Individual Participant Data Meta-Analysis

Given that IPD meta‐analyses are typically collaborative projects, trial investigators and their host institutes need to ensure that trial IPD are suitably de‐identified, then transferred and stored securely, so as to preserve participant privacy, and that any unauthorised use is prohibited, as set out in the data‐sharing agreement ( Section 3.11).

It is important to request that data providers take steps to de‐identify participants in their IPD, before transferring it to the meta‐analysis research team, so as to minimise the risk of participants being re‐identified and their confidentiality being breached. 98De‐identification generally involves the removal of all identifiers that could directly identify individuals, such as participant names and medical or hospital numbers. In an IPD meta‐analysis project, this small degree of de‐identification is the usual process followed by data providers, because the data recipients (i.e. the IPD project’s central research team) will not have access to the full, original (identifying) data. However, the data protection legislation of the country from which the trial originates, or institutional requirements, may necessitate more stringent de‐identification measures, for example, the removal or recoding of indirect or quasi‐identifiers such as dates of birth, and the removal or redaction of free‐text verbatim terms. Direct identifiers may be replaced with new pseudonyms, and quasi‐identifying dates may be removed or generalised to, for example, just the month and year so as to limit the risk of identification. 99As the link between the shared IPD and original trial data is preserved, it remains feasible to consult with trial investigators on any issues that arise at the participant level, and update the IPD as needed.

Figure 4.4Excerpts from the website https://www.york.ac.uk/crd/research/epppic/for an IPD meta‐analysis of the effects of progestogens for the prevention of preterm birth.

Source: Evaluating Progestogens for Prevention of Preterm birth International Collaborative, © University of York.

Although with a lesser degree of de‐identification or pseudonymisation there are risks that participants might be identified, 99this is mitigated by the data provider and IPD project’s central research team entering into a data‐sharing agreement. This should specifically prohibit any attempt to identify individuals, and stipulate that the team receiving the data should have data privacy training, and will hold the data securely and use it appropriately ( Section 3.11). Data recipients still need to sign data‐sharing agreements to obtain IPD from more public sources, such as data‐sharing platforms or repositories ( Section 3.2.2), 100but these data will usually have been subject to a greater degree of de‐identification, because the risks to participant confidentiality are greater with such quasi‐public data. 99Full de‐identification or anonymisation, involving the removal of all links between the de‐identified IPD and the original datasets, limits the utility of the IPD for meta‐analysis and therefore, is not recommended.

Table 4.3Example of items to include in a data transfer guide when requesting IPD

Source: Jayne Tierney and Larysa Rydzewska.

It is useful to provide trial investigators, or their data contact, with a data transfer guide outlining how their IPD should be prepared and transferred securely ( Table 4.3). In addition, the guide can be used to make data providers aware of how the central research team will subsequently manage, check and verify their data, and to encourage them to get in touch should any queries arise. It may also highlight whether there are any specific funds available to facilitate the preparation of trial data, and how to access these. If helpful, the guide can be accompanied by a template data file in the trial investigators preferred software package (such as Stata, R, SAS, or Excel), including all the variable names, but no actual data.

Based on the relevant data transfer guidance supplied by the central research team, secure data transfer can be achieved using a suitable file transfer site, for example, an institutional or suitable commercial file share service. Where a data file needs to be sent via email, ideally it should be end‐to‐end encrypted or otherwise password protected, with passwords sent separately (and ideally via a different communication medium, such as by post or by telephone). Although rare these days, if data need to be transferred using physical storage media, such as external disc drives or memory sticks, these should also be encrypted and sent using a delivery service that allows the package to be tracked and signed for upon delivery.

When data files are first received, it is important to ensure that they can be read and loaded into the preferred storage or analysis system before proceeding. For example, if a data file arrive electronically, it should be checked to ensure that any passwords provided work, and that it can be opened, is for the correct trial, and that the data have not been corrupted during transfer. It is important to thank relevant trial personnel for providing their data, and either confirm that they are as expected, or relay any issues that have arisen, as soon as possible.

Once transferred, IPD need to be stored securely by the central research team, with access limited to those members responsible for data management, checking and analysis, or overall conduct. They should have appropriate expertise in the handling of participant data, as well as training in data protection, and also should be prohibited from copying data to any mobile devices, laptops, memory sticks or cloud servers that have not been set up for the secure storage of confidential data.