Authors:	Lablans, Martin Borg, Andreas Ückert, Frank
Title:	A RESTful interface to pseudonymization services in modern web applications
Online publication date:	14-Oct-2022
Year of first publication:	2015
Language:	english
Abstract:	BACKGROUND: Medical research networks rely on record linkage and pseudonymization to determine which records from different sources relate to the same patient. To establish informational separation of powers, the required identifying data are redirected to a trusted third party that has, in turn, no access to medical data. This pseudonymization service receives identifying data, compares them with a list of already reported patient records and replies with a (new or existing) pseudonym. We found existing solutions to be technically outdated, complex to implement or not suitable for internet-based research infrastructures. In this article, we propose a new RESTful pseudonymization interface tailored for use in web applications accessed by modern web browsers. METHODS: The interface is modelled as a resource-oriented architecture, which is based on the representational state transfer (REST) architectural style. We translated typical use-cases into resources to be manipulated with well-known HTTP verbs. Patients can be re-identified in real-time by authorized users' web browsers using temporary identifiers. We encourage the use of PID strings for pseudonyms and the EpiLink algorithm for record linkage. As a proof of concept, we developed a Java Servlet as reference implementation. RESULTS: The following resources have been identified: Sessions allow data associated with a client to be stored beyond a single request while still maintaining statelessness. Tokens authorize for a specified action and thus allow the delegation of authentication. Patients are identified by one or more pseudonyms and carry identifying fields. Relying on HTTP calls alone, the interface is firewall-friendly. The reference implementation has proven to be production stable. CONCLUSION: The RESTful pseudonymization interface fits the requirements of web-based scenarios and allows building applications that make pseudonymization transparent to the user using ordinary web technology. The open-source reference implementation implements the web interface as well as a scientifically grounded algorithm to generate non-speaking pseudonyms.
DDC:	610 Medizin 610 Medical sciences
Institution:	Johannes Gutenberg-Universität Mainz
Department:	FB 04 Medizin
Place:	Mainz
ROR:	https://ror.org/023b0x485
DOI:	http://doi.org/10.25358/openscience-8003
Version:	Published version
Publication type:	Zeitschriftenaufsatz
License:	CC BY
Information on rights of use:	https://creativecommons.org/licenses/by/4.0/
Journal:	BMC medical informatics and decision making 15
Pages or article number:	Art. 2
Publisher:	BioMed Central
Publisher place:	London
Issue date:	2015
ISSN:	1472-6947
Publisher URL:	http://dx.doi.org/10.1186/s12911-014-0123-5
Publisher DOI:	10.1186/s12911-014-0123-5
Appears in collections:	DFG-OA-Publizieren (2012 - 2017)