This page is part of the MII IG Kerndatensatz-Modul Onkologie (v2027.0.0-ballot.1: Release) based on FHIR (HL7® FHIR® Standard) R4. This is the current published version. For a full list of available versions, see the Directory of published versions

Security and Privacy

This section addresses security and privacy experts. General requirements are in the FHIR core specification — Security & Privacy Module and the security checklist. This page does not repeat them; it links the overarching data protection framework and states what is specific to this module.

1. The overarching data protection concept

The overarching data protection concept of the Medical Informatics Initiative governs how patient data may be processed for research across the network of Data Integration Centers: it covers the legal basis (the MII Broad Consent), the roles of the Data Integration Centers and Use & Access Committees, and the cross-site application scenarios (feasibility queries, distributed analyses, data and biosample provision). Everything this module specifies operates inside that framework — this guide adds no processing purpose of its own.

2. De-identification, minimisation and pseudonymisation (DIMP)

How data leaving a Data Integration Center is de-identified in practice is specified by DIMP (De-Identification — Minimisation — Pseudonymisation) in the data portal documentation: direct identifiers are removed, data elements not needed by the approved project are dropped, and identifying values are replaced by project-specific pseudonyms (FHIR Pseudonymizer configuration). The profiles of this module describe data before DIMP is applied; which elements survive a concrete data release is decided per project by the DIMP configuration, not by this guide.

3. Module-specific aspects

This is the module's own contribution: the security and privacy properties that follow from the kind of data this module carries.

This module carries data categories that require consideration beyond the overarching framework:

• Germline findings affecting third parties. Predisposition syndromes (ORPHA) and predisposition genes (HGNC) are statements about germline variants. They concern blood relatives who never consented to the data use. Pseudonymisation at profile level does not protect those third parties.
• Genetic variants are identifying in themselves. A sufficiently specific variant profile (Genetic variant) remains traceable even after pseudonymisation. The risk lies in the datum itself, not in the linkage.
• Re-identification via rare entities. The combination of a rare tumour entity (ICD-O-3 morphology), age and region can converge on an individual in small cohorts without any identifier being involved.
• Death data (oBDS chapter 20) and study participation (chapter 24) connect this module to further contexts.

This yields requirements for implementers:

• Systems SHOULD subject germline and predisposition findings to a separate access decision rather than releasing them together with the remaining oncological dataset.
• Analyses over rare entities SHOULD be checked for cell sizes before release; the profiles of this module do not do this.
• These risks are not solvable at profile level. They must be addressed in system design, in operations and through data use policies — this module describes the structure of the data, not the conditions of its use.