centred approach to protecting privacy.

Introduction

The rapid advances in medical technology in the past decade have substantially decreased the cost and effort necessary to obtain genetic information for health-care applications. Genome-wide association studies with array technology, and rapid sequencing of host and pathogen genomes, RNA expression profiles, and microbiomes with next-generation sequencing technology are now commonplace. Individual use of host (eg, BRCA screening and breast cancer risk) and viral (eg, drug-resistance testing for HIV treatment) genetic data to inform medical management is regarded as routine health-care practice in many resource-rich countries. Subsequent aggregation and sharing of such data for research purposes maximises its usefulness by allowing a broader scope for the scientific community to apply ideas and skills to datasets that could be difficult for one individual or one group of researchers to assemble.^1–4 However, the privacy risks associated with such datasets, as recently outlined in work by Gymrek and colleagues⁵ and in an accompanying commentary,⁶ could be higher than previously appreciated. The investigators⁵ used several publicly available host genetic databases to deduce the identity of individuals selected from the CEPH (Center for the Study of Human Polymorphisms, Paris, France) collection of reference families. Although such a risk was included in the consent process as only a remote possibility, this study showed that the privacy risks associated with so-called omics data are not yet fully defined.

With respect to infectious diseases, routine and next-generation technologies can provide rapid and fairly inexpensive identification and characterisation of a pathogen by analysis of its genome. This molecular characterisation of the pathogen can provide clues towards antimicrobial resistance and pathogenicity at the time of diagnosis, information that can greatly affect clinical decision making and outcomes. The compilation of such sequence data also offers substantial advances for the epidemiological tracking of these pathogens through the community and environment. These data are widely used in research to guide population-level intervention efforts (eg, influenza virus vaccine development⁷ and the monitoring of bacterial resistance patterns⁸).

Although inferences and predictions can be made on the basis of data from individual research programmes or public health institutions, in many regions several separate programmes are collecting these types of data. Application of these methods to comprehensively collected sequence data acquired in real time has the potential for immediate and substantial public health benefits. However, the optimum application of these large-scale analyses has not yet been defined, partly because their technological development has outpaced the studies needed to define optimum implementation strategies. Particularly, the balance between the public health benefit and personal privacy risk for individuals whose genetic data (personal or pathogen) are included in such work has been difficult to delineate, since neither the true benefit nor the actual risk to the participant has been adequately defined.

This absence of equipoise with respect to risk has been a major limitation of large-scale molecular epidemiological analyses of HIV and hepatitis C virus (HCV)—studies that are needed to characterise the public health potential of network analyses for these infections. Uncertainty specifically related to the potential loss of privacy and the potential for unintended HIV or HCV status disclosure of individuals who might have transmitted the pathogen, along with concerns related to sharing sequence data, has resulted in a stalled research agenda.^9,10 In this Personal View, we examine the issues surrounding privacy protection in the specific case of HIV molecular epidemiological studies and offer a general pathway by which some of these issues could be addressed.

Molecular epidemiology of HIV

HIV is an ideal candidate for molecular epidemiological analysis because, as a single-stranded RNA virus, its intrinsically high mutation rate gives rise to essentially unique viral genetic sequences in each infected individual.¹¹ Phylogenetic analyses of HIV sequences have been used extensively to identify the origins and early spread of the HIV epidemic,¹² to follow national trends of disease spread,^13,14 to assess characteristics of local epidemics,^15,16 and to identify historical outbreaks.¹⁷ Although previous analyses have been retrospective, more recently these data are being investigated as a powerful means to track the disease, to make predictions about the dynamics of spread,¹³ and to assess the effectiveness of interventions within populations.¹⁸

Should these methods prove viable, they could play an integral part in community-level public health prevention efforts by focusing prevention and intervention resources within subpopulations at the greatest risk of HIV transmission. Since the existing standard of care for people infected with HIV-1 in the USA involves sequencing of a portion of the pol gene at the time of diagnosis to determine if any baseline resistance to antiretroviral therapy is present,¹⁹ the data necessary to do such molecular analyses are often readily available.¹⁶ However, just as the uniqueness of each individual’s virus allows for detailed molecular epidemiology, this same distinctiveness could represent a personally identifying characteristic.⁹

Genetic information

The past decade has seen a large increase in the amount of biological data that are stored electronically, particularly genetic sequence information. Large public repositories of HIV-1 sequence data are maintained and accessible online to researchers worldwide.²⁰ Although technology has increased the ease with which these data can be generated and centralised, efforts to develop guidelines for their use that minimise privacy risks remain absent or inadequate.

The challenge of preserving privacy associated with analysis of genetic information was addressed by US policy makers in the Genetic Information Non-discrimination Act of 2008 (GINA),²¹ which was created to prevent discrimination based on genetic information. However, GINA’s focused language and the explosive growth in technology and science that has occurred since it was enacted have left it with a narrow purview. Particularly, GINA defines genetic information as information about an individual’s genetic tests, information about the genetic tests of the members of an individual’s family, and information about manifestations of disease or disorder in members of an individual’s family. GINA goes on to define genetic testing as “an analysis of human DNA, RNA, chromosomes, proteins, or metabolites that detects genotypes, mutations, or chromosomal changes”.

Salient to HIV molecular epidemiology, GINA does not address community-level genetic information or non-host genetic information. Community-level genetic information refers to information that can be inferred about an individual from known genetic patterns present in members of his or her community. The increasing mobility of individuals in high-income countries has led to substantial mixing of populations between communities separated by geography, unique demographic characteristics, racial or ethnic groupings, or exposure risks, but tight-knit and sometimes closed populations remain.^22,23 GINA also does not directly address non-host genetic information—ie, the genetic information of circulating pathogens and commensal organisms that live within an individual. However, these genetic data can be very host specific, such as the sequence of the circulating virus of an HIV-infected individual.

When this non-host genetic information is taken into account, community-level information can be even more powerful. The case study of HIV molecular epidemiology, wherein the science is outpacing regulation, shows this fact well. Routinely generated HIV viral sequence data (used to identify and characterise resistance to anti-retroviral therapy) provide great opportunities for both researchers (to study HIV epidemiology) and clinicians (to guide personal health-care decisions). However, more recently, these data are being used to elucidate putative HIV transmission clusters both locally^16,24–28 and worldwide.^14,29 Because of the nearly unique HIV sequence of each infected person, identification of sequences from two or more individuals that are more similar than would be expected by chance allows the inference of a putative transmission link. The associated privacy risk posed by inferences based on sampled individuals is mitigated by the possibility that one or more unsampled individuals could be present in between the sampled individuals along the transmission chain (ie, genetic linkage of two individuals does not prove direct transmission).¹⁴ Although directionality cannot be inferred without additional epidemiological information, new analytical techniques can allow for informed guesses on the basis of other types of data³⁰ or knowledge of within-host viral evolution.³¹ However, because of the criminal statutes regarding HIV transmission in 37 US states and numerous nations, including Canada, even the establishment of such putative linkages could have legal implications.^32,33

Putative transmissions paired with sociodemographic data might lead to the unintended identification of individuals or groups with unique characteristics (eg, risk behaviour, travel history, etc), with the potential result of increased social stigma from inferences about both HIV status and these characteristics (eg, injection drug use). However, the widespread availability of such sequence data contributes numerous benefits to the clinical and research communities. For example, applications of transmission network analyses could improve the efficiency of public health prevention interventions through identification of individuals or groups at high risk for transmitting virus and selected groups with increased rates of epidemic growth. Such network analyses could also make it easier to observe and understand disease trends.

The absence of available methods to both quantify and preserve privacy, while making use of genetic sequence data for clinical and public health benefit, remains a stumbling block for HIV molecular epidemiology research. The simple solution would be to extend the protections noted in GINA to the community level and non-host genetic information. However, this approach would result in severe curtailment of aggregations of sequence data, resulting in substantial limitations to the burgeoning potential of molecular epidemiology and loss of the potential public health benefit. Such an approach would also not necessarily protect individuals participating in research studies, since even the results of the analyses of research sequence datasets have the potential to provide identifying information.³⁴ Indeed, these fears are currently limiting cooperation between research groups, pharmaceutical companies, and public health institutions to further realise the potential of molecular epidemiological analyses.

Privacy

In the USA, the present expectation of privacy protection in research involving human participants is described in the Health Insurance Portability and Accountability Act of 1996 (HIPAA). According to the HIPAA Privacy Rule, data are de-identified (ie, privacy protected) if at least one of two criteria are met: an expert, using accepted methods, determines that the risk of associating individual data items with any individual (ie, re-identification) is “very small” (so-called expert determination); or all of the 18 predefined information items or characteristics present in the data are removed (the so-called Safe Harbor rule; panel). Because of the challenges of satisfying the expert determination method,³⁵ investigators of most studies opt to implement the Safe Harbor rule, requiring the removal of the 18 items deemed linkable to other data sources.

However, in the context of genetic information, the Safe Harbor rule might not be safe enough.^5,6 Additionally, data not contained within the HIPAA’s list of items might still be interpreted in the context of a larger dataset or population, allowing inferences to be drawn that could compromise personal privacy. For example, when a person is newly diagnosed with syphilis, contact tracing is routinely done by public health agencies to identify sexual partners of the infected index case. Although contacted partners are provided with no information about the source of their exposure risk, if they have had only one sexual contact they will know the identity of the infected individual without having been provided with individually identifiable health information related to that person. In this case the released information, syphilis risk, would pass the Safe Harbor privacy test since none of the HIPAA’s 18 identifiers were provided to the sexual contact of the index individual, but the process of release allowed the individual to make an inference from the released data.

The alternative to the Safe Harbor method, the expert determination method of privacy preservation, requires experts to establish a threshold below which the risk of a privacy breach is deemed safe. This assessment requires that the risks associated with re-identification are quantifiable; however, empirical testing of a dataset to establish a threshold for safety is problematic. The fact that one particular researcher is not able to re-establish linkage to the study participant does not mean that another will be similarly unable.^5,36–38 Therefore, a non-empirical quantification of risk is needed.

The issue of privacy is particularly germane to the aggregation and analysis of data needed for large-scale HIV molecular epidemiological studies. Knowledge of sociodemographic information related to each HIV sequence is necessary to inform the models that can be used to predict transmission patterns and assess the effects of interventions. However, even if this socio-demographic information is stripped of the 18 HIPAA identifiers, having this information might still allow reasonable inferences to be made about the identity of individuals in the study. Thus, for molecular epidemiological analyses to preserve privacy, the ability to quantify privacy risks in a meaningful way will be crucial, and will represent the basis for risk–benefit analysis essential for sound policy making.

Unfortunately, increased efforts to protect individual privacy will require existing privacy-related practices to change, since there are limits to how far existing technological safeguards can go.^39–41 For example, recent research suggests that quantifying the privacy properties of data (such as de-identified data as defined by HIPAA) is impossible.^42,43

Panel: Protected health information, as defined by the HIPAA Privacy Rule*.

• Name

• Geographical subdivision smaller than US state, apart from the first three digits of a zip code (provided that the geographical area defined by those digits includes more than 20 000 individuals)

• All dates related to an individual (apart from years), and age if 89 years or older (eg, date of birth, date of hospital admission, etc)

• Telephone number

• Fax number

• Email address

• Social security number

• Medical record number

• Health plan beneficiary number

• Any account numbers

• Any certificate or licence numbers

• Vehicle identifiers and serial numbers

• Device identifiers and serial numbers (eg, for medical devices)

• Web URLs

• IP address numbers

• Biometric identifiers

• Facial photographs

• Any other unique identifier, characteristic, or code

List of 18 identifiers of personal health information, as defined by the US Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule.

URL=uniform resource locator. IP=internet protocol.

Differential privacy

A new and different approach shifts the focus of privacy from being regarded as a property of the data, as reflected in the HIPAA de-identification standard, to account for the process by which information is disclosed independently of the data. The emerging standard in privacy protection and disclosure control, termed differential privacy,^42,43 is based on this approach.

A benefit of moving from data-centred privacy to process-driven privacy is that this approach provides previously missing non-empirical quantitation of privacy. Because this measurement is based on the process of data disclosure, the process can be modified to reduce the risk of privacy loss below an agreed upon threshold. For example, differential privacy guarantees protection of privacy below a chosen threshold of data release through controlled randomness that is introduced in the disclosure process. This threshold could then be used to provide a quantitatively defined guarantee of strong privacy to research participants, or to set a reasonable level of privacy for public health analyses of the data. For example, in the case of syphilis contact tracing, rather than only identifying the sexual contacts of the index case, a social group of more than ten individuals including the contact of interest could be identified and tested for syphilis, thus reducing the risk of disclosure to the index individual.

An example of a differentially private approach to analysis could be envisioned for HIV sequence data. For example, a local HIV sequence database might be queried to determine the sociodemographic characteristics of the individuals who make up an expanding HIV injection-drug-use transmission cluster. Suppose that this particular cluster included individuals of generally homogeneous geography and sociodemographic characteristics, as well as a few individuals with uniquely distinctive characteristics (eg, race, vocation, etc). Release of these HIPAA-compliant data could still result in the unintentional disclosure of some members of the transmission cluster. A differentially private release of these data could output slightly perturbed counts of these distinctive characteristics within the cluster, where the variance of the perturbation is determined by the level of privacy required.

In addition to not always protecting privacy, the application of the HIPAA Safe Harbor method has been criticised for rendering data useless, particularly for epidemiology, because of the removal of too much information.^44,45 A process-oriented approach to privacy would allow several groups to aggregate their data into secure data warehouses for the purposes of queries or analysis on the combined dataset, without releasing all of the data into a public domain or even to the contributing groups.^46,47 This approach would allow useful information to be realised from the full dataset, but would preserve privacy risks to study participants in a way that can be quantified and specified for individual analyses.

Conclusions

The intersection of disease and genetics is growing rapidly, whereas privacy guidelines and policies have not kept pace with the technological advances that continue to expose new challenges to personal health-information privacy. Present methods of privacy protection in human research studies limit data sharing between researchers and constrain research opportunities. In the particular case of HIV molecular epidemiology, the risks to patient privacy are, at best, poorly quantified, and the recognised potential for loss of privacy limits research that could offer more effective methods to reduce HIV transmission.

The incorporation and assessment of differential privacy methods into collaborative data analyses could provide formal, data-independent guarantees that limit privacy risk while simultaneously increasing the yield from disparate datasets. For HIV particularly, the adoption and further development by scientists and ethicists of modern formal definitions and methods of preserving privacy will enable rational policy development. Recognition and use of these privacy-preserving policies will pave the way for molecular epidemiology to maximally improve public health while providing strong protection of patient privacy.