Separation of Personal Data in a Biobank Information System Thomas - - PowerPoint PPT Presentation

1

Separation of Personal Data in a Biobank Information System

Thomas H. Müller1, Reinhard Thasler2

1University of Munich, Germany 2Munich University Medical Centre, Germany

Foundation HTCR - Human Tissue & Cell Research

2

HTCR Biobanking in a Nutshell

l Goal: Make explanted tissue and

associated clinical data available for research and document use.

l Supervision: Independent

advisory board acts as patients' trustee and decides on research projects and sample allocation.

l Workflow: Implements need-to-

know principle in the processing

• f samples and of medical data.

l Data protection: Provide role-

based access control and physically separate databases for identification data (IDAT) and medical data (MDAT)

IDAT Webserver MDAT Webserver Webclient

3

Biobank Workflow

4

HTCR Web Application

l

Based on generic electronic data capture (EDC) tool „dbform“, developed for Linux/Apache/ PostgreSQL.

l

Separate instances for IDAT and MDAT.

l

Shared non-circulated permanent key x represents linkage. This key is arbitrary (we use UUIDs). The shared copy f(x) may be encrypted..

l

Data is merged on client display according to user prviileges.

l

Information content of data required in both DB's can be reduced in one.

key PID yob ... f(x) 2001 key name dob ... x

1.3.2001

IDAT-DB MDAT-DB

5

HTCR Web Application Screens 1

6

HTCR Web Application Screens 2

7

Some Technical Details

l Our proposed concept of a database link is very simple and

requires an acceptable amount of implementation effort.

l A link is essentially a 1-1 correspondence between records of

• ne table in one database to those of another table in another
• database. Both tables describe different properties of the same

real-world objects

l The link is directional, i.e., the first table is considered the

master.

l Only a few operations are required: create or search slave

• bject, start or transfer to slave session.

l A map of transparent attributes copied from master to slave may

be defined.

l The link may be set to expire after a certain time interval.

8

Summary & Outlook

l Separating identification data and medical data is a data

protection requirement, especially in a biobank, where many items stored for an extended period of time.

l In order to be effective, this requirement must be integrated into

the biobank workflow - need-to-know principle.

l In support of this requirement we have developed a conceptually

simple technique of linking separate databases in web-based information systems.

l The concept can be expanded to multiple databases, e.g. to

include results from research projects performed on the allocated samples.