title: A standardised graphic method for describing data privacy frameworks in primary care research using a flexible zone model.
abstract: OBJECTIVE
  To develop a model describing core concepts and principles of data flow, data privacy and confidentiality, in a simple and flexible way, using concise process descriptions and a diagrammatic notation applied to research workflow processes. The model should help to generate robust data privacy frameworks for research done with patient data.
  
  
  METHODS
  Based on an exploration of EU legal requirements for data protection and privacy, data access policies, and existing privacy frameworks of research projects, basic concepts and common processes were extracted, described and incorporated into a model with a formal graphical representation and a standardised notation. The Unified Modelling Language (UML) notation was enriched by workflow and own symbols to enable the representation of extended data flow requirements, data privacy and data security requirements, privacy enhancing techniques (PET) and to allow privacy threat analysis for research scenarios.
  
  
  RESULTS
  Our model is built upon the concept of three privacy zones (Care Zone, Non-care Zone and Research Zone) containing databases, data transformation operators, such as data linkers and privacy filters. Using these model components, a risk gradient for moving data from a zone of high risk for patient identification to a zone of low risk can be described. The model was applied to the analysis of data flows in several general clinical research use cases and two research scenarios from the TRANSFoRm project (e.g., finding patients for clinical research and linkage of databases). The model was validated by representing research done with the NIVEL Primary Care Database in the Netherlands.
  
  
  CONCLUSIONS
  The model allows analysis of data privacy and confidentiality issues for research with patient data in a structured way and provides a framework to specify a privacy compliant data flow, to communicate privacy requirements and to identify weak points for an adequate implementation of data privacy.
authors.affiliation: Coordination Centre for Clinical Trials, Heinrich-Heine-University, Düsseldorf, Germany. Electronic address: wolfgang.kuchinke@uni-duesseldorf.de.
authors.forename: Wolfgang
authors.initials: W
authors.lastname: Kuchinke
authors.affiliation: Coordination Centre for Clinical Trials, Heinrich-Heine-University, Düsseldorf, Germany.
authors.forename: Christian
authors.initials: C
authors.lastname: Ohmann
authors.affiliation: NIVEL, Utrecht, The Netherlands.
authors.forename: Robert A
authors.initials: RA
authors.lastname: Verheij
authors.affiliation: MedLawConsult, Den Haag, The Netherlands.
authors.forename: Evert-Ben
authors.initials: EB
authors.lastname: van Veen
authors.affiliation: University of Warwick, Coventry, UK.
authors.forename: Theodoros N
authors.initials: TN
authors.lastname: Arvanitis
authors.affiliation: NIHR Biomedical Research Centre at Guy's and St. Thomas' NHS Foundation Trust and King's College London, London, UK.
authors.forename: Adel
authors.initials: A
authors.lastname: Taweel
authors.affiliation: NIHR Biomedical Research Centre at Guy's and St. Thomas' NHS Foundation Trust and King's College London, London, UK.
authors.forename: Brendan C
authors.initials: BC
authors.lastname: Delaney
mesh_terms: D035843:Biomedical Research; D016494:Computer Security; D003219:Confidentiality; D016208:Databases, Factual; D006291:Health Policy; D006801:Humans; D016347:Medical Records Systems, Computerized; D008962:Models, Theoretical; D009426:Netherlands; D005791:Patient Care; D011320:Primary Health Care / Q000592:standards*; D018907:Privacy / Q000331:legislation & jurisprudence*
keywords: Anonymisation; Confidentiality; Data linkage; Medical research; Privacy; Pseudonymisation; Zones