Technical solution for data collection, data safety and data privacy legislation: experiences from the SWEET study

Abstract

Background

One of the most important tasks of the SWEET study is benchmarking the data collected. Information on the occurrence of the disease of diabetes, the treatment, and their outcomes in children from the different member states of European Union (EU) is crucial. How the collection of data is realized is essential, concerning both the technical issues and the results. The creation of SWEET Centers of Reference (CoR), all over Europe will be facilitated by the access to safe data collection, where legal aspects and privacy are ascertained.

Objective

To describe the rationale for- and the technical procedure in the data collection implementation, in the SWEET study.

Subjects

Selected data on all patients treated at SWEET CoR are collected.

Methods

The SWEET project data collection and management system, consists of modular components for data collection, online data interchange, and a database for statistical analysis.

Conclusion

The SWEET study and the organization of CoR aims for the goal of offering an updated, secure, and continuous evaluation of diabetes treatment regimens for all children with diabetes in Europe. To support this goal, an appropriate and secure data management system as described in this paper has been created.

Priority areas in public health programs within the European Union (EU) are the development of health information, recognition of strategies for the best treatment of severe diseases, and information exchange on these [1]. Support is given to disease knowledge projects relating to their occurrence, treatments, risk factors, risk reduction strategies, cost of illness, and social support, in terms of developing best practice recommendations.

One of the most important tasks of the SWEET project is benchmarking the essential collected data, despite major differences in social and economic, as well as cultural and educational levels across Europe, within and between the countries (Eurostat).

It is essential to describe how the collection of data on childhood diabetes is realized, concerning both the technical issues and the results. Information on the occurrence and the costs of the treatment for children in different Member States of EU is crucial. It is also important to elucidate the occurrence of age appropriate education- and training programs for healthcare professionals..

The creation of SWEET reference centers, centers of reference (CoR), all over Europe will be facilitated by the access to the data collected and processed, although there is a need for local accommodation.

By prospective, at least annual evaluation and open discussion of the individual centers owned computerized data, both within the local team as well as by comparing these data with other pediatric diabetes centers in Europe, the hypothesis is that the level of care and education will grow [2]. As a consequence, the outcome of the patients in terms of metabolic control and the degree of acute and long-term complications, should improve.

Appropriate, safe, and reliable data collection is the essential basis for the evaluation and comparison of data [3].

This paper will present the technical data collection procedure of the benchmarking process, between the current European Centers, the data safety system, as well as the legal privacy aspects [4]. We will also propose ways to improve the local outcome by using the registry and benchmarking possibilities, with the hope and expectation that many pediatric diabetes centers in Europe will accede, and make use of the opportunity to participate in the collaboration.

Methods

The SWEET project data collection and management system consists of modular components for data collection, online data interchange, and a database for statistical analysis (Fig. 1).

Figure 1. Dataflow.

Data collection and online data interchange

1. [dpv2]1 diamax2 – a local diabetes management system (electronic health record, EHR)
2. sweetconv3 – a conversion tool used for existing databases with EHRs

[dpv2] diamax (Fig. 2) is not only a professional documentation software but also a helpful management system for diabetes specialists, and was developed in cooperation with the German Diabetes Association (DDG) and International Society for Pediatric and Adolescent Diabetes (ISPAD). [dpv2] diamax is a module of the extensive healthcare platform dpv2. It facilitates a corporate administration of patient data for different disease patterns, e.g., ‘diabetes’, ‘cystic fibrosis’ or ‘diabetes during gravidity’ (including both gestational and pre-existing diabetes).

Figure 2. [DPV2] DIAMAX.

[dpv2] diamax, allows the documentation of all the relevant information for the diabetes sector respectively, and takes the data from the practice administration system and provides it usefully for internal quality management or for external benchmarking. In addition to detailed evaluation possibilities, the system also offers a flexible statistic tool, cohort comparison, graphical assessment possibilities, and is able to generate all kind of release documents such as doctor's letters, therapy plans, patient summaries or quick patient statuses. The dpv2 healthcare platform is implemented as a client–server application, and is therefore suitable for all kinds of networks. It allows usage within a local network, e.g., within a practice/hospital, within the framework of an institutional network through a wide area network (WAN) or via the internet. It is possible to upload the data to the SWEET central database, through a special interface.

In the cases, where pre-existing databases are in place and [dpv2] diamax is not utilized, participating centers can use the conversion tool sweetconv (Fig. 3) to upload their data to the central database.

Figure 3. SWEETCONV.

sweetconv therefore imports and utilizes data from existing data sources which needs to be either of an Excel, Access, or CSV4 format. sweetconv uses its own structured query language (SQL)5-database to store imported data. During the process of importing the data into its own database, sweetconv is able to do certain conversion tasks to make the data retrieved from the data source file compatible with the needs of the SWEET central database. These conversion tasks can be configured, and the configuration can be stored in import profiles, so that it has to be done only the first time it is used and can be reused for all the subsequent imports.

After doing an import, the sweetconv user is able to complete missing data or to add data which is not contained in the source file but which is necessary for participation in the SWEET project. Finally the data can be uploaded to the SWEET central database.

Database and statistical analysis

1. sweetonline – online data intermediary to collect quality of life data
2. sweetbase6 – site-level and aggregate data analysis, data archiving and retrieval.

Data privacy and security is an important issue [4]. sweetonline7 (Fig. 4) is built on the VisionTree Optimal Care™ (vtoc) platform and meets the highest research standards for human subject data, and is very sensitive to participant confidentiality and consent. Security is always a high priority not only to protect the data from hardware loss but also to ensure confidentiality.

Figure 4. SWEETONLINE patient portal.

Each SWEET Center is able to enter and upload data to the SWEET centralized database, via a secure 256-bit SSL8 encrypted internet connection using the vtoc platform. vtoc servers employ power-on and user passwords, virus protection, and battery backup systems in a statement on auditing standards-70 (SAS-70)9 compliant data center with restricted access to authorized maintenance through 24/7 biometric security measures. Servers are constantly monitored for break-in attempts or other illegal activity. Personal data storage is maintained with scrambled unique hash.

The vtoc is compliant with the EU privacy directive and all of its tenets, as outlined below:

1. Tenet 1-Notice: An individual has the right to know that the collection of personal data will exist. The personal data must be collected for specified, explicit, and legitimate purposes, and not further processed in a way incompatible with those purposes.
2. Tenet 2-Choice: An individual has the right to choose not to have the personal data collected.
3. Tenet 3-Use: An individual has the right to know how personal data will be used and to restrict its use. Personal data may only be used for ‘legitimate processing’ as described by directive details.
4. Tenet 4-Security: An individual has the right to know the extent to which the personal data will be protected. Organizations must implement appropriate technical and organizational measures to protect personal data. The measures must be appropriate to the risks represented by the processing and the nature of the data be protected.
5. Tenet 5-Correction: An individual has the right to challenge the accuracy of the data and to provide corrected information. Personal data collected and maintained by organizations should be up to date and reasonable steps must be taken to ensure that inaccurate or incomplete data is corrected.
6. Tenet 6-Enforcement: An individual has the right to see legal relief through appropriate channels to protect privacy rights.

To meet and maintain all six tenets of the EU privacy directive, as described above, vtoc is implementing and maintaining the Truste® third party security certificate, as well as meeting Title 21 code of federal regulations (CFR)10 Part 11 compliance standards, for de-identified research data management, which includes compliance with the European Annex. The sweetonline system maintains a user audit log, encrypted password management and provide a de-identified data import using secure hash algorithms and encryption.

SWEETBASE

SWEET centers can analyze their own data and access SWEET comparative benchmarking data from participating sites. The benchmarking report is based on the center profile. Therefore, the usefulness of the report for the local CoR depends on how well the data was collected and reported.

Synthesis

A patient's record must be first created, in an electronic format. This may be performed with the [dpv2] diamax system, as described above, any electronic health record (EHR) system or electronic data format such as Excel, Access, or CSV file. A common data set and taxonomy based on the basic information sheet (BIS) for children and adolescents, the World Health Organization Implementation of the St. Vincent Declaration, for pediatric and adolescent diabetes data elements is collected, and stored at the local center level. Data from the BIS may be exported to sweetonline using either the [dpv2] diamax system or the sweetconv data conversion tool. sweetconv, maps core data elements from disparate electronic data formats to sweetonline for secure, de-identified data transport, and reporting.

Patient level data is de-identified on the local level in the [dpv2] diamax system or sweetconv tool, and sent to sweetonline via extensible markup language (XML) file using secure transmission channels. sweetonline receives the data through a secure data transport layer, using hypertext transfer protocol secured (HTTPS) encryption.11 Furthermore, the sweetonline system encrypts user passwords and maintains an audit log of all transactions including user login date, time, page viewed, and action taken. During the import process to sweetonline a de-identified patient record is created with an instance of the BIS. At this time, patient credentials to login to a secure, online patient portal are also created.

With consent management on the local level and by returning the created user credentials from sweetonline to the transmitting system ([dpv2] diamax or sweetconv), a patient will receive login details to sweetonline to access its patient portal from any internet location, including its own computer environment or, e.g., a workstation at the clinic. In its patient portal, for example, the patient is able to complete the WHO-5 outcomes assessment, as well as other quality of life instruments, which may be added to the sweetonline system.

Using a time point management system within sweetonline and the vtoc platform, the WHO-5 could be delivered in intervals of 3 months for an active duration for completion within 6 wk. These time points and duration interval are managed by the SWEET research registry via a user interface in sweetonline.

The collection of the anonymized BIS clinical outcomes data and WHO-5 patient reported outcomes data is done via the sweetbase database for patient-level longitudinal data collection, statistical analysis, and quality data benchmarking. sweetbase provides SWEET registry centers the ability to compare their quality data using the BIS and WHO-5 data sets to all participating CoR with user-friendly aggregate and comparative reporting tools.

Subjects

A significant principle is that all patients at the CoR where the patient and parents have consented to the participation of the child in the registry should be included. A selection bias by the clinic because of poor metabolic control, poor compliance with the guidelines in administrating the yearly quality follow-up, etc. would compromise the validity of the data, and rule out fair benchmarking between the centers.

Measurements

The submitted data are categorized as outcome and process data [1]. To evaluate the progress of the clinic it is an important quality parameter not only to report the values per se of the different variables but also the degree of compliance to the guidelines, e.g., if the planned screening procedures are performed according to the schedule. The registry can offer an individualized and updated information on the time of next screening for retinopathy, urine check for microalbuminuria, etc. This reminder to the diabetologist/diabetes nurse, facilitates compliance with the guidelines and guarantees the right of the patient to receive evidence-based high level of care.

Protocol

The collection of data must be in agreement with the protocol based on International Society for Pediatric and Adolescent Diabetes (ISPAD) guidelines, in order to obtain the most secure and valid data. For example, the height and weight of the child should be recorded without the shoes and in light underclothes [5]. The blood pressure should be measured on the left arm with an age- and size appropriate cuff with the patient in an upright position [6]. The hemoglobin A1c (HbA1c) method should be continuously validated at a centralized quality laboratory to make sure that an eventual drift in the method is recognized and adjusted [7]. A future prospect may be that the CoR could affiliate with the same laboratory for some of the laboratory parameters, e.g., HbA1c [8].

Data analysis

HbA1c is reported once every 3 months as well as height, weight, and blood pressure of patients above the age of 10. BMI is auto-calculated from raw data. During 2011/2012, the following data will be collected: MA (microalbuminuria) – once a year, specified in units (mg/l; µg/min; MA/creatine in ratio), lipids, eye examination, screening for thyroid- and celiac disorders. Personal data like, the date of diagnosis, degree of metabolic disturbance at diagnosis [Diabetic ketoacidosis (DKA) or not], date of diagnosis of associated illnesses such as thyroid- and celiac disease as well as ethnicity are recorded. The treatment modality is essential to prospectively evaluate the effect of insulin pumps, sensors, and other future technical equipment, and correlate the costs with the metabolic outcome.

The data is to be submitted on a regular basis, for example, quarterly within 1 month from the end of each quarterly period. An auto-reminder by email will be sent to CoR-users of the system. The system automatically calls attention to generated data, which is outside of the expected range. Although a complete upload of data according to the protocol is desirable, some data, for example, information on demographic parameters are mandatory.

Results

It is not the subject of this paper to report on the results of specific data. However, the centers from different countries in Europe reporting their 2011 data have had a high fill in rate of almost 100%. The number of patients treated varied significantly between the centers. The mean age of the patients is dependent on whether the pediatric diabetes clinic is also caring for young adults. This allows one to determine the age of a patient at the time of his or her transition to adult care. We can conclude that in centers with about the same tradition of transferring the patients at the age of 18 yr, the mean age of the whole group is about the same in the different countries, around 13 yr. It has been a trend during the latest 20 yr in Northern Europe to lower age of diagnosis [9] but the bulk of patients are teenagers. The diabetes duration of the treated patients goes in parallel as expected with the age of the patients and is around 7 yr.

Discussion

Through this health information technology infrastructure, it is indispensable to be able to aggregate diabetes relevant information and deliver more efficient and quality care by networking all parties of a patient's care team. The outcome of the interdisciplinary care in medical practices, hospitals, and ambulatory healthcare centers, as well as the implementation of integrated utility supply contracts needs evaluation. A reliable, computerized, on-line registry for diabetes-related variables facilitates and permits, sharper focus on indicators of quality and the processes in the workplace as well as the local out-patient clinic. The registry can not only be used for the comparison of data within the diabetes unit but also as a tool for comparison and benchmarking between different units within and between countries.

In Sweden, there has been a running national registry of pediatric diabetes data (SWEDIABKIDS) since 2000 and since the web-based, on-line registry was introduced in January 2008, providing clear results from every clinic, a trend toward better outcome data may be expected in those clinics actively using the data [10].

Based on the data delivered, direct feed-back information is available, at both the individual patient level, as well as on a group level. The registry can give support for decisions according to the guidelines, such as screening time for microalbuminuria, retinopathy, and celiac- or thyroid disease. In pediatrics, the age of the patient is an important factor for appropriate evaluation of laboratory values as well as for other indicators of health. The computerized system allows age-appropriate norms to be integrated, facilitating, for example, the estimate of whether or not the blood pressure level measured is within the normal range.

Diabetes is a chronic disease where a high quality of care has a proven effect on the prognosis of the individual patient in terms of life expectancy and quality of life [11]. It also has an obvious effect on society in terms of medical costs, insurance expenditures, and working capacity of the effected patient [12]. A high quality of care is possible by prospective measurement of the target achievement by the single diabetes unit. The guidelines to follow should be based on the evidence, relying on solid data from a high number of patients, who are treated according to a well-defined policy and updated according to the results. The possibility in sweetonline for the patient to login for access to his/her own patient portal and to fill in forms on quality-of-life measurement is a major step forward toward person-centered care [13].

Implementation research is important to consider, when the aim is to realize evidence-based medicine. The theoretical framework of implementation is based on a strategic change (Pettigrow and Whipp: Strategic Management of Change):

Why-with relevance to context

What-in terms of context

How-in relation to process

Successful strategic changes are based on key people leading the change, quality and coherence of policy, supportive organizational culture, good managerial and clinical relations, co-operative interorganizational networks, and simplicity of organizational goals and priorities.

The SWEET study and the organization of CoR aims to incorporate all of these demands for successful change.

To support this goal, an appropriate and secure data management system as described has been created.

Acknowledgements

The project was supported by the Executive Agency for Health and Consumers (EAHC) as well as through unrestricted educational grants from the following foundations and corporate sponsors: Bayer HealthCare, Dexcom, Diabetes Foundation UK. Hannoversche Kinderheilanstalt Hanover, Germany, Johnson & Johnson, Lilly-Diabetes Excellence Center, Medtronic Foundation, Medtronic, Novo Nordisk, Roche, Sanofi Aventis.

Conflict of interest

The authors declare no conflict of interest.

1. 1

   Electronic health framework system for chronic diseases.

2. 2

   Diabetes management module of DPV2.

3. 3

   Used to convert data from different sources into a defined format needed for the SWEET database.

4. 4

   A file format used to store information in electronic files.

5. 5

   A computer language used to query databases.

6. 6

   The system which stores the transmitted data.

7. 7

   Patient portal for the patients of SWEET participants.

8. 8

   Protocol used for secure data interchange on the Internet.

9. 9

   A security audit standard used, for example, data centre certification.

10. 10

    Code of Federal Regulations with European Annex compliance criteria (Part 11) for electronic health data and electronic signatures to be considered trustworthy, reliable, and equivalent to paper records.

11. 11

    Protocol used for secure data interchange on the Internet.

Appendix

Following members of the SWEET study contributed actively by delivering of data

1. Department of Pediatrics, University Hospital Motol, Praha, Czech Republic
2. Department of Diabetes, Hospital Necker – Enfants Malades, Endocrinologie, Gynecologie et Diabetologie Pediatriques, Paris, France
3. Diabetes Center for Children and Adolescents at the Kinder- und Jugendkrankenhaus - AUF DER BULT, Hannover, Germany
4. Center of A' Department of Pediatrics, ‘P&A Kyriakou Childrens's Hospital’ Athens, Greece
5. First Department of Pediatrics at the Semmelweis University, Budapest, Hungary
6. Centro Regionale Specializzato di Diabetologia Pediatrica Universita Verona, Italy
7. Department of Pediatrics, DCCP/ Pediatric Clinic CH de Luxembourg, Luxembourg
8. Stichting Diabeter, TG Rotterdam, The Netherlands
9. Department of Diabetes at the Medical University of Warsaw, Warsaw, Poland
10. Peadiatric Part of Associação Protectora dos Diabeticos de Portugal, Lisbon, Portugal
11. Clinical Center ‘Cristian Serban’ for Evaluation and Rehabilitation for Children and Adolescents, Buziaş, Romania
12. Department of Diabetes at the Queen Silvia Childrens Hospital Sahlgrenska University Hospital, Gothenburg, Sweden
13. Barts and the London NHS Trust at the Royal London Hospital Whitechapel London, UK