A lot of Hype goes in reproducible, open and transparency for data analysis theses days in some fields mores that other. The code is to be share as well as the dataset. How to achieve this in a context of patient data protection that all ethics' committees will require ? What are the best practice to overcome theses antagonistics goals ? My team seems to think patient's data protection means the data (already anonymized) shouldn't leak and thus we have to work on the database's server without ever getting the anon db on our stations. This feels a tad too much / an overkill ?
Its totally normal practice for patient data to be allowed to be stored only on properly secured, regulated and monitored servers.
In my field (genomics), databases exist where researchers can deposit anonymized patient data, that is not "publically" available, but can be accessed by users that can demonstrate that they have good reason to use the data, that their use falls within the consent agreement and have the IT systems in place to keep the data safe (see for e.g. dbGaP and EGA) by making an application to a data-protection committee.
Code can be written in such a way that no patient data is in the code (loaded from secure locations, etc), so that the code can be shared.
People have already though about the this. The American Statistical Association has guideline for reproducible results (here).
- Reproducibility is enhanced by following best current practices, including:
a. Ideally, exclusive use of publicly available data. However if the research domain does not allow for publically available data for widely accepted reasons (e.g., medical data with high confidentiality concerns), the principles outlined in items (b) - (e) should still be followed;
b. Use of version control for all (collaborative or individual) code development;
c. Exclusive use of open-source software freely available to anyone in the world
d. End-to-end scripting of research, including data processing and cleaning, statistical analyses, visualizations, and report and/or manuscript generation, with the full workflow made available to others;
e. Use of container/virtual machine tools to capture software versions, dependencies, and platform specifics;
f. Publication of code in public repositories as with data; and
g. For projects that develop algorithms, implementing algorithms on standard computational platforms (e.g., R packages, Python packages, source code packages installable via standard methods, etc.).
Reproducibility shouldn't be thought of as a binary state: either reproducible or not-reproducible. It's more useful to think about it as continuum from hard to reproduce to easy to reproduce. The goal of any reproducibility effort should broadly be to move as many people as possible further towards easy-to-reproduce. This involves some technological (to make the right thing easier than the wrong thing) and some social (to give people the activation energy to learn a better process even though it's harder in the short-term) components.
It’s perhaps worth noting that in this era of “replication crisis”, reproducibility is the only thing that can be effectively guaranteed in a published study. Whether any claimed findings are indeed true or false can only be confirmed via additional studies, but reproducibility can be confirmed immediately.
Also, the medical literautre has discussed this. For example, Tucker et al. describe how to protect patient privacy when sharing data. Their two key recommendations were:
Data anonymisation/de-identification: Data holders are responsible for generating de-identified datasets which are intended to offer increased protection for patient privacy through masking or generalisation of direct and some indirect identifiers.
Controlled access to data, including use of a data sharing agreement: A legally binding data sharing agreement should be in place, including agreements not to download or further share data and not to attempt to seek to identify patients. Appropriate levels of security should be used for transferring data or providing access; one solution is use of a secure ‘locked box’ system which provides additional safeguards.
Searching through the medical and statistical literature will give you more ideas we well.