A Protocol for the Secure Linking of Registries for HPV Surveillance

In order to monitor the effectiveness of HPV vaccination in Canada the linkage of multiple data registries may be required. These registries may not always be managed by the same organization and, furthermore, privacy legislation or practices may restrict any data linkages of records that can actually be done among registries. The objective of this study was to develop a secure protocol for linking data from different registries and to allow on-going monitoring of HPV vaccine effectiveness.A secure linking protocol, using commutative hash functions and secure multi-party computation techniques was developed. This protocol allows for the exact matching of records among registries and the computation of statistics on the linked data while meeting five practical requirements to ensure patient confidentiality and privacy. The statistics considered were: odds ratio and its confidence interval, chi-square test, and relative risk and its confidence interval. Additional statistics on contingency tables, such as other measures of association, can be added using the same principles presented. The computation time performance of this protocol was evaluated.The protocol has acceptable computation time and scales linearly with the size of the data set and the size of the contingency table. The worse case computation time for up to 100,000 patients returned by each query and a 16 cell contingency table is less than 4 hours for basic statistics, and the best case is under 3 hours.A computationally practical protocol for the secure linking of data from multiple registries has been demonstrated in the context of HPV vaccine initiative impact assessment. The basic protocol can be generalized to the surveillance of other conditions, diseases, or vaccination programs

Protecting Privacy while Addressing Identity Theft”, MCETECH 2005

Abstract-There are a variety of interests from different parties which must be balanced and accommodated with respect to privacy. Organizations which collect personal data have to comply with increasingly comprehensive privacy legislation. Consumers want protection against unrestricted B2B sharing of their sensitive data and look for ways to maintain some control over it. In the mean time, regulatory agencies hope to monitor sensitive data to protect public safety and prevent crime such as identity theft. We survey current legislation and policy initiatives and examine to what extent they are effective and in synch with technology initiatives. PIPEDA is the most relevant Canadian legislation. However, it does not adequately address the sharing of private information between businesses that cooperate in providing services to consumers, nor does it adequately addres