Protecting participants in documents written for disclosure

Publishing a trial's clinical documents puts the people who took part at risk of being identified from them. Anonymising the documents lowers that risk, either by redacting a finished report or by writing the report so that little has to be removed, and the risk that remains can be measured against a threshold. Signatures and document metadata carry personal data of their own.

How participants are re-identified

Re-identification, also called de-anonymisation, is the process of analysing data or combining them with other data so that individuals become identifiable. ¹ A re-identification attack is a deliberate attempt to determine the identity of one or more individuals in a publicly shared data set or database. ² Such data sets are anonymised, with no names, addresses or telephone numbers in them, yet technology experts can trace the data back to the patients they describe. ² The attacks appear to be carried out mainly by the media, in search of news, and by certain researchers. ² Clinical trial data have been lost through data theft, commercial espionage and human error, such as a misplaced CD or a lost folder, but the greatest threat now comes from cyber attacks, the re-identification attack on patient data among them. ³

In one case, a patient died of an adverse drug reaction recorded in a Health Canada database. ⁴ Using public information alone, the media matched newspaper reports against the age, location and date of death in the database, identified the patient and approached the family for interviews. ⁴

Letting data be used, for example to train artificial intelligence algorithms, carries risk: a 2019 study showed that data, once bought, can often be reverse-engineered with machine learning to re-identify individuals despite the anonymisation techniques applied to them. ⁵ It has been shown that AI-based tools easily reverse the de-identification of large datasets and can accurately trace individuals in anonymised databanks. ⁶

An identifier is information that can directly or indirectly identify a data subject. ⁷ Direct identifiers are data specific to one individual that permit direct recognition of or communication with them, such as a name, address, email address, telephone number or patient identification number. ^{8, 7} Quasi-identifiers, also called indirect identifiers, are background information that can identify a person indirectly: demographics, characteristics and attributes such as age, gender, ethnicity, geographic location and morphometrics, socio-economic information, and dates such as the birth date, the date of death and study visit dates. ^{8, 7} Abnormal laboratory values are also thought to enable re-identification, and so can the model and serial number of a medical device implanted in or used by a patient. ⁸ So the data collected in clinical trials can be used in a re-identification attack. ⁹

Public access to protocols and clinical study reports requires, above all, that individual participants cannot be identified from the published information. ¹⁰ Research on targeted treatments for genetically suitable populations will make this harder: patients with rare conditions enrolled in small numbers at a particular site may be relatively easy to identify from their data. ¹⁰ Disclosure of a person's pre-existing conditions could preclude their eligibility for health insurance in some countries, and trial data could potentially be used to influence reimbursement decisions in countries whose healthcare is free at the point of access, or to exclude entire populations from health insurance or state medical aid on the basis of genetic predisposition. ¹⁰

Anonymisation and pseudonymisation

Anonymisation is the process of rendering data into a form that does not identify individuals and in which identification is not likely to take place, its likelihood being very low. ^{11, 12, 13} Anonymisation is irreversible. ¹¹ Anonymisation techniques mitigate the risk of re-identifying individual data subjects, and their effectiveness is judged on three criteria: singling out, linkability and inference. ¹

Pseudonymisation replaces one attribute in a record, typically a unique one, by another. ¹ It reduces the linkability of a dataset with a person's original identity, but the person may still be identified indirectly. ¹ Pseudonymising subject identifiers preserves data utility, but pseudonymisation is not considered an anonymisation technique, because a subject can still be tracked through a report and their data across different data sets. ¹⁴

Anonymisation can be done reactively or proactively. ¹³ Retrospective, or reactive, anonymisation generally uses redaction or masking to anonymise text and data. ¹ Proactive anonymisation of a clinical study report uses anonymisation techniques to generate anonymised datasets and then another copy of the report from them. ¹ Where individual subject-level information has to be discussed in the text, the writer should consider proactively anonymised text and data presentations that maintain the data's meaning, remain in context and conform to current minimum standards for de-identifying data. ¹

What a disclosed report contains

A clinical study report gives extensive detail on the trial, including specific information about its participants. ¹⁵ That detailed account of the participants' experience creates potential privacy concerns, so the report has to be effectively anonymised before publication. ¹⁵

The summarised data in Section 14 of the report do not typically include individual patient data, with some exceptions: the listings of deaths and other serious and significant adverse events in Section 14.3.2, the narratives of deaths and other serious and certain other significant adverse events in Section 14.3.3, and the abnormal laboratory value listing in Section 14.3.4. ¹⁶ A working group of medical writers recommended in 2014 that the data listings in the disclosed sections conform to current standards for anonymisation, which continue to develop. ^{16, 17} It also recommended that narratives be moved to a non-disclosed appendix. ¹⁶

Why redaction after the fact falls short

Reactive anonymisation, also known as redaction, blacks out protected patient data in a finished document. ^{13, 18, 19} Case narratives in a clinical study report used to be written on the assumption that they would stay confidential, but under EMA Policy 0070 the personal data in them has to be redacted. ²⁰ The personal data is highlighted, the EMA is told what needs to be redacted, and redaction software removes it. ²⁰ Blacked-out passages of this kind appear in a report posted on the EMA's site, probably an older report written in the conventional way, before disclosure became a reality. ^{13, 18} One practitioner holds that writing a report that way and leaving the redaction for later, for other people to take care of, is not the way to go. ¹⁸

One practitioner, rating redaction against the risks it has to address, judges that it protects patient privacy. ^{19, 20} In that practitioner's rating it does not keep the document scientifically usable, because so much information is lost that the text is no longer easy to understand. ¹⁹ Nor, in that rating, does it avoid additional work and cost, because redacting a document afterwards is a lot of work. ¹⁹ The same practitioner holds that it does not comply with the GDPR's principle of privacy by design, because the text was not written with privacy in mind and was only corrected afterwards. ²¹ Redaction can lead to loss of information and even to misinformation. ²² Clinically relevant data that may matter in the context of the disease are lost in redaction, whereas age ranges used in place of ages, for example, still show whether a finding is confined to a particular age group, such as paediatric or geriatric subjects. ¹⁴

Policy 0070 states that a balance must be reached between an acceptably low risk of re-identification and high data utility. ²² One practitioner adds that protecting personal data is the priority, and that medical writers define that balance when they write their documents. ²² EMA guidance on preparing clinical data for public disclosure states that masking confidential or sensitive information by black-box redaction alone will "decrease clinical utility of the data compared to other techniques", and so it strongly encourages the move to other anonymisation techniques. ²³

Health Canada placed identical notices on submission packages from Lilly, Novartis, Seattle Genetics and Gilead stating that the extensive redactions to patient information in the clinical study report narratives do not conform to its guidance, which encourages other transformation methods. ²⁴ Writing in 2020, one disclosure specialist expected similar notices on future submissions without a change from retrospective redaction to the proactively anonymised authoring of narratives that CORE Reference encourages. ²⁴

Anonymising while drafting

In 2014 industry was debating a two-step process for preparing a report for disclosure: a submission-ready report, which may contain data that must be removed after submission, would be produced first, and the data then removed to produce the final disclosure-ready report. ¹⁶ A working group of medical writers proposed instead that a report be as disclosure-ready as possible from the outset, to safeguard against inadvertent identification of participants, to assure optimally timed public disclosure of the results, and to be as cost-efficient as possible. ¹⁶ Documents such as a clinical study report have to be disclosure-ready and disclosure-friendly when they are created, with minimal need for time-consuming redaction. ²⁵ In 2020, while the EMA's clinical data publication was on hold, there was no indication whether public disclosure would apply retrospectively to documents once it resumed, and one disclosure specialist advised writers for that reason to keep writing their clinical documents in proactively anonymised fashion. ²⁶

Steps towards a disclosure-ready report must be taken early in the project lifecycle. ²⁷ Patient identification numbers must not include a centre identifier that could enable individuals to be identified, and sponsors should be prompted to consider fundamental study set-up issues during protocol design, because these lay the foundation for a disclosure-ready report. ²⁷

Techniques a writer applies

Proactive anonymisation means anonymising while writing. ²² Its techniques are listed in Policy 0070, and medical writers can apply some of them themselves, while others may need special software and support from data management specialists. ²²

• Remove unnecessary information. Patient initials, which some parts of the world still collect as clinical trial data, add no value to the data, and geographic information might be unnecessary too. Leaving such data out lowers the risk of re-identification without diminishing the utility of the data set. ²⁸
• Mask or band. An age is replaced by an age range. ^{28, 29}
• Generalise. A date of birth is replaced by an age or an age range, and a site's geographic location is raised to a larger area, from city to state or province and even to country, so that it is less easy to use for re-identification. ²⁹
• Handle outliers and low-frequency groups. Outliers are easy to re-identify, and removing subjects older than 89 years from the data set is highly recommended. Low-frequency groups, such as ethnic minorities or low-recruiting sites, are compared as a pooled or aggregated group rather than one by one with very low numbers. ³⁰

In one proactively anonymised passage about a genetic disease, gender is kept because it is very important there, while banding and masking are applied to other details; in other cases gender might need to be anonymised. ^{30, 31} In a proactively anonymised case narrative, the data stay in the text but can no longer easily be linked to the subject: an age range stands in place of the age, there are no geographic data and no calendar dates, and the gender can even be masked as "s/he". ^{21, 32} The aim is that, at the end, only the subject number needs to be redacted. ^{31, 32}

One practitioner, rating proactive anonymisation against the same risks as redaction, judges that it protects patient privacy, keeps the document clear, understandable and scientifically usable, and avoids additional work and cost, because the redaction left is minimal. ^{31, 33, 32} The same practitioner holds that it also complies with the GDPR's principle of privacy by design, because the writer writes the document with privacy in mind from the start. ³² Some call it a redaction-friendly way of medical writing. ³³

A data anonymisation plan

The study report team can reduce the anonymisation needed after submission by proactively reducing the use of unnecessary identifiers in the initial report drafts. ^{34, 35, 14} This requires a strong cross-functional strategy, a data anonymisation plan, created for the clinical documents from their initial stages. ^{34, 14} The plan involves the medical writer, the medical monitor, the clinical data manager, the biostatistician and the regulatory affairs representative, and the team is led by a medical writer with solid knowledge of EMA Policies 0043 and 0070 and their implications for data protection. ^{35, 14} The plan focuses on the balance between scientific value and the risk of re-identification, especially for studies of small populations and of rare diseases. ^{34, 14}

A data anonymisation plan may use several strategies to reduce the risk of re-identification while maintaining data utility: age ranges, pseudonymisation, avoiding subject identifiers in the body of the report, generalising from country to region, avoiding gender-related words, and presenting relative days, such as days since drug administration, rather than actual dates. ¹⁴

Patient narratives

Patient narratives are a critical area for applying Policy 0070's guidance: writers and editors of narratives need to remember the sensitivity of the patients' data and include only the amount of data needed. ³⁶ Under increased transparency requirements, such as those of the EU Clinical Trials Regulation, protected personal data need to be identified early as part of an overall disclosure strategy. ³⁷ For example, the data output is changed so that the text reads "a 40 to 50 year old person from Western Europe" instead of "47 year old female from France". ³⁷

Anonymised narratives can be produced retrospectively, by qualitative methods such as redaction, which bring challenges and affect data utility, or proactively, which needs modern solutions and enhanced skills to meet Policy 0070 requirements. ³⁸

A checklist for disclosure-ready documents

One medical writer's best practices for writing with a disclosure mindset avoid the following in participant information:

• pronouns in patient narratives, where "the patient" can be used instead
• investigator verbatims quoted in the text, which may include unique circumstances that could describe a patient
• patient IDs in images of tables; where patient IDs are required, tables with selectable text are used instead of images, or the table formatting is kept consistent across all images to ease redaction

³⁹

For study or sponsor staff information and other identifiers, they avoid:

• names of study staff with their organisational titles, using only their study role instead
• contact information such as fax, telephone or email, and CVs or certificates, whether in the document or added to an appendix
• personal identifiers, such as patient IDs, names or study administrators, in bookmarks
• treatment allocation and group information throughout the document

³⁹

Its final considerations are these:

• Limit duplication that requires duplicate redactions, such as a table of patient narrative information followed by text with some of the same information.
• In the sample case report form, use a clearly fake patient ID such as XXXX or 0000, not even 1234.
• Aim to keep page numbering consistent between the clinical study report and its PDF copy, to help remove out-of-scope information.
• Foreign-language pages are out of scope, so they may be kept in an appendix or removed.

³⁹

Building disclosure into templates

Even medical writers not directly involved in preparing documents for release need to be aware of the fate of the documents they write, and by adjusting the content and structure of clinical documents in anticipation of publication they can help the redaction process. ⁴⁰ They can reorganise and streamline company templates for clinical study reports, clinical study protocols and statistical analysis plans so that protected personal data and commercially confidential information are minimised upfront, limited to fewer places in a document and more easily identified for anonymisation and redaction. ⁴⁰ They can advise which content is necessary under the clinical study report and Common Technical Document guidelines, so as not to compromise the documents' primary purpose of supporting regulatory approval. ⁴⁰ They may also help prepare anonymised versions of documents once a company employs anonymisation methods other than redaction, and they are experts in targeting regulatory documents to various audiences, which now include the general public. ⁴⁰

Measuring the residual risk

Statistical anonymisation, also called quantitative or risk-based anonymisation, measures how identifiable the participants in a document bound for public disclosure remain, and changes the information to the degree required. ^{41, 42} Redaction, by contrast, is commonly seen as a fast and cost-effective rules-based approach that protects privacy, although its protection is not statistically derived. ⁴³

The EMA's external guidance on implementing Policy 0070 encourages applicants to use quantitative methods to measure the risk of re-identification and recommends a risk threshold of 0.09. ¹⁵ The risk depends on the indirectly identifying information in the documents, such as demographics and medical history, and the reports must be anonymised to reduce it below 0.09. ¹⁵ The EMA asks applicants to justify their alterations to the data and their choice of anonymisation techniques. ¹⁵ The 2018 update of that guidance further reinforced the preference for quantitative over qualitative measures of risk and for anonymisation over redaction. ¹⁵

How the risk is calculated

When documents are anonymised, it can be difficult to know which data identify someone. ⁴⁴ With 100 participants from the USA and only one from Ireland, protecting the participant from Ireland clearly requires redacting "Ireland", while "USA" can stay. ⁴⁴ But with 20 participants from Ireland of whom only five are female, adding identifiers such as race, age or ethnicity can quickly make an individual stand out as highly identifiable. ⁴⁴ So statisticians use quantitative risk to establish which rules to apply to identifiers such as age, gender, race and country, protecting patient privacy while maintaining data utility. ⁴⁴ It is generally thought good practice to group some values rather than redact all the information: participants from Ireland, England, Spain and France, each with few participants, can be reported as "Europe", which may make them less identifiable while keeping some geographic information, and numeric values such as age, height and weight can be grouped into bands. ⁴⁴

Statistical risk is measured on the quasi-identifiers: items of information of which two or three, if released, could lead to a person being re-identified. ⁴⁵ One measure is k-anonymity, the number of people who share the same characteristics. ⁴⁶ Three people from one country who share race, gender and ethnicity and are of similar height and weight give a one-in-three chance of guessing which person is which, a quantitative risk score of 0.33. ⁴⁶ The threshold of 0.09, one in eleven, means that each participant must share the same characteristics as at least ten other people in the population, rather than in the clinical trial, so that one participant who appears in a document looks like ten others. ^{46, 47}

The population is the total of participants used for sharing. ⁴⁶ Determining it is often the first part of calculating the risk. ⁴⁶ The larger the population, the more likely it is that patients share characteristics with other patients. ^{46, 48} Appropriate populations include:

• the document population, only the patients who appear in the shared document, which is hard to work with because shared documents often concentrate on a subset of the trial's patients, and in a very small population patients can be unique with just a few identifiers ⁴⁹
• the clinical trial population, all the patients in the trial on which the shared documents are based, which is larger because not all of them are discussed in the documents ⁴⁸
• the all similar sponsor trial population, the patients of all the sponsor's trials in the therapeutic area grouped together, which is larger still and reduces the risk of re-identification ⁵⁰
• the all similar trial population, which adds other sponsors' trials, and which is hard to use in practice because other sponsors' data are not normally available ⁵¹
• the therapeutic area population, everyone in a geographic area within a therapeutic area, such as all diabetics in the USA, usually the largest population considered, for which nobody holds the individual data but documented population estimator techniques exist ⁵²

Which population to choose often comes down to the sponsor's perception of what an attacker is likely to know, such as the name of the trial in which the person took part. ⁵²

Transforming the document to the threshold

Anonymisation in the statistical sense replaces the original text with re-synthesised values selected to bring each trial participant's re-identification risk below the 0.09 threshold, whereas redaction conceals the data under an opaque box and removes all their usefulness. ¹⁵ Pseudonymisation, generalisation and date shifting can be combined to transform a passage, and the altered information is not discernible, hiding in plain sight. ⁵³

When documents are anonymised for transparency, a key first step is detecting all the identifying variables associated with each trial participant, in order to measure identifiability. ⁵⁴ The process evaluates the context of disclosure to understand potential threats, considering all means reasonably likely to be used to re-identify individuals, measures with generally accepted statistical techniques whether individuals can be identified, and transforms the data to the degree necessary to make them non-identifying. ⁵⁴ Directly identifying information, such as subject IDs, names, addresses and email addresses, is removed or pseudonymised. ⁵⁴ Indirectly identifying information, such as demographics, medical histories, event dates, diagnoses and treatments, is preserved as far as possible without compromising privacy, using generalisation, randomisation, date shifting and targeted suppression. ⁵⁴ The same methods support discretionary data sharing for secondary research and internal reuse of the data, from which organisations can gain secondary benefits such as insights into the drug discovery process. ⁵⁴ The approach should take account of contextual factors such as security, privacy and contractual controls, and less controlled releases need more transformation of the data. ⁵⁴

With the shift to publishing complete clinical study reports, several manufacturers moved from basic redaction to statistical anonymisation. ⁵⁴ Regulatory timelines, particularly for historical study requests in Canada, have made the need for scalable, efficient anonymisation more apparent. ⁵⁴ In a commissioned re-identification attack, reported in 2020, on a clinical study anonymised with statistical methods under Policy 0070 guidance, more than 24 hours of effort per attempted match achieved only very low-confidence match scores. ⁵⁴ The result suggests that such anonymisation protects trial participants' privacy adequately. ⁵⁴

De-identifying personal health information

A sponsor that publishes clinical documents is responsible for ensuring that personal data that might identify individuals are not released. ⁵⁵ Preparing documents for public disclosure and preparing datasets for sharing use overlapping methods to manage the risk of re-identification, and regulatory medical writers can be involved in both. ⁵⁵

Khaled El Emam argues that the HIPAA Safe Harbor approach, on which much of the de-identification in regulatory public disclosure is based, "does not provide adequate protection", and he recommends the statistical, risk-based method instead. ⁵⁵ El Emam describes suppression, randomisation, and irreversible and reversible coding as the commonly used and recommended data masking techniques, and explains why constraining names, adding noise, character scrambling, character masking, truncation and encoding are generally not recommended. ⁵⁶ He suggests that generalisation, such as turning a date of birth into a five-year age interval, and suppression, such as removing a patient or a visit from a data set, "have the most acceptability". ⁵⁶ In 2024 there was still no single recommended method for de-identifying health information. ⁵⁶

Writers and statisticians

EMA's Technical Anonymisation Group is an expert group in data anonymisation that aims to help develop best practice for anonymising clinical reports under Policy 0070. ⁴⁴ In 2020 its members came from academia, industry, patients and healthcare professionals, and it included no medical writers, although medical writers were largely responsible for the decisions about anonymising text in clinical study reports and clinical summary documents. ⁴⁴ Writers then did this qualitatively, anonymising the text proactively while trying to maximise data utility, and statisticians were learning quantitative ways to protect privacy. ⁴⁴ One writer expected in 2020 that statisticians applying structured statistical methods to clinical trial datasets before writers report the data would eventually lessen writers' burden, leaving less proactive anonymisation and less redaction to do in the reports. ⁵²

Medical writers do not need a full understanding of the statistical concepts behind data anonymisation, but a working knowledge of them is useful. ⁵⁵ Writers working as subject matter experts in transparency and disclosure are helped by knowing how loss of data utility can be mitigated and risk assessed, with the limits of each approach, and by grasping the approaches statistical colleagues use when a quantitative anonymisation strategy is applied. ^{55, 56}

Signatures and document metadata

Moving from wet ink to an electronic signature such as DocuSign brings a date and an IP address into the document, and both have to be redacted. ^{57, 58} One experienced writer knows of no alternative, since DocuSign and Adobe Sign are the same kind of electronic signature. ⁵⁸ That writer doubts that the signatures can be done away with, believing that ICH E3 still calls for the sponsor's signatory and, in Europe, the coordinating investigators to sign the report. ⁵⁸

One writer finds an electronic signature easier to redact than a wet-ink one, which usually comes as a scanned signature page. ⁵⁹ To comply with good clinical practice, though, an electronic signature needs a validated electronic process, and one team found that this process locks the document completely. ⁵⁹ The document then has to be scanned or redone, which has implications for publishing, and its signatures still have to be redacted. ⁵⁹ The problem is not confined to the clinical study report: the statistical analysis plan, the protocol and any other document that needs signing carry it too. ⁶⁰

Many large pharmaceutical companies have a document system such as Veeva Vault, but some smaller companies, CROs and biotech companies may not. ^{60, 61} Veeva adds an extra page at the end of a signed document, recording who signed it and when. ⁶² In one published package, the front of the document states that it has been electronically signed in Veeva, with the details on the last page, and one writer imagines the publishing group can simply remove that page, leaving a very clean front page. ^{62, 63} Whether Veeva leaves any identifier depends on how each company has customised it, and a customisation that documents the signature without showing it in the document may be a solution. ^{61, 62}

The protocol is expected to be posted publicly under Policy 0070, and only the names of investigators may be disclosed in it. ⁶⁴ Other names in the protocol may therefore need to be redacted, or the individuals concerned may need to sign a waiver to disclose their personal data. ⁶⁴ It might be advisable for the signatories to sign an alternative contract that is not part of the main document, an option ICH E6 provides. ⁶⁴

A PDF's document information shows, for example, who created the template and who wrote the report. ⁶⁵ In one writer's experience, removing such metadata is the electronic publishing group's job, and it should be part of that group's checking process when it prepares the document package. ⁶⁵