An ontology to describe provenance of data anonymization workflows (i.e., data linkage) in high security research environments such as the Scottish Safe Haven. 2023-11-01 2023-11-01 Copyright 2023 University of Aberdeen The Safe Haven Provenance (SHP) Ontology shp https://w3id.org/shp# The SHP Ontology 0.2 A property linking Data Source Specification with a Variable Constraint related to one of the variables defined in this specification. constraint A property for linking data sources to corresponding data plans. data source A property linking Data Source Specification with the collection containing describtion of variables requested by a researcher. requested variables A property linking Entity Characteristic to the particular Dataset it describes. target dataset A property linking Entitiy Characteristic or Variable Constraint to a specific variable to indicate that characteristics or constriants described influence this variable. target feature Short name of source database abbreviation Number of cohort members successfully linked cohort members linked Number of cohort members not linked cohort members not linked Number of eligible cohort members with an incorrect or missing identifier as linkage variable cohort members with invalid linkage variable Total number of people in the cohort. This number was either determined by the analyst before the before the data linkage process or was provided by the researcher. cohort size Data linkage Plan: The cohort specification based on the researchers criteria to answer their research question. Dataset: How the Lead Analyst defined the cohort cohort specification Point of contact for questions about source database contact Web URL or folder path that point to the contextual information of the source data such as e.g. Metadata, variable definition, collection methods etc. contextual information link The individual responsible for the safe custody, transfer, storage of the data and database structure. data custodian A data type associated with some values described by Entity Characteristic or an expected type of values corresponding to specific Variable dataType Name of source database database name List of all datasets extracted and released into the project folder of the researcher extracted datasets List of variables extracted from the database to form the dataset extracted variables Assigned file name(s) representing the particular entity through the data workflow and provenance trace from data ingress to the release of data to the researcher in their project folder within the TRE. file name A hash value of a specific object (e.g., a dataset contained in a file). hash When was the last known update of the database, before it was used to generate the dataset for the research project last known update Variable used for linkage to source dataset linkage variable The maximum value found in the structure represented by the Entity Characteristic. For example, if an entitiy characteristic might represent a subset of numerical entries, dataes, strings in a dataset corresponding to a specific variable. A min value would represent the largest entry within such subset of entries. max value The minimum value found in the structure represented by the Entity Characteristic. For example, if an entitiy characteristic might represent a subset of numerical entries, dataes, strings in a dataset corresponding to a specific variable. A min value would represent the smallest entry within such subset of entries. min value Date of the most recent record in database. most recent record date A number of entries represented by the Entity Characteristic where the value is not null not null A percentage of non-null entries represented by the Entity Characteristic not null pct The date and time of the oldest record in the database oldest record date Project IDs are assigned to each project by the Research Coordinator. project id The results of a Data Check-activity that generated TRE Report-Enity. Currently it is recommended that is either has the values “passed” or “failed”. result of check Count of extracted records in a dataset. row count The smallest value present in a variable. smallest distinct number In DaSH, each dataset of a project gets its own unique Study ID assigned. The Study ID is used as a prefix (usually 4 digits) for the pseudo-ID. study id A number of unique CHI numbers. unique CHI count Database version version Analyst is responsible for the validation checks during extraction, pseudonymisation and/or linkage. Analyst A list of all individual people/items in the cohort. A cohort is often the people being studied, but could also be items such as scans or prescriptions. Cohort The cohort is either created by the Lead Analyst or based on the specification provided by the researcher or based on a cohort list provided by the researcher. Cohort Creation Group of activities that validates the data linkage process for the project and ensure all the necessary permission are in place for the researcher. Data Check The process of extracting data related to the Cohort from datasets according to the specific variables (fields) selected by researchers. Data Extraction The Data Linkage Plan specifies the data flow from data ingress to data egress in the DaSH environment, specifies the Cohort and specifies the datasets required for the research project. Data Linkage Plan Is a cohort-based subset of the Database(s) specific to a research project. Dataset Part of Data Specification File that describes the specific Database and corresponding Variables that shoudl be used during the Data Extraction Process. Data Source Specification In the Grampian Data Safe Haven, the data specification file details the specific databases and variables within the database that should be extracted for the project. Data Specification File Transfers between different servers in the DaSH environment. Data Transfer A database or data source from which datasets are derived. Database Replacing the dataset-specific pseudo-IDs with a common pseudo-ID across all of the project datasets that links together all datasets for a specific project. Dataset Linkage Linkage file maps the original identifiable ID (e.g. such as CHI) in the respective dataset to a project and dataset specific new UID. In other words, those UIDs are different for each dataset in a project. This is to prevent premature linkage of the data before is has been fully anonymised. Dataset Linkage ID Mapping The project-specific data released to a researcher in the trusted research environment for researcher analysis. This consists of datasets (i.e., flat-files of the extracted, pseudonymised and linked data), Data Linkage Plan, Data Specification file, and summary data that are provided to a researcher in their project folder. Dataset Release Aggregate results compiled by the researcher during their analysis of the released data in the Trusted Research Environment, are reviewed by TRE staff to ensure there are no risks of identifying individuals in the released data. Disclosure Check Report of the results of the disclosure checks, which indicates if the work of the Lead analyst has passed or failed the disclosure check. Disclosure Check Report A utility concept for referencing specific properties of an Entity. For example, if an entitiy represents a dataset, an EntityChracteristic can capture a collection of summary statistics such as min max values, etc. Entitiy Characteristic Datasets and Linkage dataset exported from SQL to flat-files FlatFileCreation Creating a unique identifier (UID) mapping table for each pseudonymised dataset, which maps the original identifier (non-pseudonymised) of the dataset to the new pseudonymised ID for that dataset. ID Linkage Lead Analyst is responsible for the whole cohort creation, data extraction, pseudonymisation and data linkage process of the project. Depending on the data safe haven, the analysts may or may not have the right to see and work on the non-anonymized data. Lead Analyst Once all datasets for the project have had pseudo-IDs applied and a linkage dataset created, the original IDs are removed from the UID mapping table (a dataset moves from Pre-Release to Release) Original ID Removal Project IDs are assigned to a project by the Research Coordinator. Project ID Assignment Techniques that replace, remove or transform information that identifies an individual (e.g. replacing date of birth with age, replacing postcode with a regional classification or demographic marker, replacing NHS number/CHI number with a pseudo-ID number). Pseudonymization A collection of variables requested by the researcher and included in the Data Specification File. Requested Variables In the Grampian Data Safe Haven, Research Coordinators facilitate the use of routinely collected health and population data for research. Research Coordinators also ensure all information governance and information security measures related to research projects, including reviewing project permissions, approved researcher access periods, appropriate training has been undertaken before and during access to the TRE. Research Coordinators support researchers from academic, NHS and industry to design, plan, gather permissions and conduct research involving health and administrative data. Research Coordinator A person who carries out academic, scientific or clinical research. Researchers who require a TRE (or SDE/Safe Haven), must have any research project approved by ethical permissions to undertake the research and require enhanced information governance and security training to become approved to access highly-sensitive data within the TRE. Researcher A collection of Variables that were selected during the extraction process and are contained within a particular dataset. Selected Variables Sensitive Variable Senior member of staff reviewed the validated datasets for data integrity and data pseudonymisation. Data signoff has more of an emphasis on validity of extraction, data validation process and aligns with research project ethical permissions. This is a key step prior to data transferring between different servers/environments (e.g. NHS data moving onto University servers, or data on University servers being released to a project folder for a researcher to access. Sign Off Give a summary statistic (e.g. mean, max, min etc) of a dataset regardless the data type (e.g. integer, string, character, Boolean etc.) Statistical Summary Update the ProjectID To StudyID Table with a new the ProjectID to StudyID pairs for use in linkage/anonymisation Study ID Assignment Has overall responsibilities and does the disclosure checks. They should have the right to access the non-anonymized data. Technical Lead Activities that happen in the data production within a trusted research environment. For the Grampian Data Safe Haven, this covers all activities in data production, such as Cohort Creation, Data Extraction, Pseudonymisation, Validation Check, etc. TRE Activity A research project in a trusted research environment (TRE); also known as a secure data environment (SDE) or a Safe Haven. In the Grampian Data Safe Haven (DaSH), projects receive specific ethical approvals for the use of unconsented health and population data for public benefit. TRE Project Documents that bare some form of importance and information required for the delivery of the TRE project. In the Grampian Data Safe Haven (DaSH), these are the project protocol, Data Linkage Plan (i.e., a visualisation of the data sources and data flow from the ingress of data to egress of data in the DaSH environment), and Data Specification File (i.e., variables required for the DaSH Project across datasets selected by researchers and used by data analysts to extract data for each project). TRE Project Document Reports related to validation checks, disclosure checks and sum checks TRE Report Unique Identifier mapping file, maps the corresponding UID in the different dataset in a project to each other. This allows the correct linkage later, once the dataset have been fully anonymised UID Mapping An activity that generates new version of an asset (e.g., document, dataset, etc.). Update heck of project activities and entities against project requirements and permissions. This involves one or more data Analysts who are involved in data validation checks after the Lead Analyst has built a cohort, extracted and pseudonymised data and/or linked the datasets for a research project. Validation checks concentrate on technical aspects,whether the coding is correct and that datasets match the Data Linkage Plan and Data Specification File. It generates a validation check report. Validation Check Report of the results of the validation checks, which indicates if the work of the Lead analyst has passed or failed the validation check. Validation Check Report A data item that captures a characteristic, number, or quantity that can be measured or counted. The data associated with the variable may be different (for example dates, ages, etc.). Variable A constraint (e.g., a date range) that can associated with a specific variable requested by the researcher. Variable Constraint