Links to Exploration step
Le document en format XML
<record><TEI><teiHeader><fileDesc><titleStmt><title xml:lang="en">DataSHIELD: taking the analysis to the data, not the data to the analysis</title><author><name sortKey="Gaye, Amadou" sort="Gaye, Amadou" uniqKey="Gaye A" first="Amadou" last="Gaye">Amadou Gaye</name><affiliation><nlm:aff id="dyu188-AFF1">School of Social and Community Medicine, University of Bristol, Bristol, UK,</nlm:aff></affiliation></author><author><name sortKey="Marcon, Yannick" sort="Marcon, Yannick" uniqKey="Marcon Y" first="Yannick" last="Marcon">Yannick Marcon</name><affiliation><nlm:aff id="dyu188-AFF1">Maelstrom Research Group, Research Institute of the McGill University Health Centre, McGill University, Montreal, Canada,</nlm:aff></affiliation></author><author><name sortKey="Isaeva, Julia" sort="Isaeva, Julia" uniqKey="Isaeva J" first="Julia" last="Isaeva">Julia Isaeva</name><affiliation><nlm:aff id="dyu188-AFF1">Norwegian Institute of Public Health, Oslo, Norway,</nlm:aff></affiliation></author><author><name sortKey="Laflamme, Philippe" sort="Laflamme, Philippe" uniqKey="Laflamme P" first="Philippe" last="Laflamme">Philippe Laflamme</name><affiliation><nlm:aff id="dyu188-AFF1">Maelstrom Research Group, Research Institute of the McGill University Health Centre, McGill University, Montreal, Canada,</nlm:aff></affiliation></author><author><name sortKey="Turner, Andrew" sort="Turner, Andrew" uniqKey="Turner A" first="Andrew" last="Turner">Andrew Turner</name><affiliation><nlm:aff id="dyu188-AFF1">School of Social and Community Medicine, University of Bristol, Bristol, UK,</nlm:aff></affiliation></author><author><name sortKey="Jones, Elinor M" sort="Jones, Elinor M" uniqKey="Jones E" first="Elinor M" last="Jones">Elinor M. Jones</name><affiliation><nlm:aff id="dyu188-AFF1">Department Statistical Science, University College London, London, UK,</nlm:aff></affiliation></author><author><name sortKey="Minion, Joel" sort="Minion, Joel" uniqKey="Minion J" first="Joel" last="Minion">Joel Minion</name><affiliation><nlm:aff id="dyu188-AFF1">School of Social and Community Medicine, University of Bristol, Bristol, UK,</nlm:aff></affiliation></author><author><name sortKey="Boyd, Andrew W" sort="Boyd, Andrew W" uniqKey="Boyd A" first="Andrew W" last="Boyd">Andrew W. Boyd</name><affiliation><nlm:aff id="dyu188-AFF1">School of Social and Community Medicine, University of Bristol, Bristol, UK,</nlm:aff></affiliation></author><author><name sortKey="Newby, Christopher J" sort="Newby, Christopher J" uniqKey="Newby C" first="Christopher J" last="Newby">Christopher J. Newby</name><affiliation><nlm:aff id="dyu188-AFF1">Department of Infection, Immunity and Inflammation, Health Sciences, University of Leicester, Leicester, UK,</nlm:aff></affiliation></author><author><name sortKey="Nuotio, Marja Liisa" sort="Nuotio, Marja Liisa" uniqKey="Nuotio M" first="Marja-Liisa" last="Nuotio">Marja-Liisa Nuotio</name><affiliation><nlm:aff id="dyu188-AFF1">Institute for Molecular Medicine Finland (FIMM), University of Helsinki, Helsinki, Finland,</nlm:aff></affiliation><affiliation><nlm:aff id="dyu188-AFF1">Unit of Public Health Genomics, National Institute for Health and Welfare, Helsinki, Finland,</nlm:aff></affiliation></author><author><name sortKey="Wilson, Rebecca" sort="Wilson, Rebecca" uniqKey="Wilson R" first="Rebecca" last="Wilson">Rebecca Wilson</name><affiliation><nlm:aff id="dyu188-AFF1">School of Social and Community Medicine, University of Bristol, Bristol, UK,</nlm:aff></affiliation></author><author><name sortKey="Butters, Oliver" sort="Butters, Oliver" uniqKey="Butters O" first="Oliver" last="Butters">Oliver Butters</name><affiliation><nlm:aff id="dyu188-AFF1">School of Social and Community Medicine, University of Bristol, Bristol, UK,</nlm:aff></affiliation></author><author><name sortKey="Murtagh, Barnaby" sort="Murtagh, Barnaby" uniqKey="Murtagh B" first="Barnaby" last="Murtagh">Barnaby Murtagh</name><affiliation><nlm:aff id="dyu188-AFF1">Department of Health Sciences, University of Leicester, Leicester, UK,</nlm:aff></affiliation></author><author><name sortKey="Demir, Ipek" sort="Demir, Ipek" uniqKey="Demir I" first="Ipek" last="Demir">Ipek Demir</name><affiliation><nlm:aff id="dyu188-AFF1">Department of Sociology, University of Leicester, Leicester, UK,</nlm:aff></affiliation></author><author><name sortKey="Doiron, Dany" sort="Doiron, Dany" uniqKey="Doiron D" first="Dany" last="Doiron">Dany Doiron</name><affiliation><nlm:aff id="dyu188-AFF1">Maelstrom Research Group, Research Institute of the McGill University Health Centre, McGill University, Montreal, Canada,</nlm:aff></affiliation></author><author><name sortKey="Giepmans, Lisette" sort="Giepmans, Lisette" uniqKey="Giepmans L" first="Lisette" last="Giepmans">Lisette Giepmans</name><affiliation><nlm:aff id="dyu188-AFF1">Department of Epidemiology, University Medical Center Groningen, Groningen, The Netherlands,</nlm:aff></affiliation></author><author><name sortKey="Wallace, Susan E" sort="Wallace, Susan E" uniqKey="Wallace S" first="Susan E" last="Wallace">Susan E. Wallace</name><affiliation><nlm:aff id="dyu188-AFF1">Department of Health Sciences, University of Leicester, Leicester, UK,</nlm:aff></affiliation></author><author><name sortKey="Budin Lj Sne, Isabelle" sort="Budin Lj Sne, Isabelle" uniqKey="Budin Lj Sne I" first="Isabelle" last="Budin-Lj Sne">Isabelle Budin-Lj Sne</name><affiliation><nlm:aff id="dyu188-AFF1">Norwegian Institute of Public Health, Oslo, Norway,</nlm:aff></affiliation></author><author><name sortKey="Oliver Schmidt, Carsten" sort="Oliver Schmidt, Carsten" uniqKey="Oliver Schmidt C" first="Carsten" last="Oliver Schmidt">Carsten Oliver Schmidt</name><affiliation><nlm:aff id="dyu188-AFF1">Institut für Community Medicine, University Medicine of Greifswald, Greifswald, Germany,</nlm:aff></affiliation></author><author><name sortKey="Boffetta, Paolo" sort="Boffetta, Paolo" uniqKey="Boffetta P" first="Paolo" last="Boffetta">Paolo Boffetta</name><affiliation><nlm:aff id="dyu188-AFF1">International Prevention Research Institute, Lyon, France,</nlm:aff></affiliation></author><author><name sortKey="Boniol, Mathieu" sort="Boniol, Mathieu" uniqKey="Boniol M" first="Mathieu" last="Boniol">Mathieu Boniol</name><affiliation><nlm:aff id="dyu188-AFF1">International Prevention Research Institute, Lyon, France,</nlm:aff></affiliation></author><author><name sortKey="Bota, Maria" sort="Bota, Maria" uniqKey="Bota M" first="Maria" last="Bota">Maria Bota</name><affiliation><nlm:aff id="dyu188-AFF1">International Prevention Research Institute, Lyon, France,</nlm:aff></affiliation></author><author><name sortKey="Carter, Kim W" sort="Carter, Kim W" uniqKey="Carter K" first="Kim W" last="Carter">Kim W. Carter</name><affiliation><nlm:aff id="dyu188-AFF1">Telethon Kids Institute, University of Western Australia, Perth, WA, Australia,</nlm:aff></affiliation></author><author><name sortKey="Deklerk, Nick" sort="Deklerk, Nick" uniqKey="Deklerk N" first="Nick" last="Deklerk">Nick Deklerk</name><affiliation><nlm:aff id="dyu188-AFF1">Telethon Kids Institute, University of Western Australia, Perth, WA, Australia,</nlm:aff></affiliation></author><author><name sortKey="Dibben, Chris" sort="Dibben, Chris" uniqKey="Dibben C" first="Chris" last="Dibben">Chris Dibben</name><affiliation><nlm:aff id="dyu188-AFF1">School of Geosciences, University of Edinburgh, Edinburgh, UK,</nlm:aff></affiliation></author><author><name sortKey="Francis, Richard W" sort="Francis, Richard W" uniqKey="Francis R" first="Richard W" last="Francis">Richard W. Francis</name><affiliation><nlm:aff id="dyu188-AFF1">Telethon Kids Institute, University of Western Australia, Perth, WA, Australia,</nlm:aff></affiliation></author><author><name sortKey="Hiekkalinna, Tero" sort="Hiekkalinna, Tero" uniqKey="Hiekkalinna T" first="Tero" last="Hiekkalinna">Tero Hiekkalinna</name><affiliation><nlm:aff id="dyu188-AFF1">Institute for Molecular Medicine Finland (FIMM), University of Helsinki, Helsinki, Finland,</nlm:aff></affiliation><affiliation><nlm:aff id="dyu188-AFF1">Unit of Public Health Genomics, National Institute for Health and Welfare, Helsinki, Finland,</nlm:aff></affiliation></author><author><name sortKey="Hveem, Kristian" sort="Hveem, Kristian" uniqKey="Hveem K" first="Kristian" last="Hveem">Kristian Hveem</name><affiliation><nlm:aff id="dyu188-AFF1">Norwegian University of Science and Technology, Levanger, Norway,</nlm:aff></affiliation></author><author><name sortKey="Kval Y, Kirsti" sort="Kval Y, Kirsti" uniqKey="Kval Y K" first="Kirsti" last="Kval Y">Kirsti Kval Y</name><affiliation><nlm:aff id="dyu188-AFF1">Norwegian University of Science and Technology, Levanger, Norway,</nlm:aff></affiliation></author><author><name sortKey="Millar, Sean" sort="Millar, Sean" uniqKey="Millar S" first="Sean" last="Millar">Sean Millar</name><affiliation><nlm:aff id="dyu188-AFF1">HRB Centre for Diet and Health Research, Department of Epidemiology and Public Health, University College Cork, Cork, Ireland,</nlm:aff></affiliation></author><author><name sortKey="Perry, Ivan J" sort="Perry, Ivan J" uniqKey="Perry I" first="Ivan J" last="Perry">Ivan J. Perry</name><affiliation><nlm:aff id="dyu188-AFF1">HRB Centre for Diet and Health Research, Department of Epidemiology and Public Health, University College Cork, Cork, Ireland,</nlm:aff></affiliation></author><author><name sortKey="Peters, Annette" sort="Peters, Annette" uniqKey="Peters A" first="Annette" last="Peters">Annette Peters</name><affiliation><nlm:aff id="dyu188-AFF1">Research Unit of Molecular Epidemiology, Research Center for Environmental Health, Neuherberg, Germany,</nlm:aff></affiliation></author><author><name sortKey="Phillips, Catherine M" sort="Phillips, Catherine M" uniqKey="Phillips C" first="Catherine M" last="Phillips">Catherine M. Phillips</name><affiliation><nlm:aff id="dyu188-AFF1">HRB Centre for Diet and Health Research, Department of Epidemiology and Public Health, University College Cork, Cork, Ireland,</nlm:aff></affiliation></author><author><name sortKey="Popham, Frank" sort="Popham, Frank" uniqKey="Popham F" first="Frank" last="Popham">Frank Popham</name><affiliation><nlm:aff id="dyu188-AFF1">MRC/CSO Social and Public Health Sciences Unit, University of Glasgow, Glasgow, UK,</nlm:aff></affiliation></author><author><name sortKey="Raab, Gillian" sort="Raab, Gillian" uniqKey="Raab G" first="Gillian" last="Raab">Gillian Raab</name><affiliation><nlm:aff id="dyu188-AFF1">School of Geosciences, University of Edinburgh, Edinburgh, UK,</nlm:aff></affiliation></author><author><name sortKey="Reischl, Eva" sort="Reischl, Eva" uniqKey="Reischl E" first="Eva" last="Reischl">Eva Reischl</name><affiliation><nlm:aff id="dyu188-AFF1">Research Unit of Molecular Epidemiology, Research Center for Environmental Health, Neuherberg, Germany,</nlm:aff></affiliation></author><author><name sortKey="Sheehan, Nuala" sort="Sheehan, Nuala" uniqKey="Sheehan N" first="Nuala" last="Sheehan">Nuala Sheehan</name><affiliation><nlm:aff id="dyu188-AFF1">Department of Health Sciences, University of Leicester, Leicester, UK,</nlm:aff></affiliation></author><author><name sortKey="Waldenberger, Melanie" sort="Waldenberger, Melanie" uniqKey="Waldenberger M" first="Melanie" last="Waldenberger">Melanie Waldenberger</name><affiliation><nlm:aff id="dyu188-AFF1">Research Unit of Molecular Epidemiology, Research Center for Environmental Health, Neuherberg, Germany,</nlm:aff></affiliation></author><author><name sortKey="Perola, Markus" sort="Perola, Markus" uniqKey="Perola M" first="Markus" last="Perola">Markus Perola</name><affiliation><nlm:aff id="dyu188-AFF1">Institute for Molecular Medicine Finland (FIMM), University of Helsinki, Helsinki, Finland,</nlm:aff></affiliation><affiliation><nlm:aff id="dyu188-AFF1">Unit of Public Health Genomics, National Institute for Health and Welfare, Helsinki, Finland,</nlm:aff></affiliation><affiliation><nlm:aff id="dyu188-AFF1">University of Tartu, Estonian Genome Center, Tartu, Estonia,</nlm:aff></affiliation></author><author><name sortKey="Van Den Heuvel, Edwin" sort="Van Den Heuvel, Edwin" uniqKey="Van Den Heuvel E" first="Edwin" last="Van Den Heuvel">Edwin Van Den Heuvel</name><affiliation><nlm:aff id="dyu188-AFF1">University Medical Center Groningen, Medical Statistics, Groningen, The Netherlands,</nlm:aff></affiliation></author><author><name sortKey="Macleod, John" sort="Macleod, John" uniqKey="Macleod J" first="John" last="Macleod">John Macleod</name><affiliation><nlm:aff id="dyu188-AFF1">School of Social and Community Medicine, University of Bristol, Bristol, UK,</nlm:aff></affiliation></author><author><name sortKey="Knoppers, Bartha M" sort="Knoppers, Bartha M" uniqKey="Knoppers B" first="Bartha M" last="Knoppers">Bartha M. Knoppers</name><affiliation><nlm:aff id="dyu188-AFF1">Centre of Genomics and Policy, McGill University, Montreal, Canada,</nlm:aff></affiliation></author><author><name sortKey="Stolk, Ronald P" sort="Stolk, Ronald P" uniqKey="Stolk R" first="Ronald P" last="Stolk">Ronald P. Stolk</name><affiliation><nlm:aff id="dyu188-AFF1">Department of Epidemiology, University Medical Center Groningen, Groningen, The Netherlands,</nlm:aff></affiliation><affiliation><nlm:aff id="dyu188-AFF1">University Medical Center Groningen, LifeLines Cohort Study, Groningen, The Netherlands,</nlm:aff></affiliation></author><author><name sortKey="Fortier, Isabel" sort="Fortier, Isabel" uniqKey="Fortier I" first="Isabel" last="Fortier">Isabel Fortier</name><affiliation><nlm:aff id="dyu188-AFF1">Maelstrom Research Group, Research Institute of the McGill University Health Centre, McGill University, Montreal, Canada,</nlm:aff></affiliation></author><author><name sortKey="Harris, Jennifer R" sort="Harris, Jennifer R" uniqKey="Harris J" first="Jennifer R" last="Harris">Jennifer R. Harris</name><affiliation><nlm:aff id="dyu188-AFF1">Norwegian Institute of Public Health, Oslo, Norway,</nlm:aff></affiliation></author><author><name sortKey="Woffenbuttel, Bruce Hr" sort="Woffenbuttel, Bruce Hr" uniqKey="Woffenbuttel B" first="Bruce Hr" last="Woffenbuttel">Bruce Hr Woffenbuttel</name><affiliation><nlm:aff id="dyu188-AFF1">University Medical Center Groningen, LifeLines Cohort Study, Groningen, The Netherlands,</nlm:aff></affiliation><affiliation><nlm:aff id="dyu188-AFF1">Department of Endocrinology, University Medical Center Groningen, Groningen, The Netherlands,</nlm:aff></affiliation></author><author><name sortKey="Murtagh, Madeleine J" sort="Murtagh, Madeleine J" uniqKey="Murtagh M" first="Madeleine J" last="Murtagh">Madeleine J. Murtagh</name><affiliation><nlm:aff wicri:cut=" and" id="dyu188-AFF1">School of Social and Community Medicine, University of Bristol, Bristol, UK</nlm:aff></affiliation></author><author><name sortKey="Ferretti, Vincent" sort="Ferretti, Vincent" uniqKey="Ferretti V" first="Vincent" last="Ferretti">Vincent Ferretti</name><affiliation><nlm:aff id="dyu188-AFF1">Maelstrom Research Group, Research Institute of the McGill University Health Centre, McGill University, Montreal, Canada,</nlm:aff></affiliation><affiliation><nlm:aff id="dyu188-AFF1">Ontario Institute for Cancer Research, Toronto, Canada</nlm:aff></affiliation></author><author><name sortKey="Burton, Paul R" sort="Burton, Paul R" uniqKey="Burton P" first="Paul R" last="Burton">Paul R. Burton</name><affiliation><nlm:aff id="dyu188-AFF1">Maelstrom Research Group, Research Institute of the McGill University Health Centre, McGill University, Montreal, Canada,</nlm:aff></affiliation><affiliation><nlm:aff wicri:cut=" and" id="dyu188-AFF1">School of Social and Community Medicine, University of Bristol, Bristol, UK</nlm:aff></affiliation></author></titleStmt><publicationStmt><idno type="wicri:source">PMC</idno><idno type="pmid">25261970</idno><idno type="pmc">4276062</idno><idno type="url">http://www.ncbi.nlm.nih.gov/pmc/articles/PMC4276062</idno><idno type="RBID">PMC:4276062</idno><idno type="doi">10.1093/ije/dyu188</idno><date when="2014">2014</date><idno type="wicri:Area/Pmc/Corpus">002600</idno><idno type="wicri:explorRef" wicri:stream="Pmc" wicri:step="Corpus" wicri:corpus="PMC">002600</idno></publicationStmt><sourceDesc><biblStruct><analytic><title xml:lang="en" level="a" type="main">DataSHIELD: taking the analysis to the data, not the data to the analysis</title><author><name sortKey="Gaye, Amadou" sort="Gaye, Amadou" uniqKey="Gaye A" first="Amadou" last="Gaye">Amadou Gaye</name><affiliation><nlm:aff id="dyu188-AFF1">School of Social and Community Medicine, University of Bristol, Bristol, UK,</nlm:aff></affiliation></author><author><name sortKey="Marcon, Yannick" sort="Marcon, Yannick" uniqKey="Marcon Y" first="Yannick" last="Marcon">Yannick Marcon</name><affiliation><nlm:aff id="dyu188-AFF1">Maelstrom Research Group, Research Institute of the McGill University Health Centre, McGill University, Montreal, Canada,</nlm:aff></affiliation></author><author><name sortKey="Isaeva, Julia" sort="Isaeva, Julia" uniqKey="Isaeva J" first="Julia" last="Isaeva">Julia Isaeva</name><affiliation><nlm:aff id="dyu188-AFF1">Norwegian Institute of Public Health, Oslo, Norway,</nlm:aff></affiliation></author><author><name sortKey="Laflamme, Philippe" sort="Laflamme, Philippe" uniqKey="Laflamme P" first="Philippe" last="Laflamme">Philippe Laflamme</name><affiliation><nlm:aff id="dyu188-AFF1">Maelstrom Research Group, Research Institute of the McGill University Health Centre, McGill University, Montreal, Canada,</nlm:aff></affiliation></author><author><name sortKey="Turner, Andrew" sort="Turner, Andrew" uniqKey="Turner A" first="Andrew" last="Turner">Andrew Turner</name><affiliation><nlm:aff id="dyu188-AFF1">School of Social and Community Medicine, University of Bristol, Bristol, UK,</nlm:aff></affiliation></author><author><name sortKey="Jones, Elinor M" sort="Jones, Elinor M" uniqKey="Jones E" first="Elinor M" last="Jones">Elinor M. Jones</name><affiliation><nlm:aff id="dyu188-AFF1">Department Statistical Science, University College London, London, UK,</nlm:aff></affiliation></author><author><name sortKey="Minion, Joel" sort="Minion, Joel" uniqKey="Minion J" first="Joel" last="Minion">Joel Minion</name><affiliation><nlm:aff id="dyu188-AFF1">School of Social and Community Medicine, University of Bristol, Bristol, UK,</nlm:aff></affiliation></author><author><name sortKey="Boyd, Andrew W" sort="Boyd, Andrew W" uniqKey="Boyd A" first="Andrew W" last="Boyd">Andrew W. Boyd</name><affiliation><nlm:aff id="dyu188-AFF1">School of Social and Community Medicine, University of Bristol, Bristol, UK,</nlm:aff></affiliation></author><author><name sortKey="Newby, Christopher J" sort="Newby, Christopher J" uniqKey="Newby C" first="Christopher J" last="Newby">Christopher J. Newby</name><affiliation><nlm:aff id="dyu188-AFF1">Department of Infection, Immunity and Inflammation, Health Sciences, University of Leicester, Leicester, UK,</nlm:aff></affiliation></author><author><name sortKey="Nuotio, Marja Liisa" sort="Nuotio, Marja Liisa" uniqKey="Nuotio M" first="Marja-Liisa" last="Nuotio">Marja-Liisa Nuotio</name><affiliation><nlm:aff id="dyu188-AFF1">Institute for Molecular Medicine Finland (FIMM), University of Helsinki, Helsinki, Finland,</nlm:aff></affiliation><affiliation><nlm:aff id="dyu188-AFF1">Unit of Public Health Genomics, National Institute for Health and Welfare, Helsinki, Finland,</nlm:aff></affiliation></author><author><name sortKey="Wilson, Rebecca" sort="Wilson, Rebecca" uniqKey="Wilson R" first="Rebecca" last="Wilson">Rebecca Wilson</name><affiliation><nlm:aff id="dyu188-AFF1">School of Social and Community Medicine, University of Bristol, Bristol, UK,</nlm:aff></affiliation></author><author><name sortKey="Butters, Oliver" sort="Butters, Oliver" uniqKey="Butters O" first="Oliver" last="Butters">Oliver Butters</name><affiliation><nlm:aff id="dyu188-AFF1">School of Social and Community Medicine, University of Bristol, Bristol, UK,</nlm:aff></affiliation></author><author><name sortKey="Murtagh, Barnaby" sort="Murtagh, Barnaby" uniqKey="Murtagh B" first="Barnaby" last="Murtagh">Barnaby Murtagh</name><affiliation><nlm:aff id="dyu188-AFF1">Department of Health Sciences, University of Leicester, Leicester, UK,</nlm:aff></affiliation></author><author><name sortKey="Demir, Ipek" sort="Demir, Ipek" uniqKey="Demir I" first="Ipek" last="Demir">Ipek Demir</name><affiliation><nlm:aff id="dyu188-AFF1">Department of Sociology, University of Leicester, Leicester, UK,</nlm:aff></affiliation></author><author><name sortKey="Doiron, Dany" sort="Doiron, Dany" uniqKey="Doiron D" first="Dany" last="Doiron">Dany Doiron</name><affiliation><nlm:aff id="dyu188-AFF1">Maelstrom Research Group, Research Institute of the McGill University Health Centre, McGill University, Montreal, Canada,</nlm:aff></affiliation></author><author><name sortKey="Giepmans, Lisette" sort="Giepmans, Lisette" uniqKey="Giepmans L" first="Lisette" last="Giepmans">Lisette Giepmans</name><affiliation><nlm:aff id="dyu188-AFF1">Department of Epidemiology, University Medical Center Groningen, Groningen, The Netherlands,</nlm:aff></affiliation></author><author><name sortKey="Wallace, Susan E" sort="Wallace, Susan E" uniqKey="Wallace S" first="Susan E" last="Wallace">Susan E. Wallace</name><affiliation><nlm:aff id="dyu188-AFF1">Department of Health Sciences, University of Leicester, Leicester, UK,</nlm:aff></affiliation></author><author><name sortKey="Budin Lj Sne, Isabelle" sort="Budin Lj Sne, Isabelle" uniqKey="Budin Lj Sne I" first="Isabelle" last="Budin-Lj Sne">Isabelle Budin-Lj Sne</name><affiliation><nlm:aff id="dyu188-AFF1">Norwegian Institute of Public Health, Oslo, Norway,</nlm:aff></affiliation></author><author><name sortKey="Oliver Schmidt, Carsten" sort="Oliver Schmidt, Carsten" uniqKey="Oliver Schmidt C" first="Carsten" last="Oliver Schmidt">Carsten Oliver Schmidt</name><affiliation><nlm:aff id="dyu188-AFF1">Institut für Community Medicine, University Medicine of Greifswald, Greifswald, Germany,</nlm:aff></affiliation></author><author><name sortKey="Boffetta, Paolo" sort="Boffetta, Paolo" uniqKey="Boffetta P" first="Paolo" last="Boffetta">Paolo Boffetta</name><affiliation><nlm:aff id="dyu188-AFF1">International Prevention Research Institute, Lyon, France,</nlm:aff></affiliation></author><author><name sortKey="Boniol, Mathieu" sort="Boniol, Mathieu" uniqKey="Boniol M" first="Mathieu" last="Boniol">Mathieu Boniol</name><affiliation><nlm:aff id="dyu188-AFF1">International Prevention Research Institute, Lyon, France,</nlm:aff></affiliation></author><author><name sortKey="Bota, Maria" sort="Bota, Maria" uniqKey="Bota M" first="Maria" last="Bota">Maria Bota</name><affiliation><nlm:aff id="dyu188-AFF1">International Prevention Research Institute, Lyon, France,</nlm:aff></affiliation></author><author><name sortKey="Carter, Kim W" sort="Carter, Kim W" uniqKey="Carter K" first="Kim W" last="Carter">Kim W. Carter</name><affiliation><nlm:aff id="dyu188-AFF1">Telethon Kids Institute, University of Western Australia, Perth, WA, Australia,</nlm:aff></affiliation></author><author><name sortKey="Deklerk, Nick" sort="Deklerk, Nick" uniqKey="Deklerk N" first="Nick" last="Deklerk">Nick Deklerk</name><affiliation><nlm:aff id="dyu188-AFF1">Telethon Kids Institute, University of Western Australia, Perth, WA, Australia,</nlm:aff></affiliation></author><author><name sortKey="Dibben, Chris" sort="Dibben, Chris" uniqKey="Dibben C" first="Chris" last="Dibben">Chris Dibben</name><affiliation><nlm:aff id="dyu188-AFF1">School of Geosciences, University of Edinburgh, Edinburgh, UK,</nlm:aff></affiliation></author><author><name sortKey="Francis, Richard W" sort="Francis, Richard W" uniqKey="Francis R" first="Richard W" last="Francis">Richard W. Francis</name><affiliation><nlm:aff id="dyu188-AFF1">Telethon Kids Institute, University of Western Australia, Perth, WA, Australia,</nlm:aff></affiliation></author><author><name sortKey="Hiekkalinna, Tero" sort="Hiekkalinna, Tero" uniqKey="Hiekkalinna T" first="Tero" last="Hiekkalinna">Tero Hiekkalinna</name><affiliation><nlm:aff id="dyu188-AFF1">Institute for Molecular Medicine Finland (FIMM), University of Helsinki, Helsinki, Finland,</nlm:aff></affiliation><affiliation><nlm:aff id="dyu188-AFF1">Unit of Public Health Genomics, National Institute for Health and Welfare, Helsinki, Finland,</nlm:aff></affiliation></author><author><name sortKey="Hveem, Kristian" sort="Hveem, Kristian" uniqKey="Hveem K" first="Kristian" last="Hveem">Kristian Hveem</name><affiliation><nlm:aff id="dyu188-AFF1">Norwegian University of Science and Technology, Levanger, Norway,</nlm:aff></affiliation></author><author><name sortKey="Kval Y, Kirsti" sort="Kval Y, Kirsti" uniqKey="Kval Y K" first="Kirsti" last="Kval Y">Kirsti Kval Y</name><affiliation><nlm:aff id="dyu188-AFF1">Norwegian University of Science and Technology, Levanger, Norway,</nlm:aff></affiliation></author><author><name sortKey="Millar, Sean" sort="Millar, Sean" uniqKey="Millar S" first="Sean" last="Millar">Sean Millar</name><affiliation><nlm:aff id="dyu188-AFF1">HRB Centre for Diet and Health Research, Department of Epidemiology and Public Health, University College Cork, Cork, Ireland,</nlm:aff></affiliation></author><author><name sortKey="Perry, Ivan J" sort="Perry, Ivan J" uniqKey="Perry I" first="Ivan J" last="Perry">Ivan J. Perry</name><affiliation><nlm:aff id="dyu188-AFF1">HRB Centre for Diet and Health Research, Department of Epidemiology and Public Health, University College Cork, Cork, Ireland,</nlm:aff></affiliation></author><author><name sortKey="Peters, Annette" sort="Peters, Annette" uniqKey="Peters A" first="Annette" last="Peters">Annette Peters</name><affiliation><nlm:aff id="dyu188-AFF1">Research Unit of Molecular Epidemiology, Research Center for Environmental Health, Neuherberg, Germany,</nlm:aff></affiliation></author><author><name sortKey="Phillips, Catherine M" sort="Phillips, Catherine M" uniqKey="Phillips C" first="Catherine M" last="Phillips">Catherine M. Phillips</name><affiliation><nlm:aff id="dyu188-AFF1">HRB Centre for Diet and Health Research, Department of Epidemiology and Public Health, University College Cork, Cork, Ireland,</nlm:aff></affiliation></author><author><name sortKey="Popham, Frank" sort="Popham, Frank" uniqKey="Popham F" first="Frank" last="Popham">Frank Popham</name><affiliation><nlm:aff id="dyu188-AFF1">MRC/CSO Social and Public Health Sciences Unit, University of Glasgow, Glasgow, UK,</nlm:aff></affiliation></author><author><name sortKey="Raab, Gillian" sort="Raab, Gillian" uniqKey="Raab G" first="Gillian" last="Raab">Gillian Raab</name><affiliation><nlm:aff id="dyu188-AFF1">School of Geosciences, University of Edinburgh, Edinburgh, UK,</nlm:aff></affiliation></author><author><name sortKey="Reischl, Eva" sort="Reischl, Eva" uniqKey="Reischl E" first="Eva" last="Reischl">Eva Reischl</name><affiliation><nlm:aff id="dyu188-AFF1">Research Unit of Molecular Epidemiology, Research Center for Environmental Health, Neuherberg, Germany,</nlm:aff></affiliation></author><author><name sortKey="Sheehan, Nuala" sort="Sheehan, Nuala" uniqKey="Sheehan N" first="Nuala" last="Sheehan">Nuala Sheehan</name><affiliation><nlm:aff id="dyu188-AFF1">Department of Health Sciences, University of Leicester, Leicester, UK,</nlm:aff></affiliation></author><author><name sortKey="Waldenberger, Melanie" sort="Waldenberger, Melanie" uniqKey="Waldenberger M" first="Melanie" last="Waldenberger">Melanie Waldenberger</name><affiliation><nlm:aff id="dyu188-AFF1">Research Unit of Molecular Epidemiology, Research Center for Environmental Health, Neuherberg, Germany,</nlm:aff></affiliation></author><author><name sortKey="Perola, Markus" sort="Perola, Markus" uniqKey="Perola M" first="Markus" last="Perola">Markus Perola</name><affiliation><nlm:aff id="dyu188-AFF1">Institute for Molecular Medicine Finland (FIMM), University of Helsinki, Helsinki, Finland,</nlm:aff></affiliation><affiliation><nlm:aff id="dyu188-AFF1">Unit of Public Health Genomics, National Institute for Health and Welfare, Helsinki, Finland,</nlm:aff></affiliation><affiliation><nlm:aff id="dyu188-AFF1">University of Tartu, Estonian Genome Center, Tartu, Estonia,</nlm:aff></affiliation></author><author><name sortKey="Van Den Heuvel, Edwin" sort="Van Den Heuvel, Edwin" uniqKey="Van Den Heuvel E" first="Edwin" last="Van Den Heuvel">Edwin Van Den Heuvel</name><affiliation><nlm:aff id="dyu188-AFF1">University Medical Center Groningen, Medical Statistics, Groningen, The Netherlands,</nlm:aff></affiliation></author><author><name sortKey="Macleod, John" sort="Macleod, John" uniqKey="Macleod J" first="John" last="Macleod">John Macleod</name><affiliation><nlm:aff id="dyu188-AFF1">School of Social and Community Medicine, University of Bristol, Bristol, UK,</nlm:aff></affiliation></author><author><name sortKey="Knoppers, Bartha M" sort="Knoppers, Bartha M" uniqKey="Knoppers B" first="Bartha M" last="Knoppers">Bartha M. Knoppers</name><affiliation><nlm:aff id="dyu188-AFF1">Centre of Genomics and Policy, McGill University, Montreal, Canada,</nlm:aff></affiliation></author><author><name sortKey="Stolk, Ronald P" sort="Stolk, Ronald P" uniqKey="Stolk R" first="Ronald P" last="Stolk">Ronald P. Stolk</name><affiliation><nlm:aff id="dyu188-AFF1">Department of Epidemiology, University Medical Center Groningen, Groningen, The Netherlands,</nlm:aff></affiliation><affiliation><nlm:aff id="dyu188-AFF1">University Medical Center Groningen, LifeLines Cohort Study, Groningen, The Netherlands,</nlm:aff></affiliation></author><author><name sortKey="Fortier, Isabel" sort="Fortier, Isabel" uniqKey="Fortier I" first="Isabel" last="Fortier">Isabel Fortier</name><affiliation><nlm:aff id="dyu188-AFF1">Maelstrom Research Group, Research Institute of the McGill University Health Centre, McGill University, Montreal, Canada,</nlm:aff></affiliation></author><author><name sortKey="Harris, Jennifer R" sort="Harris, Jennifer R" uniqKey="Harris J" first="Jennifer R" last="Harris">Jennifer R. Harris</name><affiliation><nlm:aff id="dyu188-AFF1">Norwegian Institute of Public Health, Oslo, Norway,</nlm:aff></affiliation></author><author><name sortKey="Woffenbuttel, Bruce Hr" sort="Woffenbuttel, Bruce Hr" uniqKey="Woffenbuttel B" first="Bruce Hr" last="Woffenbuttel">Bruce Hr Woffenbuttel</name><affiliation><nlm:aff id="dyu188-AFF1">University Medical Center Groningen, LifeLines Cohort Study, Groningen, The Netherlands,</nlm:aff></affiliation><affiliation><nlm:aff id="dyu188-AFF1">Department of Endocrinology, University Medical Center Groningen, Groningen, The Netherlands,</nlm:aff></affiliation></author><author><name sortKey="Murtagh, Madeleine J" sort="Murtagh, Madeleine J" uniqKey="Murtagh M" first="Madeleine J" last="Murtagh">Madeleine J. Murtagh</name><affiliation><nlm:aff wicri:cut=" and" id="dyu188-AFF1">School of Social and Community Medicine, University of Bristol, Bristol, UK</nlm:aff></affiliation></author><author><name sortKey="Ferretti, Vincent" sort="Ferretti, Vincent" uniqKey="Ferretti V" first="Vincent" last="Ferretti">Vincent Ferretti</name><affiliation><nlm:aff id="dyu188-AFF1">Maelstrom Research Group, Research Institute of the McGill University Health Centre, McGill University, Montreal, Canada,</nlm:aff></affiliation><affiliation><nlm:aff id="dyu188-AFF1">Ontario Institute for Cancer Research, Toronto, Canada</nlm:aff></affiliation></author><author><name sortKey="Burton, Paul R" sort="Burton, Paul R" uniqKey="Burton P" first="Paul R" last="Burton">Paul R. Burton</name><affiliation><nlm:aff id="dyu188-AFF1">Maelstrom Research Group, Research Institute of the McGill University Health Centre, McGill University, Montreal, Canada,</nlm:aff></affiliation><affiliation><nlm:aff wicri:cut=" and" id="dyu188-AFF1">School of Social and Community Medicine, University of Bristol, Bristol, UK</nlm:aff></affiliation></author></analytic><series><title level="j">International Journal of Epidemiology</title><idno type="ISSN">0300-5771</idno><idno type="eISSN">1464-3685</idno><imprint><date when="2014">2014</date></imprint></series></biblStruct></sourceDesc></fileDesc><profileDesc><textClass></textClass></profileDesc></teiHeader><front><div type="abstract" xml:lang="en"><p><bold>Background:</bold> Research in modern biomedicine and social science requires sample sizes so large that they can often only be achieved through a pooled co-analysis of data from several studies. But the pooling of information from individuals in a central database that may be queried by researchers raises important ethico-legal questions and can be controversial. In the UK this has been highlighted by recent debate and controversy relating to the UK’s proposed ‘<italic>care.data</italic>’ initiative, and these issues reflect important societal and professional concerns about privacy, confidentiality and intellectual property. DataSHIELD provides a novel technological solution that can circumvent some of the most basic challenges in facilitating the access of researchers and other healthcare professionals to individual-level data.</p><p><bold>Methods:</bold> Commands are sent from a central analysis computer (AC) to several data computers (DCs) storing the data to be co-analysed. The data sets are analysed simultaneously but in parallel. The separate parallelized analyses are linked by non-disclosive summary statistics and commands transmitted back and forth between the DCs and the AC. This paper describes the technical implementation of DataSHIELD using a modified R statistical environment linked to an Opal database deployed behind the computer firewall of each DC. Analysis is controlled through a standard R environment at the AC.</p><p><bold>Results:</bold> Based on this Opal/R implementation, DataSHIELD is currently used by the Healthy Obese Project and the Environmental Core Project (BioSHaRE-EU) for the federated analysis of 10 data sets across eight European countries, and this illustrates the opportunities and challenges presented by the DataSHIELD approach.</p><p><bold>Conclusions:</bold> DataSHIELD facilitates important research in settings where: (i) a co-analysis of individual-level data from several studies is scientifically necessary but governance restrictions prohibit the release or sharing of some of the required data, and/or render data access unacceptably slow; (ii) a research group (e.g. in a developing nation) is particularly vulnerable to loss of intellectual property—the researchers want to fully share the information held in their data with national and international collaborators, but do not wish to hand over the physical data themselves; and (iii) a data set is to be included in an individual-level co-analysis but the physical size of the data precludes direct transfer to a new site for analysis.</p></div></front><back><div1 type="bibliography"><listBibl><biblStruct><analytic><author><name sortKey="Burton, Pr" uniqKey="Burton P">PR Burton</name></author><author><name sortKey="Tobin, Md" uniqKey="Tobin M">MD Tobin</name></author><author><name sortKey="Hopper, Jl" uniqKey="Hopper J">JL Hopper</name></author></analytic></biblStruct><biblStruct><analytic><author><name sortKey="Spencer, Cc" uniqKey="Spencer C">CC Spencer</name></author><author><name sortKey="Su, Z" uniqKey="Su Z">Z Su</name></author><author><name sortKey="Donnelly, P" uniqKey="Donnelly P">P Donnelly</name></author><author><name sortKey="Marchini, J" uniqKey="Marchini J">J Marchini</name></author></analytic></biblStruct><biblStruct><analytic><author><name sortKey="Zondervan, Kt" uniqKey="Zondervan K">KT Zondervan</name></author><author><name sortKey="Cardon, Lr" uniqKey="Cardon L">LR Cardon</name></author></analytic></biblStruct><biblStruct><analytic><author><name sortKey="Walport, M" uniqKey="Walport M">M Walport</name></author><author><name sortKey="Brest, P" uniqKey="Brest P">P Brest</name></author></analytic></biblStruct><biblStruct><analytic><author><name sortKey="Burton, Pr" uniqKey="Burton P">PR Burton</name></author><author><name sortKey="Hansell, Al" uniqKey="Hansell A">AL Hansell</name></author><author><name sortKey="Fortier, I" uniqKey="Fortier I">I Fortier</name></author></analytic></biblStruct><biblStruct><analytic><author><name sortKey="Gomatam, S" uniqKey="Gomatam S">S Gomatam</name></author><author><name sortKey="Karr, A" uniqKey="Karr A">A Karr</name></author><author><name sortKey="Reiter, J" uniqKey="Reiter J">J Reiter</name></author><author><name sortKey="Sanil, A" uniqKey="Sanil A">A Sanil</name></author></analytic></biblStruct><biblStruct><analytic><author><name sortKey="Hoeksma, J" uniqKey="Hoeksma J">J Hoeksma</name></author></analytic></biblStruct><biblStruct><analytic><author><name sortKey="Mccartney, M" uniqKey="Mccartney M">M McCartney</name></author></analytic></biblStruct><biblStruct><analytic><author><name sortKey="Demir, I" uniqKey="Demir I">I Demir</name></author><author><name sortKey="Murtagh, Mj" uniqKey="Murtagh M">MJ Murtagh</name></author></analytic></biblStruct><biblStruct></biblStruct><biblStruct><analytic><author><name sortKey="Ford, Dv" uniqKey="Ford D">DV Ford</name></author><author><name sortKey="Jones, Kh" uniqKey="Jones K">KH Jones</name></author><author><name sortKey="Verplancke, Jp" uniqKey="Verplancke J">JP Verplancke</name></author></analytic></biblStruct><biblStruct><analytic><author><name sortKey="Wolfson, M" uniqKey="Wolfson M">M Wolfson</name></author><author><name sortKey="Wallace, Se" uniqKey="Wallace S">SE Wallace</name></author><author><name sortKey="Masca, N" uniqKey="Masca N">N Masca</name></author></analytic></biblStruct><biblStruct><analytic><author><name sortKey="Newton Cheh, C" uniqKey="Newton Cheh C">C Newton-Cheh</name></author><author><name sortKey="Johnson, T" uniqKey="Johnson T">T Johnson</name></author><author><name sortKey="Gateva, V" uniqKey="Gateva V">V Gateva</name></author></analytic></biblStruct><biblStruct><analytic><author><name sortKey="Repapi, E" uniqKey="Repapi E">E Repapi</name></author><author><name sortKey="Sayers, I" uniqKey="Sayers I">I Sayers</name></author><author><name sortKey="Wain, Lv" uniqKey="Wain L">LV Wain</name></author></analytic></biblStruct><biblStruct><analytic><author><name sortKey="Zeggini, E" uniqKey="Zeggini E">E Zeggini</name></author><author><name sortKey="Weedon, Mn" uniqKey="Weedon M">MN Weedon</name></author><author><name sortKey="Lindgren, Cm" uniqKey="Lindgren C">CM Lindgren</name></author></analytic></biblStruct><biblStruct><analytic><author><name sortKey="Petitti, Db" uniqKey="Petitti D">DB Petitti</name></author></analytic></biblStruct><biblStruct><analytic><author><name sortKey="Sutton, Aj" uniqKey="Sutton A">AJ Sutton</name></author><author><name sortKey="Kendrick, D" uniqKey="Kendrick D">D Kendrick</name></author><author><name sortKey="Coupland, Ca" uniqKey="Coupland C">CA Coupland</name></author></analytic></biblStruct><biblStruct><analytic><author><name sortKey="Burman, W" uniqKey="Burman W">W Burman</name></author><author><name sortKey="Daum, R" uniqKey="Daum R">R Daum</name></author><author><name sortKey="Janoff, E" uniqKey="Janoff E">E Janoff</name></author></analytic></biblStruct><biblStruct><analytic><author><name sortKey="Malfroy, M" uniqKey="Malfroy M">M Malfroy</name></author><author><name sortKey="Llewelyn, Ca" uniqKey="Llewelyn C">CA Llewelyn</name></author><author><name sortKey="Johnson, T" uniqKey="Johnson T">T Johnson</name></author><author><name sortKey="Williamson, Lm" uniqKey="Williamson L">LM Williamson</name></author></analytic></biblStruct><biblStruct><analytic><author><name sortKey="Burton, P" uniqKey="Burton P">P Burton</name></author><author><name sortKey="Wolfson, M" uniqKey="Wolfson M">M Wolfson</name></author><author><name sortKey="Masca, N" uniqKey="Masca N">N Masca</name></author><author><name sortKey="Fortier, I" uniqKey="Fortier I">I Fortier</name></author></analytic></biblStruct><biblStruct><analytic><author><name sortKey="Wallace, Se" uniqKey="Wallace S">SE Wallace</name></author><author><name sortKey="Gaye, A" uniqKey="Gaye A">A Gaye</name></author><author><name sortKey="Shoush, O" uniqKey="Shoush O">O Shoush</name></author><author><name sortKey="Burton, Pr" uniqKey="Burton P">PR Burton</name></author></analytic></biblStruct><biblStruct><analytic><author><name sortKey="Jones, Em" uniqKey="Jones E">EM Jones</name></author><author><name sortKey="Sheehan, Na" uniqKey="Sheehan N">NA Sheehan</name></author><author><name sortKey="Masca, N" uniqKey="Masca N">N Masca</name></author><author><name sortKey="Wallace, Se" uniqKey="Wallace S">SE Wallace</name></author><author><name sortKey="Murtagh, Mj" uniqKey="Murtagh M">MJ Murtagh</name></author><author><name sortKey="Burton, Pr" uniqKey="Burton P">PR Burton</name></author></analytic></biblStruct><biblStruct><analytic><author><name sortKey="Jones, Em" uniqKey="Jones E">EM Jones</name></author><author><name sortKey="Sheehan, Na" uniqKey="Sheehan N">NA Sheehan</name></author><author><name sortKey="Gaye, A" uniqKey="Gaye A">A Gaye</name></author><author><name sortKey="Laflamme, P" uniqKey="Laflamme P">P Laflamme</name></author><author><name sortKey="Burton, P" uniqKey="Burton P">P Burton</name></author></analytic></biblStruct><biblStruct><analytic><author><name sortKey="Murtagh, Mj" uniqKey="Murtagh M">MJ Murtagh</name></author><author><name sortKey="Demir, I" uniqKey="Demir I">I Demir</name></author><author><name sortKey="Jenkings, Kn" uniqKey="Jenkings K">KN Jenkings</name></author></analytic></biblStruct><biblStruct></biblStruct><biblStruct><analytic><author><name sortKey="Wallace, Se" uniqKey="Wallace S">SE Wallace</name></author></analytic></biblStruct><biblStruct><analytic><author><name sortKey="Doiron, D" uniqKey="Doiron D">D Doiron</name></author><author><name sortKey="Burton, P" uniqKey="Burton P">P Burton</name></author><author><name sortKey="Marcon, Y" uniqKey="Marcon Y">Y Marcon</name></author></analytic></biblStruct><biblStruct></biblStruct><biblStruct><analytic><author><name sortKey="Ihaka, R" uniqKey="Ihaka R">R Ihaka</name></author><author><name sortKey="Gentleman, R" uniqKey="Gentleman R">R Gentleman</name></author></analytic></biblStruct><biblStruct></biblStruct><biblStruct></biblStruct><biblStruct></biblStruct><biblStruct></biblStruct><biblStruct><analytic><author><name sortKey="Fortier, I" uniqKey="Fortier I">I Fortier</name></author><author><name sortKey="Burton, Pr" uniqKey="Burton P">PR Burton</name></author><author><name sortKey="Robson, Pj" uniqKey="Robson P">PJ Robson</name></author></analytic></biblStruct><biblStruct><analytic><author><name sortKey="Fortier, I" uniqKey="Fortier I">I Fortier</name></author><author><name sortKey="Doiron, D" uniqKey="Doiron D">D Doiron</name></author><author><name sortKey="Little, J" uniqKey="Little J">J Little</name></author></analytic></biblStruct><biblStruct><analytic><author><name sortKey="Kuk, A" uniqKey="Kuk A">A Kuk</name></author><author><name sortKey="Cheng, Y" uniqKey="Cheng Y">Y Cheng</name></author></analytic></biblStruct><biblStruct></biblStruct><biblStruct><analytic><author><name sortKey="Power, C" uniqKey="Power C">C Power</name></author><author><name sortKey="Elliott, J" uniqKey="Elliott J">J Elliott</name></author></analytic></biblStruct><biblStruct><analytic><author><name sortKey="Wichmann, H" uniqKey="Wichmann H">H Wichmann</name></author><author><name sortKey="Gieger, C" uniqKey="Gieger C">C Gieger</name></author><author><name sortKey="Illig, T" uniqKey="Illig T">T Illig</name></author></analytic></biblStruct><biblStruct><analytic><author><name sortKey="Stolk, Rp" uniqKey="Stolk R">RP Stolk</name></author><author><name sortKey="Rosmalen, Jg" uniqKey="Rosmalen J">JG Rosmalen</name></author><author><name sortKey="Postma, Ds" uniqKey="Postma D">DS Postma</name></author></analytic></biblStruct><biblStruct><analytic><author><name sortKey="Kearney, Pm" uniqKey="Kearney P">PM Kearney</name></author><author><name sortKey="Harrington, Jm" uniqKey="Harrington J">JM Harrington</name></author><author><name sortKey="Mc Carthy, Vj" uniqKey="Mc Carthy V">VJ Mc Carthy</name></author><author><name sortKey="Fitzgerald, Ap" uniqKey="Fitzgerald A">AP Fitzgerald</name></author><author><name sortKey="Perry, Ij" uniqKey="Perry I">IJ Perry</name></author></analytic></biblStruct><biblStruct></biblStruct><biblStruct><analytic><author><name sortKey="Gaye, A" uniqKey="Gaye A">A Gaye</name></author><author><name sortKey="Burton, Wy" uniqKey="Burton W">WY Burton</name></author></analytic></biblStruct><biblStruct><analytic><author><name sortKey="Breslow, N" uniqKey="Breslow N">N Breslow</name></author><author><name sortKey="Clayton, D" uniqKey="Clayton D">D Clayton</name></author></analytic></biblStruct><biblStruct><analytic><author><name sortKey="Goldstein, H" uniqKey="Goldstein H">H Goldstein</name></author></analytic></biblStruct><biblStruct><analytic><author><name sortKey="Burton, P" uniqKey="Burton P">P Burton</name></author><author><name sortKey="Gurrin, L" uniqKey="Gurrin L">L Gurrin</name></author><author><name sortKey="Sly, P" uniqKey="Sly P">P Sly</name></author></analytic></biblStruct><biblStruct><analytic><author><name sortKey="Cox, Dr" uniqKey="Cox D">DR Cox</name></author></analytic></biblStruct><biblStruct><analytic><author><name sortKey="Nietfeld, Jj" uniqKey="Nietfeld J">JJ Nietfeld</name></author><author><name sortKey="Sugarman, J" uniqKey="Sugarman J">J Sugarman</name></author><author><name sortKey="Litton, Je" uniqKey="Litton J">JE Litton</name></author></analytic></biblStruct><biblStruct><analytic><author><name sortKey="Hanson, B" uniqKey="Hanson B">B Hanson</name></author><author><name sortKey="Sugden, A" uniqKey="Sugden A">A Sugden</name></author><author><name sortKey="Alberts, B" uniqKey="Alberts B">B Alberts</name></author></analytic></biblStruct><biblStruct><analytic><author><name sortKey="Trifir, G" uniqKey="Trifir G">G Trifirò</name></author><author><name sortKey="Coloma, P" uniqKey="Coloma P">P Coloma</name></author><author><name sortKey="Rijnbeek, P" uniqKey="Rijnbeek P">P Rijnbeek</name></author></analytic></biblStruct><biblStruct></biblStruct><biblStruct></biblStruct><biblStruct></biblStruct><biblStruct></biblStruct><biblStruct></biblStruct><biblStruct><analytic><author><name sortKey="Kahn, Sd" uniqKey="Kahn S">SD Kahn</name></author></analytic></biblStruct></listBibl></div1></back></TEI><pmc article-type="research-article"><pmc-dir>properties open_access</pmc-dir>
<front><journal-meta><journal-id journal-id-type="nlm-ta">Int J Epidemiol</journal-id><journal-id journal-id-type="iso-abbrev">Int J Epidemiol</journal-id><journal-id journal-id-type="publisher-id">ije</journal-id><journal-id journal-id-type="hwp">intjepid</journal-id><journal-title-group><journal-title>International Journal of Epidemiology</journal-title></journal-title-group><issn pub-type="ppub">0300-5771</issn><issn pub-type="epub">1464-3685</issn><publisher><publisher-name>Oxford University Press</publisher-name></publisher></journal-meta><article-meta><article-id pub-id-type="pmid">25261970</article-id><article-id pub-id-type="pmc">4276062</article-id><article-id pub-id-type="doi">10.1093/ije/dyu188</article-id><article-id pub-id-type="publisher-id">dyu188</article-id><article-categories><subj-group subj-group-type="heading"><subject>Data Matters</subject></subj-group></article-categories><title-group><article-title>DataSHIELD: taking the analysis to the data, not the data to the analysis</article-title></title-group><contrib-group><contrib contrib-type="author"><name><surname>Gaye</surname><given-names>Amadou</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>1</sup></xref></contrib><contrib contrib-type="author"><name><surname>Marcon</surname><given-names>Yannick</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>2</sup></xref></contrib><contrib contrib-type="author"><name><surname>Isaeva</surname><given-names>Julia</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>3</sup></xref></contrib><contrib contrib-type="author"><name><surname>LaFlamme</surname><given-names>Philippe</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>2</sup></xref></contrib><contrib contrib-type="author"><name><surname>Turner</surname><given-names>Andrew</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>1</sup></xref></contrib><contrib contrib-type="author"><name><surname>Jones</surname><given-names>Elinor M</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>4</sup></xref></contrib><contrib contrib-type="author"><name><surname>Minion</surname><given-names>Joel</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>1</sup></xref></contrib><contrib contrib-type="author"><name><surname>Boyd</surname><given-names>Andrew W</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>1</sup></xref></contrib><contrib contrib-type="author"><name><surname>Newby</surname><given-names>Christopher J</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>5</sup></xref></contrib><contrib contrib-type="author"><name><surname>Nuotio</surname><given-names>Marja-Liisa</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>6</sup></xref><xref ref-type="aff" rid="dyu188-AFF1"><sup>7</sup></xref></contrib><contrib contrib-type="author"><name><surname>Wilson</surname><given-names>Rebecca</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>1</sup></xref></contrib><contrib contrib-type="author"><name><surname>Butters</surname><given-names>Oliver</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>1</sup></xref></contrib><contrib contrib-type="author"><name><surname>Murtagh</surname><given-names>Barnaby</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>8</sup></xref></contrib><contrib contrib-type="author"><name><surname>Demir</surname><given-names>Ipek</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>9</sup></xref></contrib><contrib contrib-type="author"><name><surname>Doiron</surname><given-names>Dany</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>2</sup></xref></contrib><contrib contrib-type="author"><name><surname>Giepmans</surname><given-names>Lisette</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>10</sup></xref></contrib><contrib contrib-type="author"><name><surname>Wallace</surname><given-names>Susan E</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>8</sup></xref></contrib><contrib contrib-type="author"><name><surname>Budin-Ljøsne</surname><given-names>Isabelle</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>3</sup></xref></contrib><contrib contrib-type="author"><name><surname>Oliver Schmidt</surname><given-names>Carsten</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>11</sup></xref></contrib><contrib contrib-type="author"><name><surname>Boffetta</surname><given-names>Paolo</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>12</sup></xref></contrib><contrib contrib-type="author"><name><surname>Boniol</surname><given-names>Mathieu</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>12</sup></xref></contrib><contrib contrib-type="author"><name><surname>Bota</surname><given-names>Maria</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>12</sup></xref></contrib><contrib contrib-type="author"><name><surname>Carter</surname><given-names>Kim W</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>13</sup></xref></contrib><contrib contrib-type="author"><name><surname>deKlerk</surname><given-names>Nick</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>13</sup></xref></contrib><contrib contrib-type="author"><name><surname>Dibben</surname><given-names>Chris</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>14</sup></xref></contrib><contrib contrib-type="author"><name><surname>Francis</surname><given-names>Richard W</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>13</sup></xref></contrib><contrib contrib-type="author"><name><surname>Hiekkalinna</surname><given-names>Tero</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>6</sup></xref><xref ref-type="aff" rid="dyu188-AFF1"><sup>7</sup></xref></contrib><contrib contrib-type="author"><name><surname>Hveem</surname><given-names>Kristian</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>15</sup></xref></contrib><contrib contrib-type="author"><name><surname>Kvaløy</surname><given-names>Kirsti</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>15</sup></xref></contrib><contrib contrib-type="author"><name><surname>Millar</surname><given-names>Sean</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>16</sup></xref></contrib><contrib contrib-type="author"><name><surname>Perry</surname><given-names>Ivan J</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>16</sup></xref></contrib><contrib contrib-type="author"><name><surname>Peters</surname><given-names>Annette</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>17</sup></xref></contrib><contrib contrib-type="author"><name><surname>Phillips</surname><given-names>Catherine M</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>16</sup></xref></contrib><contrib contrib-type="author"><name><surname>Popham</surname><given-names>Frank</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>18</sup></xref></contrib><contrib contrib-type="author"><name><surname>Raab</surname><given-names>Gillian</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>14</sup></xref></contrib><contrib contrib-type="author"><name><surname>Reischl</surname><given-names>Eva</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>17</sup></xref></contrib><contrib contrib-type="author"><name><surname>Sheehan</surname><given-names>Nuala</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>8</sup></xref></contrib><contrib contrib-type="author"><name><surname>Waldenberger</surname><given-names>Melanie</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>17</sup></xref></contrib><contrib contrib-type="author"><name><surname>Perola</surname><given-names>Markus</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>6</sup></xref><xref ref-type="aff" rid="dyu188-AFF1"><sup>7</sup></xref><xref ref-type="aff" rid="dyu188-AFF1"><sup>19</sup></xref></contrib><contrib contrib-type="author"><name><surname>van den Heuvel</surname><given-names>Edwin</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>20</sup></xref></contrib><contrib contrib-type="author"><name><surname>Macleod</surname><given-names>John</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>1</sup></xref></contrib><contrib contrib-type="author"><name><surname>Knoppers</surname><given-names>Bartha M</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>21</sup></xref></contrib><contrib contrib-type="author"><name><surname>Stolk</surname><given-names>Ronald P</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>10</sup></xref><xref ref-type="aff" rid="dyu188-AFF1"><sup>22</sup></xref></contrib><contrib contrib-type="author"><name><surname>Fortier</surname><given-names>Isabel</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>2</sup></xref></contrib><contrib contrib-type="author"><name><surname>Harris</surname><given-names>Jennifer R</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>3</sup></xref></contrib><contrib contrib-type="author"><name><surname>Woffenbuttel</surname><given-names>Bruce HR</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>22</sup></xref><xref ref-type="aff" rid="dyu188-AFF1"><sup>23</sup></xref></contrib><contrib contrib-type="author"><name><surname>Murtagh</surname><given-names>Madeleine J</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>24</sup></xref><xref ref-type="author-notes" rid="dyu188-FN1"><sup>†</sup></xref></contrib><contrib contrib-type="author"><name><surname>Ferretti</surname><given-names>Vincent</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>2</sup></xref><xref ref-type="aff" rid="dyu188-AFF1"><sup>25</sup></xref><xref ref-type="author-notes" rid="dyu188-FN1"><sup>†</sup></xref></contrib><contrib contrib-type="author"><name><surname>Burton</surname><given-names>Paul R</given-names></name><xref ref-type="aff" rid="dyu188-AFF1"><sup>2</sup></xref><xref ref-type="aff" rid="dyu188-AFF1"><sup>24</sup></xref><xref ref-type="author-notes" rid="dyu188-FN1"><sup>†</sup></xref><xref ref-type="corresp" rid="dyu188-COR1">*</xref></contrib><aff id="dyu188-AFF1"><sup>1</sup>School of Social and Community Medicine, University of Bristol, Bristol, UK,<sup>2</sup>Maelstrom Research Group, Research Institute of the McGill University Health Centre, McGill University, Montreal, Canada,<sup>3</sup>Norwegian Institute of Public Health, Oslo, Norway,<sup>4</sup>Department Statistical Science, University College London, London, UK,<sup>5</sup>Department of Infection, Immunity and Inflammation, Health Sciences, University of Leicester, Leicester, UK,<sup>6</sup>Institute for Molecular Medicine Finland (FIMM), University of Helsinki, Helsinki, Finland,<sup>7</sup>Unit of Public Health Genomics, National Institute for Health and Welfare, Helsinki, Finland,<sup>8</sup>Department of Health Sciences, University of Leicester, Leicester, UK,<sup>9</sup>Department of Sociology, University of Leicester, Leicester, UK,<sup>10</sup>Department of Epidemiology, University Medical Center Groningen, Groningen, The Netherlands,<sup>11</sup>Institut für Community Medicine, University Medicine of Greifswald, Greifswald, Germany,<sup>12</sup>International Prevention Research Institute, Lyon, France,<sup>13</sup>Telethon Kids Institute, University of Western Australia, Perth, WA, Australia,<sup>14</sup>School of Geosciences, University of Edinburgh, Edinburgh, UK,<sup>15</sup>Norwegian University of Science and Technology, Levanger, Norway,<sup>16</sup>HRB Centre for Diet and Health Research, Department of Epidemiology and Public Health, University College Cork, Cork, Ireland,<sup>17</sup>Research Unit of Molecular Epidemiology, Research Center for Environmental Health, Neuherberg, Germany,<sup>18</sup>MRC/CSO Social and Public Health Sciences Unit, University of Glasgow, Glasgow, UK,<sup>19</sup>University of Tartu, Estonian Genome Center, Tartu, Estonia,<sup>20</sup>University Medical Center Groningen, Medical Statistics, Groningen, The Netherlands,<sup>21</sup>Centre of Genomics and Policy, McGill University, Montreal, Canada,<sup>22</sup>University Medical Center Groningen, LifeLines Cohort Study, Groningen, The Netherlands,<sup>23</sup>Department of Endocrinology, University Medical Center Groningen, Groningen, The Netherlands,<sup>24</sup>School of Social and Community Medicine, University of Bristol, Bristol, UK and<sup>25</sup>Ontario Institute for Cancer Research, Toronto, Canada</aff></contrib-group><author-notes><corresp id="dyu188-COR1">*Corresponding author. E-mail: <email>paul.burton@bristol.ac.uk</email></corresp><fn id="dyu188-FN1"><p><sup>†</sup>These authors contributed equally to this work.</p></fn></author-notes><pub-date pub-type="ppub"><month>12</month><year>2014</year></pub-date><pub-date pub-type="epub"><day>27</day><month>9</month><year>2014</year></pub-date><pub-date pub-type="pmc-release"><day>27</day><month>9</month><year>2014</year></pub-date><pmc-comment> PMC Release delay is 0 months and 0 days and was based on the
<volume>43</volume><issue>6</issue><fpage>1929</fpage><lpage>1944</lpage><history><date date-type="accepted"><day>15</day><month>8</month><year>2014</year></date></history><permissions><copyright-statement>© The Author 2014; all rights reserved. Published by Oxford University Press on behalf of the International Epidemiological Association</copyright-statement><copyright-year>2014</copyright-year><license xlink:href="http://creativecommons.org/licenses/by-nc/4.0/" license-type="creative-commons"><license-p>This is an Open Access article distributed under the terms of the Creative Commons Attribution Non-Commercial License (<ext-link ext-link-type="uri" xlink:href="http://creativecommons.org/licenses/by-nc/4.0/">http://creativecommons.org/licenses/by-nc/4.0/</ext-link>), which permits non-commercial re-use, distribution, and reproduction in any medium, provided the original work is properly cited. For commercial re-use, please contact journals.permissions@oup.com</license-p></license></permissions><abstract><p><bold>Background:</bold> Research in modern biomedicine and social science requires sample sizes so large that they can often only be achieved through a pooled co-analysis of data from several studies. But the pooling of information from individuals in a central database that may be queried by researchers raises important ethico-legal questions and can be controversial. In the UK this has been highlighted by recent debate and controversy relating to the UK’s proposed ‘<italic>care.data</italic>’ initiative, and these issues reflect important societal and professional concerns about privacy, confidentiality and intellectual property. DataSHIELD provides a novel technological solution that can circumvent some of the most basic challenges in facilitating the access of researchers and other healthcare professionals to individual-level data.</p><p><bold>Methods:</bold> Commands are sent from a central analysis computer (AC) to several data computers (DCs) storing the data to be co-analysed. The data sets are analysed simultaneously but in parallel. The separate parallelized analyses are linked by non-disclosive summary statistics and commands transmitted back and forth between the DCs and the AC. This paper describes the technical implementation of DataSHIELD using a modified R statistical environment linked to an Opal database deployed behind the computer firewall of each DC. Analysis is controlled through a standard R environment at the AC.</p><p><bold>Results:</bold> Based on this Opal/R implementation, DataSHIELD is currently used by the Healthy Obese Project and the Environmental Core Project (BioSHaRE-EU) for the federated analysis of 10 data sets across eight European countries, and this illustrates the opportunities and challenges presented by the DataSHIELD approach.</p><p><bold>Conclusions:</bold> DataSHIELD facilitates important research in settings where: (i) a co-analysis of individual-level data from several studies is scientifically necessary but governance restrictions prohibit the release or sharing of some of the required data, and/or render data access unacceptably slow; (ii) a research group (e.g. in a developing nation) is particularly vulnerable to loss of intellectual property—the researchers want to fully share the information held in their data with national and international collaborators, but do not wish to hand over the physical data themselves; and (iii) a data set is to be included in an individual-level co-analysis but the physical size of the data precludes direct transfer to a new site for analysis.</p></abstract><kwd-group><kwd>DataSHIELD</kwd><kwd>pooled analysis</kwd><kwd>ELSI</kwd><kwd>privacy</kwd><kwd>confidentiality</kwd><kwd>disclosure</kwd><kwd>distributed computing</kwd><kwd>intellectual property</kwd><kwd>bioinformatics</kwd></kwd-group><counts><page-count count="16"></page-count></counts></article-meta></front><body><boxed-text id="dyu188-BOX1" position="float"><caption><title>Key Messages</title></caption><p><list list-type="bullet"><list-item><p>DataSHIELD provides a solution when ethico-legal considerations prevent or impede data-sharing and analysis.</p></list-item><list-item><p>It promotes and facilitates collaborations by empowering data owners and affording them better control over their data.</p></list-item><list-item><p>DataSHIELD has the potential to protect the intellectual property of researchers in institutions and countries with limited resources, thus enabling more balanced collaborations with wealthier partners.</p></list-item><list-item><p>It also improves the governance and management of data by allowing them to be maintained locally.</p></list-item></list></p></boxed-text><sec sec-type="intro"><title>Introduction</title><p>The analysis of complex interrelated datasets containing demographic, social, health-related and/or biological information derived from large numbers of individuals has become pivotal to the investigation of disease causation and to the evaluation of healthcare programmes and interventions. However, the daunting sample sizes needed to provide adequate statistical power<xref rid="dyu188-B1" ref-type="bibr"><sup>1–3</sup></xref> often exceed the provision of any one single study. Furthermore, if major research funders are to optimize return on their investment of public or charitable money, it is crucial that researchers other than those who originally created a particular data set are able to access and work with those data.<xref rid="dyu188-B4" ref-type="bibr"><sup>4</sup></xref> These two imperatives underpin the active encouragement of ‘data sharing’—across several studies, or from a single data source—which is central to contemporary bioscience.<xref rid="dyu188-B5" ref-type="bibr"><sup>5</sup></xref> The data to be shared may be derived from large epidemiological studies, from smaller research projects and/or from healthcare or administrative records. They may originally have been intended for research or for direct support of patient care or public health. There is no doubt that liberating and integrating such information to support medical research has the potential to generate enormous future health benefits. But substantive challenges exist, and the sharing of data—particularly individual-level data, also known as <italic>microdata</italic><xref rid="dyu188-B6" ref-type="bibr"><sup>6</sup></xref>—raises important societal and professional concerns.</p><p>In the UK, these concerns were recently highlighted by controversy surrounding the <italic>care.data</italic> project.<xref rid="dyu188-B7" ref-type="bibr"><sup>7</sup></xref><sup>,</sup><xref rid="dyu188-B8" ref-type="bibr"><sup>8</sup></xref> At a societal level they include real and perceived frailties of information governance when a research database containing potentially sensitive personal information about individuals is made accessible to any third party including researchers.<xref rid="dyu188-B4" ref-type="bibr"><sup>4</sup></xref> However, these broader societal concerns are closely—though not precisely—mirrored in the disquiet of some professional health researchers regarding the unfettered sharing of valuable scientific data that they believe exist primarily because they have made a substantial investment of their own time, effort and scientific thought to creating and managing them. In both instances, individuals for whom the data to be shared are valuable and potentially sensitive (personally, or as intellectual property) worry that, once they have been physically ‘shared’, there will be a significant loss of control over their subsequent exploitation. In support of this thesis, we have noted<xref rid="dyu188-B9" ref-type="bibr"><sup>9</sup></xref> that researchers are often more than willing to share the information contained in their data—because this enhances the quality and quantity of their own scientific output by providing opportunities for national and international collaboration. But they are sometimes less keen to hand over the physical data themselves,<xref rid="dyu188-B9" ref-type="bibr"><sup>9</sup></xref> because even with ethically and legally binding safeguards in place, the loss of governance control over the data themselves and the intellectual property they represent can be seen as seriously problematic. This is particularly so for data creators with limited resources for managing and scientifically exploiting their own data—e.g. researchers in developing countries. Effective and acceptable solutions must be found to all of these problems if we are to optimize evidence-based progress in stratified and conventional medicine.</p><p>Many technical and policy measures can be enacted to render data sharing more secure from a governance perspective and less likely to result in loss of intellectual property. For example, data owners might restrict data release to aggregate statistics alone, or may limit the number of variables that individual researchers might access for specified purposes. Alternatively, secure analysis centres, such as the ESRC Secure Data Service,<xref rid="dyu188-B10" ref-type="bibr"><sup>10</sup></xref> and SAIL,<xref rid="dyu188-B11" ref-type="bibr"><sup>11</sup></xref> represent major informatics infrastructures that can provide a safe haven for remote or local analysis/linkage of data from selected sources while preventing researchers from downloading the original data themselves. However, to complement pre-existing solutions to the important challenges now faced, the DataSHIELD consortium has developed a flexible new way to comprehensively analyse individual-level data collected across several studies or sources while keeping the original data strictly secure. As a technology, DataSHIELD uses distributed computing and parallelized analysis to enable full joint analysis of individual-level data from several sources—e.g. research projects or health or administrative data—without the need for those data to move, or even be seen, outside the study where they usually reside.<xref rid="dyu188-B12" ref-type="bibr"><sup>12</sup></xref> Crucially, because it does not require underpinning by a major informatics infrastructure and because it is based on non-commercial open source software, it is both locally implementable and very cost effective.</p><p>Co-analysis of data from several studies/sources is often conducted using study-level meta-analysis (SLMA),<xref rid="dyu188-B13" ref-type="bibr"><sup>13–15</sup></xref> using conventional meta-analysis to combine results generated by each study separately.<xref rid="dyu188-B16" ref-type="bibr"><sup>16</sup></xref><sup>,</sup><xref rid="dyu188-B17" ref-type="bibr"><sup>17</sup></xref> In contrast, individual-level meta-analysis (ILMA)involves the physical transfer of data from each study to produce a single central database that is then analysed as if it were a conventional multi-centre data set.<xref rid="dyu188-B16" ref-type="bibr"><sup>16</sup></xref><sup>,</sup><xref rid="dyu188-B17" ref-type="bibr"><sup>17</sup></xref> Unfortunately, both SLMA and ILMA present significant problems.<xref rid="dyu188-B12" ref-type="bibr"><sup>12</sup></xref><sup>,</sup><xref rid="dyu188-B16" ref-type="bibr"><sup>16</sup></xref><sup>,</sup><xref rid="dyu188-B17" ref-type="bibr"><sup>17</sup></xref> Because SLMA combines analytical results (e.g. means, odds ratios, regression coefficients) produced ahead of time by the contributing studies, it can be very inflexible: only the pre-planned analyses undertaken by all the studies can be converted into joint results across all studies combined. Any additional analyses must be requested <italic>post hoc</italic>. This hinders exploratory analysis,<xref rid="dyu188-B16" ref-type="bibr"><sup>16</sup></xref> for example the investigation of sub-groups, or interactions between key variables. In contrast, ILMA is very flexible, but ethico-legal considerations can impede access to individual-level data. Thus, research may be delayed if formal data access procedures are protracted, or may have to be postponed while participants have reconsented.<xref rid="dyu188-B18" ref-type="bibr"><sup>18</sup></xref><sup>,</sup><xref rid="dyu188-B19" ref-type="bibr"><sup>19</sup></xref> ILMA may even be impossible if consent forms prohibit individual-level data being sent to external researchers, or if privacy legislation precludes sharing of data across national or jurisdictional boundaries.<xref rid="dyu188-B12" ref-type="bibr"><sup>12</sup></xref><sup>,</sup><xref rid="dyu188-B20" ref-type="bibr"><sup>20</sup></xref><sup>,</sup><xref rid="dyu188-B21" ref-type="bibr"><sup>21</sup></xref></p><p>DataSHIELD circumvents these problems. First, it can be set up to be mathematically equivalent to ILMA,<xref rid="dyu188-B12" ref-type="bibr"><sup>12</sup></xref><sup>,</sup><xref rid="dyu188-B22" ref-type="bibr"><sup>22</sup></xref><sup>,</sup><xref rid="dyu188-B23" ref-type="bibr"><sup>23</sup></xref> while avoiding the attendant governance, legal or societal concerns.<xref rid="dyu188-B21" ref-type="bibr"><sup>21</sup></xref><sup>,</sup><xref rid="dyu188-B24" ref-type="bibr"><sup>24</sup></xref> Individual-level data never cross, and are never visible outside, the firewall of their home study.<xref rid="dyu188-B12" ref-type="bibr"><sup>12</sup></xref><sup>,</sup><xref rid="dyu188-B20" ref-type="bibr"><sup>20</sup></xref><sup>,</sup><xref rid="dyu188-B24" ref-type="bibr"><sup>24</sup></xref> Jones <italic>et al.</italic><xref rid="dyu188-B22" ref-type="bibr"><sup>22</sup></xref> explain why fitting a generalized linear model (GLM) under DataSHIELD produces exactly the same results—not just a good approximation—as a GLM fitted to a single database containing the individual-level data from all studies combined. This is confirmed empirically in the current article by the comparison of the output of a GLM model fitted initially via DataSHIELD on all studies separately, and then through R on the pooled data (i.e. the separate data sets stacked together into one table). Second, however, DataSHIELD can also be configured to mimic a secure SLMA but without the need to ask individual studies to undertake their own analyses. Under DataSHIELD, any non-disclosive analysis may therefore be requested at any time without physically sharing data. DataSHIELD can also protect intellectual property when data producers are keen for external researchers to query and work with their data but do not wish to lose ultimate control by physically transferring their data. This can even apply to a single study—single-site DataSHIELD—which may be viewed as being a particularly simple and cost-effective way to construct a ‘secure data enclave’ within which data can be comprehensively analysed but not accessed. For all of these reasons, DataSHIELD encourages ‘true’, equal-status collaboration.</p><p><xref ref-type="fig" rid="dyu188-F1">Figure 1</xref> illustrates the basic IT infrastructure for a hypothetical DataSHIELD implementation for co-analysing six studies. The individual-level data themselves remain on ‘data computers’ (DCs) at their home bases. A central ‘analysis computer’ (AC) is used to issue commands to enact and control the analysis. As a by-product of its underlying structure, DataSHIELD can enhance governance and data management because data are locally maintained by their producers who typically know them best; that is, it encourages storage, updating and sharing of complex multi-class data from ongoing studies through a federated rather than a centralized architecture. However, this does not deny the important complementary role of large centralized repositories specializing in archiving particular classes of data, such as the European Genome-Phenome Archive<xref rid="dyu188-B25" ref-type="bibr"><sup>25</sup></xref> or the UK Data Service.<xref rid="dyu188-B10" ref-type="bibr"><sup>10</sup></xref> As an additional consequence of its structure, DataSHIELD can also avoid the need to move very large data sets. Finally, because all data remain unobserved at their home repository, DataSHIELD can mitigate some of the dilemmas arising from findings of actionable clinical significance in individuals.<xref rid="dyu188-B26" ref-type="bibr"><sup>26</sup></xref> Specifically, external researchers cannot, in principle, produce results pertaining to individual participants. Rather, individual clinical results can only be generated by investigators working with data from their own study and these investigators should be covered by formal internal policies.
<fig id="dyu188-F1" position="float"><label>Figure 1.</label><caption><p>Typical DataSHIELD setting for a pooled individual-level analysis.</p></caption><graphic xlink:href="dyu188f1p"></graphic></fig></p><p>DataSHIELD offers both opportunities and challenges. It has been known for several years that it works in principle,<xref rid="dyu188-B12" ref-type="bibr"><sup>12</sup></xref><sup>,</sup><xref rid="dyu188-B22" ref-type="bibr"><sup>22</sup></xref> but its practical implementation and utilization on an IT platform that can be used by non-expert researchers has proved to be challenging. This paper describes the application platform that has now been developed. It explains each of the fundamental steps in a typical DataSHIELD analysis and outlines the key elements of the infrastructure that underpins these steps. Illustration is based on a real-world setting in which DataSHIELD is currently being used to analyse data for a pan-European consortium: the Healthy Obese Project (HOP).<xref rid="dyu188-B27" ref-type="bibr"><sup>27</sup></xref> Finally, we briefly discuss a potential future role of DataSHIELD in circumventing some of the privacy and confidentiality concerns arising—as under <italic>care.data</italic><xref rid="dyu188-B7" ref-type="bibr"><sup>7</sup></xref><sup>,</sup><xref rid="dyu188-B8" ref-type="bibr"><sup>8</sup></xref>—when progress in biomedical science might be accelerated if researchers could easily access and co-analyse data held in multiple sources, including healthcare, social or governmental data, that may have been administratively generated.</p></sec><sec sec-type="methods"><title>Methods</title><sec><title>The IT infrastructure</title><p>The IT infrastructure required to carry out a DataSHIELD analysis comprises three main components: a computer server at each source study hosting an Opal database;<xref rid="dyu188-B28" ref-type="bibr"><sup>28</sup></xref> the statistical programming environment(R<xref rid="dyu188-B29" ref-type="bibr"><sup>29</sup></xref>); and DataSHIELD-specific R libraries installed on the data servers (data computers = DCs) and on the client computer (analysis computer = AC). Opal is a core database application for biobanks and epidemiological studies developed by the Maelstrom Research group<xref rid="dyu188-B30" ref-type="bibr"><sup>30</sup></xref> in collaboration with OBiBa, an international software development project creating open-source software for Biobanks.<xref rid="dyu188-B31" ref-type="bibr"><sup>31</sup></xref> Opal, R and DataSHIELD are open source and freely available.</p><p>Instances of Opal, the R server and the DataSHIELD server-side R libraries are implemented behind the firewall of each data owner’s DC (<xref ref-type="fig" rid="dyu188-F2">Figure 2</xref>). The AC is used to enact and control the distributed analysis. The DataSHIELD client-side R libraries are installed on the AC (<xref ref-type="fig" rid="dyu188-F2">Figure 2</xref>). A DataSHIELD platform consists of at least one AC communicating with a number of DCs or with just one DC (i.e. single-site DataSHIELD).
<fig id="dyu188-F2" position="float"><label>Figure 2.</label><caption><p>Overview of the IT infrastructure required for a DataSHIELD process. The settings are the same in all DCs so only one is highlighted in this figure.</p></caption><graphic xlink:href="dyu188f2p"></graphic></fig></p></sec><sec><title>DataSHIELD process explained</title><p>DataSHIELD as described in this article is intended for the pooled analysis of <italic>‘</italic>horizontally partitioned’ data, i.e. contributing sources hold the same variables but on different individuals (see <xref ref-type="fig" rid="dyu188-F3">Figure 3</xref>b). A new version of DataSHIELD is currently being developed for ‘vertically partitioned’ data where various sources hold different variables on the same individuals (see <xref ref-type="fig" rid="dyu188-F3">Figure 3</xref>c). This uses an overlapping range of secure approaches to secure data integration and retains the same fundamental principle: leave the data where they are but analyse them as if they were combined in one database.
<fig id="dyu188-F3" position="float"><label>Figure 3.</label><caption><p>Graphical view of pooled data (a), horizontally partitioned (b) and vertically partitioned data (c).</p></caption><graphic xlink:href="dyu188f3p"></graphic></fig></p><p>As for any co-analysis, shared data must be harmonized first. The harmonization phase of the HOP project<xref rid="dyu188-B32" ref-type="bibr"><sup>32</sup></xref> within BioSHaRE-EU<xref rid="dyu188-B33" ref-type="bibr"><sup>33</sup></xref> (described in detail elsewhere<xref rid="dyu188-B27" ref-type="bibr"><sup>27</sup></xref><sup>,</sup><xref rid="dyu188-B34" ref-type="bibr"><sup>34</sup></xref><sup>,</sup><xref rid="dyu188-B35" ref-type="bibr"><sup>35</sup></xref>) is functionally independent of DataSHIELD itself (<xref ref-type="table" rid="dyu188-T1">Table 1</xref>, step 0).
<table-wrap id="dyu188-T1" position="float"><label>Table 1.</label><caption><p>Detailed explanations of the steps in DataSHIELD process</p></caption><table frame="hsides" rules="groups"><thead align="left"><tr><th rowspan="1" colspan="1">Step</th><th rowspan="1" colspan="1">Explanation</th><th rowspan="1" colspan="1">Input data</th><th rowspan="1" colspan="1">Output data</th><th rowspan="1" colspan="1">Output location</th><th rowspan="1" colspan="1">Visibility</th></tr></thead><tbody align="left"><tr><td rowspan="1" colspan="1">(0) Preliminary and prerequisite step</td><td rowspan="1" colspan="1">Strictly speaking, this step is not part of a DataSHIELD analysis process; it is, however, a prerequisite for any valid analysis that pools multiple data sets. Each contributing study (e.g. <italic>STUDY<sub>1</sub></italic>) identifies the requisite variables and creates any new harmonized variables needed in the combined analysis. These harmonized variables are then transferred from the study’s database (<italic>Original.DB<sub>STUDY1</sub></italic>) to adatabase linked to the Opal server (<italic>Analysis.DB<sub>STUDY1</sub></italic>)</td><td rowspan="1" colspan="1">All variables held in <italic>Original.DB<sub>STUDY1</sub></italic></td><td rowspan="1" colspan="1">Variables required for combined analysis. No data that may potentially be directly identifying [e.g. a full UK postcode, a full date of birth, or an ID that is equivalent to an ID available elsewhere (e.g. a national health system number)] unless such a variable is essential to the required analysis</td><td rowspan="1" colspan="1">A new analysis SQL database linked to an Opal server: <italic>Analysis.DB<sub>STUDY1</sub></italic>, located on a server controlled by the same researchers who run the original study</td><td rowspan="1" colspan="1">Invisible outside <italic>STUDY<sub>1</sub></italic></td></tr><tr><td rowspan="1" colspan="1">(1) Login to collaborating servers</td><td rowspan="1" colspan="1">The user logs into the collaborating servers through secured web services, using the credentials provided to them. This authentication ensures that only users authorized by the access body (e.g. an analysis access panel put in place by the consortium) can actually carry out an analysis</td><td rowspan="1" colspan="1">A command with a specific public/private key pair</td><td rowspan="1" colspan="1">No data are returned, the connection is established</td><td rowspan="1" colspan="1">Not applicable</td><td rowspan="1" colspan="1">No individual-level server-side data are ever visible to the user after login</td></tr><tr><td rowspan="1" colspan="1">(2 and 3) Request and transfer of the shared data to the analysis zone</td><td rowspan="1" colspan="1">(2) The user sends a command to request the specific data to analyse. This could be all the variables or specific variables stored in <italic>Analysis.DB<sub>STUDY1</sub></italic>. (3) DataSHIELD extracts data from <italic>Analysis.DB<sub>STUDY1</sub></italic> and transfers it (<italic>Assigned.Data<sub>STUDY1</sub></italic>) to the local R instance (<italic>R.Environment<sub>STUDY1</sub></italic>) of <italic>STUDY<sub>1</sub></italic> controlled bythe researchers of <italic>STUDY<sub>1</sub></italic></td><td rowspan="1" colspan="1">All or some of the variables in <italic>Analysis.DB<sub>STUDY1</sub></italic></td><td rowspan="1" colspan="1">A data frame (an R data structure) with all variables or part of the variables in <italic>Analysis.DB<sub>STUDY1</sub></italic></td><td rowspan="1" colspan="1"><italic>R.Environment<sub>STUDY1</sub></italic> behind the firewall controlled by the same scientists who run<italic> STUDY<sub>1</sub></italic></td><td rowspan="1" colspan="1">Individual-level data invisible outside <italic>STUDY<sub>1</sub></italic>. Aggregated data invisible outside <italic>STUDY<sub>1</sub></italic> except via approved DataSHIELD commands<xref rid="dyu188-B24" ref-type="bibr"><sup>24</sup></xref></td></tr><tr><td rowspan="1" colspan="1">(4) Starting the analysis (i.e. sending command to fit a GLM model)</td><td rowspan="1" colspan="1">The researcher sitting at the analysis computer (AC) sends an R command to every study telling it to fit one iteration of a generalized linear modelling fitting procedure (the iterative reweighted least-squares algorithm), including first-‘guessed’ estimates at what the ultimate set of regression coefficients will be</td><td rowspan="1" colspan="1">A short set of instructions completely unrelated to any data in any study which contains the model to fit and an arbitrary string of numbers representing the first-guessed coefficient estimates</td><td rowspan="1" colspan="1">Instructions about the model to fit and the coefficient estimates are received by <italic>R.Environment<sub>STUDY1</sub></italic></td><td rowspan="1" colspan="1"><italic>R.Environment<sub>STUDY1</sub></italic></td><td rowspan="1" colspan="1">The model to fit and the coefficient estimates are visible outside <italic>STUDY<sub>1</sub></italic> but are non-sensitive</td></tr><tr><td rowspan="1" colspan="1">(5) Carrying out the analysis locally (i.e.enact one iteration of a GLM fit)</td><td rowspan="1" colspan="1">Each data computer responds to the instructions sent from the AC in step 4 by running a single iteration of aGLM fit. This fitting is carried out in <italic>R.Environment<sub>STUDY1</sub></italic> using the first coefficient estimates as starting position. Two mathematical products of this analysis are called the score vector and the information matrix</td><td rowspan="1" colspan="1">Instructions as in step 4</td><td rowspan="1" colspan="1">A score vector (e.g. <italic>Score.Vector<sub>STUDY1</sub></italic>) and an information matrix (e.g. <italic>Information.Matrix<sub>STUDY1</sub></italic>) are calculated by each study</td><td rowspan="1" colspan="1"><italic>R.Environment<sub>STUDY1</sub></italic></td><td rowspan="1" colspan="1"><italic>Score.Vector<sub>STUDY1</sub></italic> and <italic>Information.Matrix<sub>STUDY1</sub></italic> carry no individually identifying or sensitive data and are only visible outside <italic>study<sub>1</sub></italic>via a legal DataSHIELD Command</td></tr><tr><td rowspan="1" colspan="1">(6) Summary statistics returned to the analysis computer</td><td rowspan="1" colspan="1">DC<sub>1</sub> transmits <italic>Score.Vector<sub>STUDY1</sub></italic> and <italic>Information.Matrix<sub>STUDY1</sub></italic> to the analysis computer</td><td rowspan="1" colspan="1"><italic>Score.Vector<sub>STUDY1</sub></italic> and <italic>Information.Matrix<sub>STUDY1</sub></italic> are sent</td><td rowspan="1" colspan="1"><italic>Score.Vector<sub>STUDY1</sub></italic> and <italic>Information.Matrix<sub>STUDY1</sub></italic> are received</td><td rowspan="1" colspan="1">Analysis computer</td><td rowspan="1" colspan="1"><italic>Score.Vector<sub>STUDY1</sub></italic> and <italic>Information.Matrix<sub>STUDY1</sub></italic> are now visible to outside world but they carry no individually identifying or sensitive information</td></tr><tr><td rowspan="1" colspan="1">(7) Combining the summary statistics returned by the DCs</td><td rowspan="1" colspan="1">The analysis computer adds up the score vectors and information matrices from all DCs, divides the first sum by the latter (technically, a matrix multiplication) and uses the result to update the coefficient estimates using the conventional updating algorithm called the Iterative Reweighted Least Squares (IRLS) algorithm<xref rid="dyu188-B36" ref-type="bibr"><sup>36</sup></xref></td><td rowspan="1" colspan="1">Score vectors and information matrices from all DCs</td><td rowspan="1" colspan="1">New coefficient estimates</td><td rowspan="1" colspan="1">Analysis computer</td><td rowspan="1" colspan="1">All visible to outside world, but carry no sensitive information</td></tr><tr><td rowspan="1" colspan="1">(8) Repeat step 4 with updated coefficients</td><td rowspan="1" colspan="1">The same process as in step 4 re-starts; the analysis computer commands the DCs to fit the same model with the updated coefficient estimates</td><td rowspan="1" colspan="1">Same as per step (4)</td><td rowspan="1" colspan="1">Same as per step (4)</td><td rowspan="1" colspan="1">Same as per step (4)</td><td rowspan="1" colspan="1">Same as per step (4)</td></tr><tr><td colspan="6" rowspan="1">Keep repeating steps 5-8 until the model is almost unchanged (judged by appropriate convergence criterion) between iterations—the model is then said to have converged</td></tr></tbody></table></table-wrap></p><sec><title>DataSHIELD functions</title><p>The fundamental building blocks of DataSHIELD are its client-side and server-side functions. As illustrated in <xref ref-type="fig" rid="dyu188-F2">Figure 2</xref>, server-side functions reside in the modified R environments located behind the firewall of the DC at each individual study. It is the server-side functions that actually process the individual-level data at the distinct repositories. The outputs from server-side functions (non-disclosive study-level statistics) represent the only information that ever leaves a DC, and this is why we can claim that DataSHIELD allows full analysis of individual-level data without those data ever having to be moved, or even rendered visible, outside their study of origin. Client-side functions reside on the conventional R environment on the AC. Client-side functions call and control server-side functions and combine information across different repositories when required. All DataSHIELD functions require approval under a technical and governance process including external independent evaluation.</p></sec><sec><title>DataSHIELD secure analyses</title><p>An iterative analysis (e.g. fitting a generalized linear model [GLM]) is illustrated in <xref ref-type="fig" rid="dyu188-F4">Figure 4</xref>: its steps are detailed in <xref ref-type="table" rid="dyu188-T1">Table 1</xref>.The same process is triggered simultaneously in all four DCs. The process iterates through steps 5–8 until the combined coefficient estimates remain unchanged between two iterations (according to a pre-defined tolerance criterion). Once convergence is achieved the AC uses the final score vectors and information matrices from all data sets to provide definitive estimates of regression coefficients, their standard errors and other non-disclosive model outputs. One-step analyses are analogous to iterative analyses but do not require repeated loops. For example, to construct a contingency table, each study generates its own table in one step—this is inherentlynon-disclosive—and the AC integrates these to produce a combined table.
<fig id="dyu188-F4" position="float"><label>Figure 4.</label><caption><p>Overview of a DataSHIELD process. Each of the 8 steps and the terms used to refer to the key components and data exchanged between AC and DCs are detailed in <xref ref-type="table" rid="dyu188-T1">Table 1</xref>.</p></caption><graphic xlink:href="dyu188f4p"></graphic></fig></p></sec><sec><title>Disclosure control—examples</title><p>Some functions that are not intrinsically disclosive can nevertheless be problematic in certain settings. Thus, a contingency table with 1–4 observations in any one cell is often viewed as providing a potential disclosure risk.<xref rid="dyu188-B21" ref-type="bibr"><sup>21</sup></xref> To address this problem under DataSHIELD, each DC tests any contingency table it creates and will only return a full table to the AC if all cells are empty or contain at least five observations. All the AC knows is that it has received an incomplete table which is so constructed that nothing disclosive can be inferred—Sub-setting—e.g. by sex, age or phenotypic sub-type—is crucial in statistical analysis. But repeated sub-setting may produce sub-groups that are so small that results based on that subset (e.g. a mean) might potentially be disclosive. Under DataSHIELD, therefore, it is not possible to generate a subset data set containing 1–4 observations. However, this rule may be relaxed or made more stringent at the request of the principal investigator who is seen as taking responsibility for the overall analysis. The DataSHIELD project is currently working on governance rules for sub-setting.</p></sec></sec></sec><sec><title>Results: DataSHIELD at work</title><sec><title>Analyses of data from the Health Obese Project</title><p>The Healthy Obese Project (HOP)<xref rid="dyu188-B27" ref-type="bibr"><sup>27</sup></xref><sup>,</sup><xref rid="dyu188-B32" ref-type="bibr"><sup>32</sup></xref> is part of the BioSHaRE-EU project.<xref rid="dyu188-B33" ref-type="bibr"><sup>33</sup></xref> It aims to identify individuals who are ‘healthy obese’ (HO), defined as having a body mass index >30 in the absence of any of the common metabolic sequelae of obesity—e.g. hypertension, hypercholesterolaemia, impaired glucose tolerance or diabetes—in order to study the biological and environmental correlates of HO. Since HO is relatively uncommon, any single study containing all requisite measures is likely to have inadequate statistical power. DataSHIELD provides an effective way to enact a secure federated co-analysis of the multiple studies involved in HOP. This section briefly describes how DataSHIELD was implemented for this application. At the time of writing, HOP involves 10 studies across eight European countries (<xref ref-type="table" rid="dyu188-T2">Table 2</xref>) sharing 96 harmonized variables.
<table-wrap id="dyu188-T2" position="float"><label>Table 2.</label><caption><p>Healthy Obese Project collaborating studies and shared number of participants at the time of this work</p></caption><table frame="hsides" rules="groups"><thead align="left"><tr><th rowspan="1" colspan="1">Study name</th><th rowspan="1" colspan="1">Host institution</th><th rowspan="1" colspan="1">Location</th><th rowspan="1" colspan="1">Participants</th></tr></thead><tbody align="left"><tr><td rowspan="1" colspan="1">Cooperative Health Research in South Tyrol Study (CHRIS)</td><td rowspan="1" colspan="1">European Academy of Bolzano</td><td rowspan="1" colspan="1">Bolzano, Italy</td><td align="char" char="." rowspan="1" colspan="1">1583</td></tr><tr><td rowspan="1" colspan="1">Cooperative Health Research in the Region of Augsburg (KORA)</td><td rowspan="1" colspan="1">Helmoltz Center Munich</td><td rowspan="1" colspan="1">Augsburg, Germany</td><td align="char" char="." rowspan="1" colspan="1">3080</td></tr><tr><td rowspan="1" colspan="1">LifeLines Cohort Study (LifeLines)</td><td rowspan="1" colspan="1">University Medical Center Groningen</td><td rowspan="1" colspan="1">Groningen, The Netherlands</td><td align="char" char="." rowspan="1" colspan="1">94516</td></tr><tr><td rowspan="1" colspan="1">Mitchelstown Study Population (Mitchelstown)</td><td rowspan="1" colspan="1">Living Health Clinic in Mitchelstown</td><td rowspan="1" colspan="1">Cork, Ireland</td><td align="char" char="." rowspan="1" colspan="1">2047</td></tr><tr><td rowspan="1" colspan="1">Microisolates in South Tyrol Study (MICROS)</td><td rowspan="1" colspan="1">European Academy of Bolzano</td><td rowspan="1" colspan="1">Bolzano, Italy</td><td align="char" char="." rowspan="1" colspan="1">1060</td></tr><tr><td rowspan="1" colspan="1">National Child Development Study (NCDS)</td><td rowspan="1" colspan="1">University of Leicester</td><td rowspan="1" colspan="1">Leicester, UK</td><td align="char" char="." rowspan="1" colspan="1">7210</td></tr><tr><td rowspan="1" colspan="1">FINRISK 2007 Study (FINRISK 2007)</td><td rowspan="1" colspan="1">National Institute for Health and Welfare</td><td rowspan="1" colspan="1">Helsinki, Finland</td><td align="char" char="." rowspan="1" colspan="1">5024</td></tr><tr><td rowspan="1" colspan="1">Nord-Trøndelag Health Study (HUNT)</td><td rowspan="1" colspan="1">Norwegian University of Science and Technology</td><td rowspan="1" colspan="1">Levanger, Norway</td><td align="char" char="." rowspan="1" colspan="1">78968</td></tr><tr><td rowspan="1" colspan="1">Prevention of REnal and Vascular ENd-stage Disease study (PREVEND)</td><td rowspan="1" colspan="1">University Medical Center Groningen</td><td rowspan="1" colspan="1">Groningen, The Netherlands</td><td align="char" char="." rowspan="1" colspan="1">8592</td></tr><tr><td rowspan="1" colspan="1">The Study of Health in Pomerania (SHIP) joined HOP after the analysis reported in this paper, and so the text and figures refer to 9 not 10 studies</td><td rowspan="1" colspan="1">University Medicine of Greifswald</td><td rowspan="1" colspan="1">Greifswald, Germany</td><td align="char" char="." rowspan="1" colspan="1">4308</td></tr></tbody></table></table-wrap></p><p><xref ref-type="fig" rid="dyu188-F5">Figure 5</xref> schematizes the DataSHIELD analysis of HOP data. Under HOP, communications between the AC and the DCs pass through the BioSHaRE-EU<xref rid="dyu188-B33" ref-type="bibr"><sup>33</sup></xref>MICA<xref rid="dyu188-B37" ref-type="bibr"><sup>37</sup></xref> web portal. This ensures that links can only be made through a designated IP name. Such a portal is not a pre-requisite for a DataSHIELD analysis, but it further enhances security. In the Hop settings the Analysis Computer is just used to login to the HOP portal where the client functions are installed and from where the actual analysis is ran.
<fig id="dyu188-F5" position="float"><label>Figure 5.</label><caption><p>For the Healthy Obese Project, communications between AC and DCs were channelled through a trusted portal.</p></caption><graphic xlink:href="dyu188f5p"></graphic></fig></p></sec><sec><title>Examples of DataSHIELD commands</title><p>Although the examples in this section are real as they use real data from the HOP project, they are included here for illustrative purposes only. For the sake of conciseness—and to maintain consistency across all examples—we include only four of the available studies in these examples. Throughout this section the DataSHIELD commands, in bold and italic font, are preceded by explanations and followed, where there is any, by the output of the command, in italic font.</p><sec><title>Histogram plots</title><p><xref ref-type="fig" rid="dyu188-F6">Figure 6</xref> illustrates the output from a DataSHIELD histogram plot of HDL cholesterol for each of the four studies (<xref ref-type="fig" rid="dyu188-F6">Figure 6</xref>A) and for the pooled data (<xref ref-type="fig" rid="dyu188-F6">Figure 6</xref>B). The DataSHIELD function <monospace><bold><italic>ds.histogram</italic></bold></monospace> filters the information returned from each study to remove bars based on a count of between 1 and 4. This means that potentially disclosive outliers are not shown on the plot. It however reports the number of invalid cells in the original grid density matrix used to produce the graph. For all DataSHIELD commands, the ‘type’ argument indicates whether to report results for each study separately (<monospace><bold>type='split'</bold></monospace>) or across all studies, the default behaviour.
<list list-type="simple"><list-item><p><monospace><bold>ds.histogram('D$LAB_HDL',type = 'split')</bold></monospace></p></list-item><list-item><p><monospace><bold>ds.histogram('D$LAB_HDL')</bold></monospace></p></list-item><list-item><p><monospace><italic>ncds: Number of invalid cells (cells with counts >0 and <5) is 53</italic></monospace></p></list-item><list-item><p><monospace><italic>finrisk: Number of invalid cells (cells with counts >0 and <5) is 72</italic></monospace></p></list-item><list-item><p><monospace><italic>micros: Number of invalid cells (cells with counts >0 and <5) is 55</italic></monospace></p></list-item><list-item><p><monospace><italic>kora: Number of invalid cells (cells with counts >0 and <5) is 75.</italic></monospace></p></list-item></list><fig id="dyu188-F6" position="float"><label>Figure 6.</label><caption><p>Histogram plots of the variable ‘LAB_HDL' for each study (A) and for the pooled data (B).</p></caption><graphic xlink:href="dyu188f6p"></graphic></fig></p></sec><sec><title>Quantiles</title><p>The DataSHIELD function <monospace><bold>ds.quantileMean</bold></monospace> returns means and critical quantiles for quantitative variables. Unlike the conventional summary function in R, the DataSHIELD function does not return the minimum and maximum values because these may be disclosive. The results below were obtained by running the command on the quantitative age variable encoding age in years:</p><p><inline-graphic xlink:href="dyu188ilf1.jpg"></inline-graphic></p></sec><sec><title>One and two-dimensional contingency tables</title><sec><title>One-dimensional tables</title><p>The output below is generated by the DataSHIELD function <bold>ds.table1D</bold>, applied to a categorical variable holding BMI in three classes—for all studies combined. In addition to the counts in each category, the function also reports column percentages, row percentages and global percentages. To save space, only counts are shown here. The function also reports on the ‘validity’ of each study data set (full results being reported only for studies where the table is entirely non-disclosive, i.e. no table cells have counts between 1 and 4). As the last component of the output—$VALIDITY.WARNING—each source is flagged as having only valid data, or at least some invalid data.
<list list-type="simple"><list-item><p><monospace><bold><italic>ds.table1D('D$PM_BMI_CATEGORIAL')</italic></bold></monospace></p></list-item><list-item><p><monospace><italic>$`TOTAL.VALID.DATA.COUNTS for variable PM_BMI_CATEGORIAL`</italic></monospace></p></list-item><list-item><p><monospace><italic>ncdsfinrisk micros kora TOTAL</italic></monospace></p></list-item><list-item><p><monospace><italic>1 2453 1777 539 972 5741</italic></monospace></p></list-item><list-item><p><monospace><italic>2 2905 2096 364 1279 6644</italic></monospace></p></list-item><list-item><p><monospace><italic>3 1733 1151 157 812 3853</italic></monospace></p></list-item><list-item><p><monospace><italic>TOTAL 7091 5024 1060 3063 16238</italic></monospace></p></list-item><list-item><p><monospace><italic>$VALIDITY.WARNING</italic></monospace></p></list-item><list-item><p><monospace><italic>[1] ‘ALL STUDIES VALID’</italic></monospace></p></list-item></list></p></sec><sec><title>Two-dimensional tables</title><p>The function <monospace><bold>ds.table2D</bold></monospace> generates two-dimensional contingency tables. Here, the categorical BMI variable is tabulated against gender. The function <monospace><bold>ds.table2D</bold></monospace> also produces column percentages, row percentages, global percentages and validity information. It also runs chi-square tests for homogeneity on (nc-1)*(nr-1) degrees of freedom for each study and for all studies combined, where nc is the number of columns and nr the number of rows.
<list list-type="simple"><list-item><p><monospace><bold><italic>ds.table2D('D$PM_BMI_CATEGORIAL', 'D$GENDER')</italic></bold></monospace></p></list-item><list-item><p><monospace><italic>$`COMBINED.VALID.DATA.COUNTS--PM_BMI_CATEGORIAL (rows) V GENDER (cols) `</italic></monospace></p></list-item><list-item><p><monospace><italic> 0 1 TOTAL</italic></monospace></p></list-item><list-item><p><monospace><italic>1 2036 3705 5741</italic></monospace></p></list-item><list-item><p><monospace><italic>2 3826 2818 6644</italic></monospace></p></list-item><list-item><p><monospace><italic>3 1807 2046 3853</italic></monospace></p></list-item><list-item><p><monospace><italic>TOTAL 7669 8569 16238</italic></monospace></p></list-item><list-item><p><monospace><italic>$CHI2.TESTS.FOR.HOMOGENEITY</italic></monospace></p></list-item><list-item><p><monospace><italic> X2-value df p-value</italic></monospace></p></list-item><list-item><p><monospace><italic>ncds 350.12295 2 9.370602e-77</italic></monospace></p></list-item><list-item><p><monospace><italic>finrisk 139.05465 2 6.377738e-31</italic></monospace></p></list-item><list-item><p><monospace><italic>micros 34.21016 2 3.726980e-08</italic></monospace></p></list-item><list-item><p><monospace><italic>kora 98.49705 2 4.089196e-22</italic></monospace></p></list-item><list-item><p><monospace><italic>ALL VALID STUDIES COMBINED 604.93484 2 4.365851e-132</italic></monospace></p></list-item></list></p></sec></sec><sec><title>Generalized linear models (GLMs)</title><p>Because we wanted to directly compare the results of a GLM analysis under DataSHIELD with the corresponding results obtained from a conventional R-based GLM analysis—i.e. with the raw data from all sources physically combined in one database (<xref ref-type="table" rid="dyu188-T3">Table 3</xref>)—our GLM example is based on four of the HOP studies that explicitly allowed their data to be physically shared within the HOP consortium, as well as to be analysed via DataSHIELD: NCDS,<xref rid="dyu188-B38" ref-type="bibr"><sup>38</sup></xref> KORA,<xref rid="dyu188-B39" ref-type="bibr"><sup>39</sup></xref> LifeLines<xref rid="dyu188-B40" ref-type="bibr"><sup>40</sup></xref> and Mitchelstown.<xref rid="dyu188-B41" ref-type="bibr"><sup>41</sup></xref><table-wrap id="dyu188-T3" position="float"><label>Table 3.</label><caption><p>Comparison of the critical outputs of the same GLM model fitted using DataSHIELD (in light shading) and using standard R with the physically pooled data (in dark shading)</p></caption><table frame="hsides" rules="groups"><tbody align="left"><tr><td rowspan="1" colspan="1"><inline-graphic xlink:href="dyu188t3.jpg"></inline-graphic></td></tr></tbody></table><table-wrap-foot><fn id="dyu188-TF1"><p>DataSHIELD derived estimates rounded to same decimal places as standard R estimates. To avoid confusion, it should be noted that at a very early stage of the HOP analysis, the name of the categorical BMI variable was misspelt as ‘… CATEGORIAL …’. As that misspelling is now entrenched in all of the harmonized data sets etc. we chose not correct it for this paper.</p></fn><fn id="dyu188-TF2"><p>SE, standard error.</p></fn></table-wrap-foot></table-wrap></p><p>The DataSHIELD GLM function, <bold><italic>ds.glm</italic></bold>, is currently constructed to fit linear regression (Gaussian family, identity link), logistic regression (binomial family, logistic link) and Poisson regression (Poisson family, log link). It can easily be extended to encompass other combinations of errors and links. Because it is based around the conventional <italic>glm</italic> function in R, it can fit categorical factors as well as quantitative covariates, and can make use of the full array of R model-fitting operators in specifying the formula—e.g<bold>. *</bold> meaning all possible interactions between a categorical covariate and another covariate, or <bold>-1</bold> meaning remove the regression constant. Intermediate summaries of the fitting process can be printed out after each iteration but, for the sake of conciseness, they are not reported here; only the final results (i.e. after the model has converged) are included in the output below. In order to enhance its illustrative value, the particular model we have fitted contains study-specific terms allowing for heterogeneity in the baseline risk of disease and have used the * operator to specify an interaction between GENDER and a three-level factor encoding BMI. In addition, we compare the estimates and confidence intervals from the GLM fitted using DataSHIELD with their equivalents from the same GLM fitted directly to a combined database into which the individual-level data from each study have been physically pooled. This provides empirical confirmation of the precise theoretical equivalence of the two approaches.<xref rid="dyu188-B22" ref-type="bibr"><sup>22</sup></xref> It should be noted that when variables are initially transferred from Opal into the DataSHIELD R environment at each source, they are by default placed in a data frame denoted ‘D’. For the purposes of clarity here, these variables all have names that are capitalized, and the prefix ‘D$’ tells R to read them from the data frame. In contrast, all new variables created by transformation during the DataSHIELD session itself have been given lower-case names—these sit outside ‘D’(at root level in the DataSHIELD R environment) and are not preceded by ‘D$’.</p><p><inline-graphic xlink:href="dyu188ilf2.jpg"></inline-graphic></p></sec></sec><sec><title>Application in other settings</title><p>In this paper we have illustrated the use of DataSHIELD in a setting involving research-focused analysis of data that were originally collected for research purposes. But it could potentially be of equal value in settings involving co-analysis of data from multiple health service or other administrative databases, or the joint analysis of research data with administrative data. It is for these purposes that major infrastructural projects<xref rid="dyu188-B7" ref-type="bibr"><sup>7</sup></xref><sup>,</sup><xref rid="dyu188-B8" ref-type="bibr"><sup>8</sup></xref> like <italic>care.data</italic><xref rid="dyu188-B7" ref-type="bibr"><sup>7</sup></xref><sup>,</sup><xref rid="dyu188-B8" ref-type="bibr"><sup>8</sup></xref> and secure data-sharing infrastructures<xref rid="dyu188-B10" ref-type="bibr"><sup>10</sup></xref><sup>,</sup><xref rid="dyu188-B11" ref-type="bibr"><sup>11</sup></xref> have been proposed and developed. For example, the aim of <italic>care.data</italic> was to amalgamate medical information on individuals from various administrative sources, including general practice (GP) records, into a single research database held by the Health and Social Care Information Centre and made available to approved researchers. Though some of the concerns that led to the suspension of <italic>care.data</italic> related to the possibility of commercial entities such as pharmaceutical and insurance companies being approved as customers, a central concern was protection of patient confidentiality. If they are ever to succeed, projects like <italic>care.data</italic> must therefore overcome two fundamental data-sharing challenges. First, they must find a safe and appropriate way to allow researchers to analyse data drawn from particular healthcare or other administrative data sources, including GP medical records, wherein the risk of breaching patient confidentiality is reduced to an absolute and acceptable minimum. Depending how many sources need to be accessed, this could potentially be achieved through a conventional—or single-site—application of horizontal DataSHIELD (<xref ref-type="fig" rid="dyu188-F7">Figure 7</xref>a). The second challenge is to securely combine information relating to individuals from a primary source (e.g. from a particular research project, or from GP medical records) with other health or administrative records on the same individuals, using record linkage and co-analysis. This is essential if some of the required data are not directly available from the primary source (e.g. hospitalization data, or education data). In such a setting, a vertical implementation of DataSHIELD can play a useful role (<xref ref-type="fig" rid="dyu188-F7">Figure 7</xref>b), although it is out of the scope of this paper to discuss vertical DataSHIELD in detail. In principle, DataSHIELD could provide a means to reassure the public that their data were being used in a secure manner. However, important challenges remain: (i) ongoing technical refinement of the functionality of the vertical implementation of DataSHIELD; (ii) extensive discussion with data-providing agencies—including government—and relevant governance committees to ensure that they are all comfortable with application of DataSHIELD to potentially sensitive administrative data; and (iii) consideration of whether, in any particular setting, the agencies involved will be willing and able to devote the time and resources required to prepare and document data ready for vertical DataSHIELD use. Our future work includes a focus on addressing these challenges.
<fig id="dyu188-F7" position="float"><label>Figure 7.</label><caption><p>Illustration of DataSHIELD set-up for the analyses of: (a) horizontally partitioned data (similar data, different individuals) held in GP databases and/or data centres. (**Single-site DataSHIELD); and (b) vertically partitioned data requiring record linkage between different types of data on the same individuals held in a variety of data archives.</p></caption><graphic xlink:href="dyu188f7p"></graphic></fig></p></sec></sec><sec sec-type="discussion"><title>Discussion</title><p>DataSHIELD enables co-analysis of several collaborating studies or data sources as if the data from all individuals in all studies were directly accessible but, in reality, these data remain completely secure behind the firewalls of their host computers. This is of significant value in several settings: (i)where ethico-legal or governance restrictions proscribe individual-level data release, or make permission for such release excessively time-consuming to obtain; (ii) a research group is particularly vulnerable to losing intellectual property (e.g<italic>.</italic> in a developing nation) but wishes to freely share the information held in its data without physically sharing the data themselves; and (iii)the underlying data are too large to be physically shared.</p><p>All components of the combined platform (Opal/DataSHIELD) are open source and available without restriction or payment. Both the installation and the configuration require minimal specialist IT expertise: researchers with no IT background have already installed Opal without major difficulties by following the wiki documentation available online.<xref rid="dyu188-B42" ref-type="bibr"><sup>42</sup></xref> DataSHIELD is therefore attractive for researchers with limited resources. An extensive suite of functions already exists, but development work continues and we recently started developing a Graphic User Interface that requires no prior knowledge of R to run a DataSHIELD analysis.<xref rid="dyu188-B43" ref-type="bibr"><sup>43</sup></xref> The newest software release of Opal incorporates an important enhancement. Specifically, DataSHIELD analysis is now truly parallelized: every command is sent simultaneously to all DCs—previously, each command necessarily completed on one DC before being sent to the next. This substantially speeds up analysis, particularly with many studies or time-consuming functions. If processing speed is particularly critical, further time may be saved by distributing the data from a large study across several Opal servers. If there are actual problems with the Opal instance at a given DC, then a message is sent to the data owner to correct that problem (e.g. the version of the libraries currently installed is not up to date, or the server is down). Crucially, if one or more of the data servers are unusable, the user can temporarily exclude them from analysis while they are repaired or updated.</p><p>Because in DataSHIELD potentially disclosive commands are not allowed, some analyses that are possible in standard R are not enabled. In essence, there are two classes of limitation on potential DataSHIELD functionality: (i) absolute limitations which require an analysis that can only be undertaken by enabling one of the functionalities (e.g. visualizing individual data points) that is explicitly blocked as a fundamental element of the DataSHIELD philosophy. For example, this would be the case for a standard scatter plot. Such limitations can never be circumvented and so alternatives (e.g. contour and heat-map plots) are enabled which convey similar information but without disclosing individual data points; (ii) current limitations which are functions or models that we believe are implementable but we have not, as yet, undertaken or completed the development work required. As examples, these latter include generalized linear mixed models<xref rid="dyu188-B44" ref-type="bibr"><sup>44</sup></xref> (including multi-level modelling<xref rid="dyu188-B45" ref-type="bibr"><sup>45</sup></xref><sup>,</sup><xref rid="dyu188-B46" ref-type="bibr"><sup>46</sup></xref>) and Cox regression.<xref rid="dyu188-B47" ref-type="bibr"><sup>47</sup></xref></p><p>Despite its potential utility, implementation of DataSHIELD involves significant challenges. First, although set-up is fundamentally straightforward, application involves a relatively steep learning curve because the command structure is complex: it demands specification of the analysis to be undertaken, the studies to use and how to combine the results. In mitigation, most complex server-side functions are now called using simpler client-side functions and we are working on a menu-driven implementation. Second, like anyco-analysis involving several studies, data must be adequately harmonized<xref rid="dyu188-B27" ref-type="bibr"><sup>27</sup></xref><sup>,</sup><xref rid="dyu188-B34" ref-type="bibr"><sup>34</sup></xref><sup>,</sup><xref rid="dyu188-B35" ref-type="bibr"><sup>35</sup></xref> and the proposed work must comply with governance stipulations in every study. Third, good research governance demands that any published analysis can precisely be replicated. We are therefore developing systems to automatically identify the particular DataSHIELD release used for a given analysis. In addition, each data provider must unambiguously record the particular freeze of data they contributed. These fundamental issues apply in many settings other than DataSHIELD, but because the project could be damaged if early users were to encounter serious scientific or governance problems, application has so far been restricted to research groups with whom we are fully collaborating. This means we can provide active advice and support relating both to implementation and application. We plan to enable independent use as early as possible. Fourth, in undertaking a standard DataSHIELD analysis it is assumed that the data truly are horizontally partitioned, i.e. contributing sources hold the same variables but on different individuals (see <xref ref-type="fig" rid="dyu188-F3">Figure 3</xref>b). So far DataSHIELD has been applied in settings where individual participants in different studies are from different countries or from different regions so it is unlikely that any one person will appear in more than one source. However, going forward, that cannot always be assumed. We have therefore been considering approaches to identify and correct this problem based on probabilistic record linkage. In the genetic setting the BioPIN<xref rid="dyu188-B48" ref-type="bibr"><sup>48</sup></xref> provides an alternative solution. Ongoing work is required. Fifth, despite the care taken to set up DataSHIELD so that it works properly and is non-disclosive, it is possible that unanticipated problems (accidental or malicious) may arise. In order to identify, describe and rectify any errors or loopholes that emerge and in order to identify deliberate miscreants, all commands issued on the client server and enacted on each data server are permanently logged.</p><p>Data sharing platforms, such as <italic>care.data</italic>, that enable powerful integrative analysis of research data as well as data generated by activity in the health service, from disease or death registries or from other administrative or governmental sources, have the potential to generate great societal benefit. Most crucially, they can provide an important route for production of the raw ‘evidence’ needed for ‘evidence-based health care’. But, to be pragmatic, many of the routinely collected healthcare and administrative databases will have to undergo substantial evolution before their quality and consistency are such that they can directly be used in high-quality research without extensive preparatory work. By its very nature, such preparation—which typically includes data cleaning and data harmonization—cannot usually be undertaken in DataSHIELD, because it involves investigating discrepancies and/or extreme results in individual data subjects: the precise functionality that DataSHIELD is designed to block. Such work must therefore be undertaken ahead of time by the data generators themselves—and this is demanding of time, resources and expertise that—at present - many administrative data providers may well be unwilling and/or unable to provide. That said, if the widespread usability of such data is viewed as being of high priority, the required resources could be forthcoming. Then the primary challenge will be to find effective solutions to the professional and societal challenges presented by the need to ensure that all work with individual-level data is rendered adequately secure. These solutions must respect and protect individual autonomy and confidentiality while facilitating the scientific progress from which everybody benefits. This conundrum is well recognized as demonstrated in the series of articles under the heading Dealing with Data in <italic>Science</italic> in 2011,<xref rid="dyu188-B49" ref-type="bibr"><sup>49</sup></xref> and more recently in a review article exploring the combination of multiple healthcare databases for postmarketing surveillance of drug and vaccine safety.<xref rid="dyu188-B50" ref-type="bibr"><sup>50</sup></xref> Furthermore, these challenges and potential solutions provide a crucial focus for professional organizations aimed specifically at enhancing our capacity to make effective use of the rapidly accumulating body of available data in the arenas of health and social care, governmental administration and biomedical and social research. These organizations include major pan-European infrastructural projects in large-scale biomedical sciences such as: <italic>ELIXIR</italic><xref rid="dyu188-B51" ref-type="bibr"><sup>51</sup></xref> and <italic>BBMRI</italic> (the Biobanking and Biomolecular Resources Research Infrastructure<xref rid="dyu188-B52" ref-type="bibr"><sup>52</sup></xref><sup>,</sup><xref rid="dyu188-B53" ref-type="bibr"><sup>53</sup></xref>); <italic>EAGDA</italic> (the Expert Advisory Group in Data Access) set up by four major UK funders (Wellcome Trust, MRC, ESRC and Cancer Research UK); the Public Population Project in Genomics and Society<xref rid="dyu188-B54" ref-type="bibr"><sup>54</sup></xref> and most recently, the Global Alliance for Genomics and Health.<xref rid="dyu188-B55" ref-type="bibr"><sup>55</sup></xref> DataSHIELD provides a radically different way to keep sensitive data from multiple sources completely confidential while maintaining their full scientific utility; it could prove to be an invaluable complement to other more conventional approaches.</p><p>No single approach can provide a perfect universal solution to the challenges arising from the complex interplay between professional and societal wishes, needs and concerns as healthcare and research data become ever richer, increasing both their power for good and their potential risk of disclosure. However, DataSHIELD provides important opportunities that neatly complement other approaches. It has already been proven to work in principle,<xref rid="dyu188-B12" ref-type="bibr"><sup>12</sup></xref><sup>,</sup><xref rid="dyu188-B22" ref-type="bibr"><sup>22</sup></xref> and this paper now addresses the equally taxing problem: how to make it work in practice. DataSHIELD now provides a real opportunity to follow the advice of Kahn in Dealing with Data<xref rid="dyu188-B56" ref-type="bibr"><sup>56</sup></xref> to move the ‘computation to the data, rather than the data to the computation’.<xref rid="dyu188-B56" ref-type="bibr"><sup>56</sup></xref></p></sec><sec><title>Funding</title><p>This work was supported through funds from: the European Union's Seventh Framework Programme BioSHaRE-EU, grant agreement <award-id>HEALTH-F4-2010-261433</award-id>; the Welsh and Scottish Farr Institutes funded by <funding-source>MRC</funding-source>; joint funding from <funding-source>MRC</funding-source> and <funding-source>Wellcome Trust</funding-source> comprising a strategic award underpinning the ALSPAC project and an infrastructural grant entitled <italic>The 1958 Birth Cohort</italic><italic>Biomedical Resource – facilitating access to data and samples and enhancing future utility</italic>; and the BBMRI-LPC project (<award-id>EU FP7, I3</award-id> grant).</p><p><bold>Conflict of interest:</bold> None declared.</p></sec></body><back><ref-list><title>References</title><ref id="dyu188-B1"><label>1</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>Burton</surname><given-names>PR</given-names></name><name><surname>Tobin</surname><given-names>MD</given-names></name><name><surname>Hopper</surname><given-names>JL</given-names></name></person-group><article-title>Key concepts in genetic epidemiology</article-title>. <source>Lancet</source><year>2005</year>;<volume>366</volume>:<fpage>941–</fpage><lpage>51</lpage>.<pub-id pub-id-type="pmid">16154023</pub-id></mixed-citation></ref><ref id="dyu188-B2"><label>2</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>Spencer</surname><given-names>CC</given-names></name><name><surname>Su</surname><given-names>Z</given-names></name><name><surname>Donnelly</surname><given-names>P</given-names></name><name><surname>Marchini</surname><given-names>J</given-names></name></person-group><article-title>Designing genome-wide association studies: sample size, power, imputation, and the choice of genotyping chip</article-title>. <source>PLoS Genet</source><year>2009</year>;<volume>5</volume>:<fpage>e1000477</fpage>.<pub-id pub-id-type="pmid">19492015</pub-id></mixed-citation></ref><ref id="dyu188-B3"><label>3</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>Zondervan</surname><given-names>KT</given-names></name><name><surname>Cardon</surname><given-names>LR</given-names></name></person-group><article-title>Designing candidate gene and genome-wide case-control association studies</article-title>. <source>Nat Protocols</source><year>2007</year>;<volume>2</volume>:<fpage>2492</fpage>–<lpage>501</lpage>.</mixed-citation></ref><ref id="dyu188-B4"><label>4</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>Walport</surname><given-names>M</given-names></name><name><surname>Brest</surname><given-names>P</given-names></name></person-group><article-title>Sharing research data to improve public health</article-title>. <source>Lancet</source><year>2011</year>;<volume>377</volume>:<fpage>537</fpage>–<lpage>39</lpage>.<pub-id pub-id-type="pmid">21216456</pub-id></mixed-citation></ref><ref id="dyu188-B5"><label>5</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>Burton</surname><given-names>PR</given-names></name><name><surname>Hansell</surname><given-names>AL</given-names></name><name><surname>Fortier</surname><given-names>I</given-names></name><etal></etal></person-group><article-title>Size matters: just how big is BIG? Quantifying realistic sample size requirements for human genome epidemiology</article-title>. <source>Int J Epidemiol</source><year>2008</year>;<volume>38</volume>:<fpage>263</fpage>–<lpage>73</lpage>.<pub-id pub-id-type="pmid">18676414</pub-id></mixed-citation></ref><ref id="dyu188-B6"><label>6</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>Gomatam</surname><given-names>S</given-names></name><name><surname>Karr</surname><given-names>A</given-names></name><name><surname>Reiter</surname><given-names>J</given-names></name><name><surname>Sanil</surname><given-names>A</given-names></name></person-group><article-title>Data dissemination and disclosure limitation in a world without microdata: a risk-utility framework for remote access analysis servers</article-title>. <source>Stat Sc</source><year>2005</year>;<volume>20</volume>:<fpage>163</fpage>–<lpage>77</lpage>.</mixed-citation></ref><ref id="dyu188-B7"><label>7</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>Hoeksma</surname><given-names>J</given-names></name></person-group><article-title>The NHS's care.data scheme: what are the risks to privacy?</article-title><source>BMJ</source><year>2014</year>;<volume>348</volume>:<fpage>g1547</fpage>.<pub-id pub-id-type="pmid">24535332</pub-id></mixed-citation></ref><ref id="dyu188-B8"><label>8</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>McCartney</surname><given-names>M</given-names></name></person-group><article-title>Care.data: why are Scotland and Wales doing it differently?</article-title><source>BMJ</source><year>2014</year>;<volume>348</volume>:<fpage>g1702</fpage>.<pub-id pub-id-type="pmid">24556069</pub-id></mixed-citation></ref><ref id="dyu188-B9"><label>9</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>Demir</surname><given-names>I</given-names></name><name><surname>Murtagh</surname><given-names>MJ</given-names></name></person-group><article-title>Data sharing across biobanks: epistemic values, data mutability and data incommensurability</article-title>. <source>New Genet Soc</source><year>2013</year>;<volume>32</volume>:<fpage>350–</fpage><lpage>65</lpage>.</mixed-citation></ref><ref id="dyu188-B10"><label>10</label><mixed-citation publication-type="journal"><collab>UK.Data.Service</collab>. <source>About Secure Access</source>. <comment><ext-link ext-link-type="uri" xlink:href="http://ukdataservice.ac.uk/get-data/secure-access/about/what-is.aspx">http://ukdataservice.ac.uk/get-data/secure-access/about/what-is.aspx</ext-link> (7 March 2014, date last accessed)</comment>.</mixed-citation></ref><ref id="dyu188-B11"><label>11</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>Ford</surname><given-names>DV</given-names></name><name><surname>Jones</surname><given-names>KH</given-names></name><name><surname>Verplancke</surname><given-names>JP</given-names></name><etal></etal></person-group><article-title>The SAIL Databank: building a national architecture for e-health research and evaluation</article-title>. <source>BMC Health Serv Res</source><year>2009</year>;<volume>9</volume>:<fpage>157</fpage>.<pub-id pub-id-type="pmid">19732426</pub-id></mixed-citation></ref><ref id="dyu188-B12"><label>12</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>Wolfson</surname><given-names>M</given-names></name><name><surname>Wallace</surname><given-names>SE</given-names></name><name><surname>Masca</surname><given-names>N</given-names></name><etal></etal></person-group><article-title>DataSHIELD: resolving a conflict in contemporary bioscience—performing a pooled analysis of individual-level data without sharing the data</article-title>. <source>Int J Epidemiol</source><year>2010</year>;<volume>39</volume>:<fpage>1372</fpage>–<lpage>82</lpage>.<pub-id pub-id-type="pmid">20630989</pub-id></mixed-citation></ref><ref id="dyu188-B13"><label>13</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>Newton-Cheh</surname><given-names>C</given-names></name><name><surname>Johnson</surname><given-names>T</given-names></name><name><surname>Gateva</surname><given-names>V</given-names></name><etal></etal></person-group><article-title>Genome-wide association study identifies eight loci associated with blood pressure</article-title>. <source>Nat Genet</source><year>2009</year>;<volume>41</volume>:<fpage>666</fpage>–<lpage>76</lpage>.<pub-id pub-id-type="pmid">19430483</pub-id></mixed-citation></ref><ref id="dyu188-B14"><label>14</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>Repapi</surname><given-names>E</given-names></name><name><surname>Sayers</surname><given-names>I</given-names></name><name><surname>Wain</surname><given-names>LV</given-names></name><etal></etal></person-group><article-title>Genome-wide association study identifies five loci associated with lung function</article-title>. <source>Nat Genet</source><year>2010</year>;<volume>42</volume>:<fpage>36</fpage>–<lpage>44</lpage>.<pub-id pub-id-type="pmid">20010834</pub-id></mixed-citation></ref><ref id="dyu188-B15"><label>15</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>Zeggini</surname><given-names>E</given-names></name><name><surname>Weedon</surname><given-names>MN</given-names></name><name><surname>Lindgren</surname><given-names>CM</given-names></name><etal></etal></person-group><article-title>Replication of genome-wide association signals in U.K</article-title>. <source>Samples reveal risk loci for type 2 diabetes. <italic>Science</italic></source><year>2007</year>;<volume>316</volume>:<fpage>1336</fpage>–<lpage>39</lpage>.</mixed-citation></ref><ref id="dyu188-B16"><label>16</label><mixed-citation publication-type="book"><person-group person-group-type="author"><name><surname>Petitti</surname><given-names>DB</given-names></name></person-group><source>Meta-analysis, Decision Analysis and Cost-Effectiveness Analysis: Methods for Quantitative Synthesis in Medicine</source>. <edition>2nd</edition> ed. <publisher-loc>New York</publisher-loc>: <publisher-name>Oxford University Press</publisher-name>; <year>2000</year>.</mixed-citation></ref><ref id="dyu188-B17"><label>17</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>Sutton</surname><given-names>AJ</given-names></name><name><surname>Kendrick</surname><given-names>D</given-names></name><name><surname>Coupland</surname><given-names>CA</given-names></name></person-group><article-title>Meta-analysis of individual- and aggregate-level data</article-title>. <source>Stat Med</source><year>2008</year>;<volume>27</volume>:<fpage>651</fpage>–<lpage>69</lpage>.<pub-id pub-id-type="pmid">17514698</pub-id></mixed-citation></ref><ref id="dyu188-B18"><label>18</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>Burman</surname><given-names>W</given-names></name><name><surname>Daum</surname><given-names>R</given-names></name><name><surname>Janoff</surname><given-names>E</given-names></name><etal></etal></person-group><article-title>Grinding to a halt: the effects of the increasing regulatory burden on research and quality improvement efforts</article-title>. <source>Clin Infect Dis</source><year>2009</year>;<volume>49</volume>:<fpage>328</fpage>–<lpage>35</lpage>.<pub-id pub-id-type="pmid">19566438</pub-id></mixed-citation></ref><ref id="dyu188-B19"><label>19</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>Malfroy</surname><given-names>M</given-names></name><name><surname>Llewelyn</surname><given-names>CA</given-names></name><name><surname>Johnson</surname><given-names>T</given-names></name><name><surname>Williamson</surname><given-names>LM</given-names></name></person-group><article-title>Using patient-identifiable data for epidemiological research</article-title>. <source>Transfus Med</source><year>2004</year>;<volume>14</volume>:<fpage>275</fpage>–<lpage>79</lpage>.<pub-id pub-id-type="pmid">15285723</pub-id></mixed-citation></ref><ref id="dyu188-B20"><label>20</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>Burton</surname><given-names>P</given-names></name><name><surname>Wolfson</surname><given-names>M</given-names></name><name><surname>Masca</surname><given-names>N</given-names></name><name><surname>Fortier</surname><given-names>I</given-names></name></person-group><article-title>Datashield: Individual-level meta-analysis without sharing the data</article-title>. <source>J Epidemiol Commun Health</source><year>2011</year>;<volume>65</volume>:<fpage>A37</fpage>.</mixed-citation></ref><ref id="dyu188-B21"><label>21</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>Wallace</surname><given-names>SE</given-names></name><name><surname>Gaye</surname><given-names>A</given-names></name><name><surname>Shoush</surname><given-names>O</given-names></name><name><surname>Burton</surname><given-names>PR</given-names></name></person-group><article-title>Protecting personal data in epidemiological research: DataSHIELD and UK law</article-title>. <source>Public Health Genom</source><year>2014</year>;<volume>17</volume>:<fpage>149</fpage>–<lpage>57</lpage>.</mixed-citation></ref><ref id="dyu188-B22"><label>22</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>Jones</surname><given-names>EM</given-names></name><name><surname>Sheehan</surname><given-names>NA</given-names></name><name><surname>Masca</surname><given-names>N</given-names></name><name><surname>Wallace</surname><given-names>SE</given-names></name><name><surname>Murtagh</surname><given-names>MJ</given-names></name><name><surname>Burton</surname><given-names>PR</given-names></name></person-group><article-title>DataSHIELD-shared individual-level analysis without sharing the data: a biostatistical perspective</article-title>. <source>Norsk Epidemiologi</source><year>2012</year>;<volume>21</volume>:<fpage>231</fpage>–<lpage>39</lpage>.</mixed-citation></ref><ref id="dyu188-B23"><label>23</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>Jones</surname><given-names>EM</given-names></name><name><surname>Sheehan</surname><given-names>NA</given-names></name><name><surname>Gaye</surname><given-names>A</given-names></name><name><surname>Laflamme</surname><given-names>P</given-names></name><name><surname>Burton</surname><given-names>P</given-names></name></person-group><article-title>Combined analysis of correlated data when data cannot be pooled</article-title>. <source>Stat</source><year>2013</year>;<volume>2</volume>:<fpage>72</fpage>–<lpage>85</lpage>.</mixed-citation></ref><ref id="dyu188-B24"><label>24</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>Murtagh</surname><given-names>MJ</given-names></name><name><surname>Demir</surname><given-names>I</given-names></name><name><surname>Jenkings</surname><given-names>KN</given-names></name><etal></etal></person-group><article-title>Securing the data economy: translating privacy and enacting security in the development of DataSHIELD</article-title>. <source>Public Health Genom</source><year>2012</year>;<volume>15</volume>:<fpage>243</fpage>–<lpage>53</lpage>.</mixed-citation></ref><ref id="dyu188-B25"><label>25</label><mixed-citation publication-type="book"><collab>EGA</collab>. <source>European Genome-Phenome Archive</source>. <comment><ext-link ext-link-type="uri" xlink:href="https://www.ebi.ac.uk/training/online/course/genomics-introduction-ebi-resources/european-genome-phenome-archive-ega">https://www.ebi.ac.uk/training/online/course/genomics-introduction-ebi-resources/european-genome-phenome-archive-ega</ext-link> (13 March 2014, date last accessed)</comment>.</mixed-citation></ref><ref id="dyu188-B26"><label>26</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>Wallace</surname><given-names>SE</given-names></name></person-group><article-title>The needle in the haystack: international consortia and the return of individual research results</article-title>. <source>J Law Med Ethics</source><year>2011</year>;<volume>39</volume>:<fpage>631</fpage>–<lpage>39</lpage>.<pub-id pub-id-type="pmid">22084849</pub-id></mixed-citation></ref><ref id="dyu188-B27"><label>27</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>Doiron</surname><given-names>D</given-names></name><name><surname>Burton</surname><given-names>P</given-names></name><name><surname>Marcon</surname><given-names>Y</given-names></name><etal></etal></person-group><article-title>Data harmonization and federated analysis of population-based studies: the BioSHaRE project</article-title>. <source>Emerg Themes Epidemiol</source><year>2013</year>;<volume>10</volume>:<fpage>12</fpage>.<pub-id pub-id-type="pmid">24257327</pub-id></mixed-citation></ref><ref id="dyu188-B28"><label>28</label><mixed-citation publication-type="journal"><collab>OBiBa</collab>. <source><italic>Opal [Opal is OBiBa's core database application for biobanks or epidemiological studies]</italic>.</source><year>2012</year><comment><ext-link ext-link-type="uri" xlink:href="http://www.obiba.org/node/63">http://www.obiba.org/node/63</ext-link> (24 June 2014, date last accessed)</comment></mixed-citation></ref><ref id="dyu188-B29"><label>29</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>Ihaka</surname><given-names>R</given-names></name><name><surname>Gentleman</surname><given-names>R</given-names></name></person-group><article-title>R: A language for data analysis and graphics</article-title>. <source>J Comput Graph Stat</source><year>1996</year>;<volume>5</volume>:<fpage>299</fpage>–<lpage>14</lpage>.</mixed-citation></ref><ref id="dyu188-B30"><label>30</label><mixed-citation publication-type="book"><collab>Maelstrom</collab>. <source>Maelstrom Research</source>. <comment><ext-link ext-link-type="uri" xlink:href="https://www.maelstrom-research.org/">https://www.maelstrom-research.org/</ext-link> (4 March 2014, date last accessed)</comment>.</mixed-citation></ref><ref id="dyu188-B31"><label>31</label><mixed-citation publication-type="book"><collab>OBiBa</collab>. <source>Open Source Software for Biobanks</source>. <comment><ext-link ext-link-type="uri" xlink:href="http://www.obiba.org/?q=node/1">http://www.obiba.org/?q=node/1</ext-link> (04 March 2014, date last accessed).</comment></mixed-citation></ref><ref id="dyu188-B32"><label>32</label><mixed-citation publication-type="book"><collab>Healthy Obese Project</collab>. <source>Healthy Obese Project</source>. <comment>2013 <ext-link ext-link-type="uri" xlink:href="https://www.bioshare.eu/content/healthy-obese-project">https://www.bioshare.eu/content/healthy-obese-project</ext-link> (19 March 2014, date last accessed).</comment></mixed-citation></ref><ref id="dyu188-B33"><label>33</label><element-citation publication-type="book"><collab>BioSHaRE-EU.</collab><source><italic>BioSHaRE.eu</italic>.</source><comment><ext-link ext-link-type="uri" xlink:href="https://www.bioshare.eu/">https://www.bioshare.eu/</ext-link> (19 June 2014, date last accessed).</comment></element-citation></ref><ref id="dyu188-B34"><label>34</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>Fortier</surname><given-names>I</given-names></name><name><surname>Burton</surname><given-names>PR</given-names></name><name><surname>Robson</surname><given-names>PJ</given-names></name><etal></etal></person-group><article-title>Quality, quantity and harmony: the DataSHaPER approach to integrating data across bioclinical studies</article-title>. <source>Int J Epidemiol</source><year>2010</year>;<volume>39</volume>:<fpage>1383</fpage>–<lpage>93</lpage>.<pub-id pub-id-type="pmid">20813861</pub-id></mixed-citation></ref><ref id="dyu188-B35"><label>35</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>Fortier</surname><given-names>I</given-names></name><name><surname>Doiron</surname><given-names>D</given-names></name><name><surname>Little</surname><given-names>J</given-names></name><etal></etal></person-group><article-title>Is rigorous retrospective harmonization possible? Application of the DataSHaPER approach across 53 large studies</article-title>. <source>Int J Epidemiol</source><year>2011</year>;<volume>40</volume>:<fpage>1314</fpage>–<lpage>28</lpage>.<pub-id pub-id-type="pmid">21804097</pub-id></mixed-citation></ref><ref id="dyu188-B36"><label>36</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>Kuk</surname><given-names>A</given-names></name><name><surname>Cheng</surname><given-names>Y</given-names></name></person-group><article-title>The Monte Carlo Newton-Raphson Algorithm</article-title>. <source>J Stat Comput Sim</source><year>1997</year>;<volume>59</volume>:<fpage>233</fpage>–<lpage>50</lpage>.</mixed-citation></ref><ref id="dyu188-B37"><label>37</label><mixed-citation publication-type="book"><collab>OBiBa</collab>. <source>Mica</source>. <comment><ext-link ext-link-type="uri" xlink:href="http://obiba.org/node/174">http://obiba.org/node/174</ext-link> (4 March 2014, date last accessed).</comment></mixed-citation></ref><ref id="dyu188-B38"><label>38</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>Power</surname><given-names>C</given-names></name><name><surname>Elliott</surname><given-names>J</given-names></name></person-group><article-title>Cohort profile: 1958 British birth cohort (National Child Development Study)</article-title>. <source>Int J Epidemiol</source><year>2006</year>;<volume>35</volume>:<fpage>34</fpage>–<lpage>41</lpage>.<pub-id pub-id-type="pmid">16155052</pub-id></mixed-citation></ref><ref id="dyu188-B39"><label>39</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>Wichmann</surname><given-names>H</given-names></name><name><surname>Gieger</surname><given-names>C</given-names></name><name><surname>Illig</surname><given-names>T</given-names></name></person-group><article-title>KORA-gen-resource for population genetics, controls and a broad spectrum of disease phenotypes</article-title>. <source>Gesundheitswesen</source><year>2005</year>;<volume>67</volume>:<fpage>S26</fpage>.<pub-id pub-id-type="pmid">16032514</pub-id></mixed-citation></ref><ref id="dyu188-B40"><label>40</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>Stolk</surname><given-names>RP</given-names></name><name><surname>Rosmalen</surname><given-names>JG</given-names></name><name><surname>Postma</surname><given-names>DS</given-names></name><etal></etal></person-group><article-title>Universal risk factors for multifactorial diseases</article-title>. <source>Eur J Epidemiol</source><year>2008</year>;<volume>23</volume>:<fpage>67</fpage>–<lpage>74</lpage>.<pub-id pub-id-type="pmid">18075776</pub-id></mixed-citation></ref><ref id="dyu188-B41"><label>41</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>Kearney</surname><given-names>PM</given-names></name><name><surname>Harrington</surname><given-names>JM</given-names></name><name><surname>Mc Carthy</surname><given-names>VJ</given-names></name><name><surname>Fitzgerald</surname><given-names>AP</given-names></name><name><surname>Perry</surname><given-names>IJ</given-names></name></person-group><article-title>Cohort Profile: The Cork and Kerry Diabetes and Heart Disease Study</article-title>. <source><italic>Int J Epidemiol</italic> 2013</source><year>2013</year>;<volume>42</volume>:<fpage>1253</fpage>–<lpage>62</lpage>.</mixed-citation></ref><ref id="dyu188-B42"><label>42</label><mixed-citation publication-type="book"><collab>OBiBa</collab>. <source>Opal documentation</source>. <comment>2014 <ext-link ext-link-type="uri" xlink:href="http://wiki.obiba.org/display/OPALDOC/Home">http://wiki.obiba.org/display/OPALDOC/Home</ext-link> (27 June 2014, date last accessed)</comment>.</mixed-citation></ref><ref id="dyu188-B43"><label>43</label><mixed-citation publication-type="book"><person-group person-group-type="author"><name><surname>Gaye</surname><given-names>A</given-names></name><name><surname>Burton</surname><given-names>WY</given-names></name></person-group><source>DataSHIELD Online Interactive Terminal</source>. <year>2014</year><comment><ext-link ext-link-type="uri" xlink:href="https://www.bioshare.eu/datashieldgui/">https://www.bioshare.eu/datashieldgui/</ext-link> (29 June 2014, date last accessed)</comment>.</mixed-citation></ref><ref id="dyu188-B44"><label>44</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>Breslow</surname><given-names>N</given-names></name><name><surname>Clayton</surname><given-names>D</given-names></name></person-group><article-title>Approximate inference in generalized linear mixed models</article-title>. <source>J Am Stat Assoc</source><year>1993</year>;<volume>88</volume>:<fpage>9</fpage>–<lpage>25</lpage>.</mixed-citation></ref><ref id="dyu188-B45"><label>45</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>Goldstein</surname><given-names>H</given-names></name></person-group><article-title>Multilevel mixed linear modelling analysis using iterative generalized least squares</article-title>. <source>Biometrika</source><year>1986</year>;<volume>73</volume>:<fpage>43</fpage>–<lpage>56</lpage>.</mixed-citation></ref><ref id="dyu188-B46"><label>46</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>Burton</surname><given-names>P</given-names></name><name><surname>Gurrin</surname><given-names>L</given-names></name><name><surname>Sly</surname><given-names>P</given-names></name></person-group><article-title>Extending the simple linear regression model to account for correlated responses: an introduction to generalized estimating equations and multi-level mixed modelling</article-title>. <source>Stat Med</source><year>1998</year>;<volume>17</volume>:<fpage>1261</fpage>–<lpage>91</lpage>.<pub-id pub-id-type="pmid">9670414</pub-id></mixed-citation></ref><ref id="dyu188-B47"><label>47</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>Cox</surname><given-names>DR</given-names></name></person-group><article-title>Regression models and life-tables</article-title>. <source>J R Stat Soc</source><year>1972</year>;<volume>B;34</volume>:<fpage>187</fpage>–<lpage>220</lpage>.</mixed-citation></ref><ref id="dyu188-B48"><label>48</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>Nietfeld</surname><given-names>JJ</given-names></name><name><surname>Sugarman</surname><given-names>J</given-names></name><name><surname>Litton</surname><given-names>JE</given-names></name></person-group><article-title>The Bio-PIN: a concept to improve biobanking</article-title>. <source>Nat Rev Cancer</source><year>2011</year>;<volume>11</volume>:<fpage>303</fpage>–<lpage>08</lpage>.<pub-id pub-id-type="pmid">21412253</pub-id></mixed-citation></ref><ref id="dyu188-B49"><label>49</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>Hanson</surname><given-names>B</given-names></name><name><surname>Sugden</surname><given-names>A</given-names></name><name><surname>Alberts</surname><given-names>B</given-names></name></person-group><article-title>Making data maximally available</article-title>. <source>Science</source><year>2011</year>;<volume>331</volume>:<fpage>649</fpage>.<pub-id pub-id-type="pmid">21310971</pub-id></mixed-citation></ref><ref id="dyu188-B50"><label>50</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>Trifirò</surname><given-names>G</given-names></name><name><surname>Coloma</surname><given-names>P</given-names></name><name><surname>Rijnbeek</surname><given-names>P</given-names></name><etal></etal></person-group><article-title>Combining multiple healthcare databases for postmarketing drug and vaccine safety surveillance: why and how?</article-title><source>J Int Med</source><year>2014</year>;<volume>275</volume>:<fpage>551</fpage>–<lpage>61</lpage>.</mixed-citation></ref><ref id="dyu188-B51"><label>51</label><mixed-citation publication-type="book"><collab>Elixir</collab>. <source>Elixir, Data For Life</source>. <year>2014</year><comment><ext-link ext-link-type="uri" xlink:href="http://www.elixir-europe.org/">http://www.elixir-europe.org/</ext-link> (27 June 2014, date last accessed).</comment></mixed-citation></ref><ref id="dyu188-B52"><label>52</label><mixed-citation publication-type="book"><collab>BBMRI-ERIC</collab>. <source>Managing Resources for the Future of Biomedical Research</source>. <comment><ext-link ext-link-type="uri" xlink:href="http://bbmri-eric.eu/">http://bbmri-eric.eu/</ext-link> (27 June 2014, date last accessed).</comment></mixed-citation></ref><ref id="dyu188-B53"><label>53</label><mixed-citation publication-type="book"><collab>BBMRI-LPC</collab>. <source>Helping Europeans Get Healthier</source>. <comment><ext-link ext-link-type="uri" xlink:href="http://www.bbmri-lpc.org/">http://www.bbmri-lpc.org/</ext-link> (27 June 2014, date last accessed).</comment></mixed-citation></ref><ref id="dyu188-B54"><label>54</label><mixed-citation publication-type="book"><collab>Public Population Project in Genomics and Society</collab>. <source>P3G HOME</source>. <comment><ext-link ext-link-type="uri" xlink:href="http://p3g.org/">http://p3g.org/</ext-link>.</comment></mixed-citation></ref><ref id="dyu188-B55"><label>55</label><mixed-citation publication-type="book"><collab>Global Alliance 4 Genomics and Health</collab>. <source>Web site. 2014</source>. <comment><ext-link ext-link-type="uri" xlink:href="http://genomicsandhealth.org/">http://genomicsandhealth.org/</ext-link></comment></mixed-citation></ref><ref id="dyu188-B56"><label>56</label><mixed-citation publication-type="journal"><person-group person-group-type="author"><name><surname>Kahn</surname><given-names>SD</given-names></name></person-group><article-title>On the future of genomic data</article-title>. <source>Science</source><year>2011</year>;<volume>331</volume>:<fpage>728</fpage>–<lpage>29</lpage>.<pub-id pub-id-type="pmid">21311016</pub-id></mixed-citation></ref></ref-list></back></pmc></record>Pour manipuler ce document sous Unix (Dilib)
EXPLOR_STEP=$WICRI_ROOT/Wicri/Asie/explor/AustralieFrV1/Data/Pmc/Corpus
HfdSelect -h $EXPLOR_STEP/biblio.hfd -nk 002600 | SxmlIndent | more
Ou
HfdSelect -h $EXPLOR_AREA/Data/Pmc/Corpus/biblio.hfd -nk 002600 | SxmlIndent | more
Pour mettre un lien sur cette page dans le réseau Wicri
{{Explor lien
|wiki= Wicri/Asie
|area= AustralieFrV1
|flux= Pmc
|étape= Corpus
|type= RBID
|clé=
|texte=
}}
| This area was generated with Dilib version V0.6.33. |  |