A risk-based framework for biomedical data sharing

- A risk-aware information disclosure model for biomedical data is presented.
- The model evaluates the privacy risk posed by a data request.
- The calculated risk depends on circumstantial factors specific to the data sharing episode.
- The model imposes mitigation measures proportional to the estimated risk.

The problem of biomedical data sharing is a form of gambling; on one hand it incurs the risk of privacy violations and on the other it stands to profit from knowledge discovery. In general, the risk of granting data access to a user depends heavily upon the data requested, the purpose for the access, the user requesting the data (user motives) and the security of the user's environment. While traditional manual biomedical data sharing processes (based on institutional review boards) are lengthy and demanding, the automated ones (known as honest broker systems) disregard the individualities of different requests and offer “one-size-fits-all” solutions to all data requestors. In this manuscript, we propose a conceptual risk-aware data sharing system; the system brings the concept of risk, from all contextual information surrounding a data request, into the data disclosure decision module. The decision module, in turn, imposes mitigation measures to counter the calculated risk.

149