The Drugs for Neglected Diseases Initiative (DNDi), an international non-profit, discovers, develops, and delivers treatments to save lives and improve the health of people living with neglected diseases. The organization fosters collaboration between more than 200 partners in the public, private, academic, and philanthropic sectors to serve patients. DNDi is committed to transparency in sharing clinical trial data, while striving to preserve patients’ right to privacy according to the highest standards governing the use of personal health information.
Having partnered with Privacy Analytics to anonymize a single data set as a pilot, DNDi validated its confidence in Privacy Analytics’ methodology and expertise and then tasked them with anonymizing data from 18 historical clinical studies. This will allow the data to be shared with researchers, universities, and other organizations with a valid research interest.
The Challenge
Multiple small studies of neglected diseases
DNDi is a signatory to the World Health Organization’s (WHO) statement on public disclosure of results from clinical trials and believes that data sharing is critical to maximizing the value of research. Craig Tipple, DNDi’s medical director, said, “Proprietary interests stifle science. Data are siloed, hidden, or provided late. As a publicly funded organization, it is important to us that our data be used for the public good. By sharing data we can reduce research waste, improve transparency, and make sure that treatments are developed more quickly.”
Before making data from 18 clinical trials available to others via Vivli—a global, data-sharing platform—DNDi asked Privacy Analytics to anonymize the data so that the privacy of participants in the data would be protected. This task was particularly complex because some trials addressed diseases with small patient populations that were often concentrated geographically. In a small sample, it is easier to re-identify someone in the data set, making anonymization of that sample more difficult. Some indications were localized in specific villages in the developing world, and some studies had as few as 40 participants.
"I appreciated that Privacy Analytics was prepared to adapt. I didn’t hear ‘We can’t do that.’ Rather, I heard, ‘Let’s see what we can do.’”
Craig Tipple,
Medical Director at DNDi
Additionally, the data existed in several different formats, from well-structured data compliant with modern CDISC standards to more legacy or custom-format data without data dictionaries to help interpret its contents. DNDi also asked Privacy Analytics for help in determining which data sets —whether analysis data sets or full data sets—would be most useful to potential users once anonymized.
The Solution
A robust, risk-based anonymization process
Privacy Analytics grouped the 18 studies by indication—including studies addressing diseases such as hepatitis C, cryptococcal meningitis, river blindness, sleeping sickness, and leishmaniasis—and assigned them to designated teams consisting of a data analyst and quality control specialist. This allowed each team to become immersed in the nuances of data pertaining to a given disease area.
The first order of business was to assess which of the various data formats for each study should be anonymized and then shared. In general, Privacy Analytics selected the most inclusive data sets, knowing that they would hold the most analytical value. If all things were equal across formats, they recommended anonymizing the data prepared for analysis, rather than the raw data.
Privacy Analytics then performed an assessment of the risk of re-identification, study by study, and presented their recommendations on which variables needed to be suppressed for the risk to be under the industry-accepted threshold. Privacy Analytics discussed these decisions in detail with DNDi, as there were often options. For instance, would it be preferable in terms of data utility to keep patient weight or study country?
To the extent possible, Privacy Analytics recommended transformations that were aligned across studies to support cross-study comparisons. For example, if patient age needed to be generalized, they applied the same age ranges to each study. Privacy Analytics then performed the transformations, anonymizing each data set and thoroughly reviewing the resulting data to ensure quality.
The Results
Data utility without compromising patient privacy
Privacy Analytics completed the anonymization of all 18 studies within three months, a month less than originally planned, to accommodate DNDi’s strict timeline. Privacy Analytics then returned the files to DNDi so that they could be listed on the data-sharing platform. Potential users include research institutions, disease control programs, WHO, global health funders, and providers and patients. The data could form the basis of additional analysis, meta-analysis, and research which contributes to public health policy recommendations, financing and resource allocation decisions for further research.
DNDi is confident that it is complying with its mandate to share its data while protecting the privacy rights of trial participants. “This,” continued Tipple, “advances our mission of helping to develop affordable, life-saving medicines for neglected disease and populations, sets an example for others, and upholds our reputation for research integrity.”
In reflecting on DNDi’s working relationship with Privacy Analytics, Tipple used four powerful adjectives: painless, smooth, professional, and robust. “I appreciated that they were prepared to adapt,” he said. “I didn’t hear ‘We can’t do that.’ Rather, I heard, ‘Let’s see what we can do.’ I found the Privacy Analytics team very easy to work with. It was obvious that they had experience in the classic description of rare diseases, and that was useful when we were talking about neglected diseases. Their processes were always clear and they kept to the timelines and the budget. You can’t really ask for more.”
DNDi intends to continue the process for the remainder of its existing studies and looks forward to working with Privacy Analytics to complete that work.