@article{Raisaro2017b,
title = {MedCo: Enabling Privacy-Conscious Exploration of Distributed Clinical and Genomic Data.},
author = {Jean Louis Raisaro (EPFL), Juan Ramon Troncoso-Pastoriza (EPFL), Mickaël Misbach (EPFL and Centre Hospitalier Universitaire Vaudois), João Sá Sousa (EPFL), Sylvain Pradervand (Centre Hospitalier Universitaire Vaudois and University of Lausanne), Edoardo Missiaglia (Centre Hospitalier Universitaire Vaudois), Olivier Michielin (Centre Hospitalier Universitaire Vaudois), Bryan Ford (EPFL) and Jean-Pierre Hubaux (EPFL)},
year = {2017},
date = {2017-10-15},
journal = {Genopri 2017},
abstract = {Being able to share large amounts of sensitive clinical and genomic data across several institutions is crucial for precision medicine to scale up. Unfor- tunately, existing solutions only partially address this challenge and are still unable to provide the strong privacy and security guarantees required by regulations (e.g., HIPAA, GDPR). As a result, currently only very limited datasets of non-sensitive and moderately useful information can be shared. In this paper, we introduce MedCo, the first operational system that enables an investigator to explore sensi- tive medical information distributed at several sites and protected with collective homomorphic encryption. MedCo builds on top of established and widespread technology from the biomedical informatics community, such as i2b2 and SHRINE, and relies on state-of-the-art secure protocols for processing encrypted distributed data and complying with regulations. As such, MedCo can be easily adopted by clinical sites thus paving the way to new unexplored data-sharing use cases. We tested MedCo in a real network of three institutions (EPFL, UNIL and CHUV) by focusing on an oncology use-case with real somatic mutations and clinical tumor data. The relatively low overhead introduced by MedCo shows that it represents a concrete and scalable solution for sharing privacy-conscious medical data.},
keywords = {},
pubstate = {published},
tppubtype = {article}
}

@article{jagadeesh2017deriving,
title = {Deriving genomic diagnoses without revealing patient genomes},
author = {Jagadeesh, Karthik A and Wu, David J and Birgmeier, Johannes A and Boneh, Dan and Bejerano, Gill},
url = {http://science.sciencemag.org/content/357/6352/692.long},
doi = {10.1126/science.aam9710},
year = {2017},
date = {2017-08-18},
journal = {Science},
volume = {357},
number = {6352},
pages = {692--695},
abstract = {Patient genomes are interpretable only in the context of other genomes; however, genome sharing enables discrimination. Thousands of monogenic diseases have yielded definitive genomic diagnoses and potential gene therapy targets. Here we show how to provide such diagnoses while preserving participant privacy through the use of secure multiparty computation. In multiple real scenarios (small patient cohorts, trio analysis, two-hospital collaboration), we used our methods to identify the causal variant and discover previously unrecognized disease genes and variants while keeping up to 99.7% of all participants' most sensitive genomic information private.},
keywords = {},
pubstate = {published},
tppubtype = {article}
}

@article{lippert2017identification,
title = {Identification of individuals by trait prediction using whole-genome sequencing data},
author = {Lippert, Christoph and Sabatini, Riccardo and Maher, M Cyrus and Kang, Eun Yong and Lee, Seunghak and Arikan, Okan and Harley, Alena and Bernal, Axel and Garst, Peter and Lavrenko, Victor and others},
url = {http://www.pnas.org/content/114/38/10166.full},
doi = {10.1073/pnas.1711125114},
year = {2017},
date = {2017-06-28},
journal = {Proceedings of the National Academy of Sciences},
volume = {114},
number = {38},
pages = {10166--10171},
abstract = {Prediction of human physical traits and demographic information from genomic data challenges privacy and data deidentification in personalized medicine. To explore the current capabilities of phenotype-based genomic identification, we applied whole-genome sequencing, detailed phenotyping, and statistical modeling to predict biometric traits in a cohort of 1,061 participants of diverse ancestry. Individually, for a large fraction of the traits, their predictive accuracy beyond ancestry and demographic information is limited. However, we have developed a maximum entropy algorithm that integrates multiple predictions to determine which genomic samples and phenotype measurements originate from the same person. Using this algorithm, we have reidentified an average of >8 of 10 held-out individuals in an ethnically mixed cohort and an average of 5 of either 10 African Americans or 10 Europeans. This work challenges current conceptions of personal privacy and may have far-reaching ethical and legal implications.},
keywords = {},
pubstate = {published},
tppubtype = {article}
}

@article{backesidentifying,
title = {Identifying Personal DNA Methylation Profiles by Genotype Inference},
author = {M. Backes, P. Berrang, M. Bieg, R. Eils, C. Herrmann, M. Humbert and I. Lehmann},
year = {2017},
date = {2017-05-24},
journal = {38th IEEE Symposium on Security and Privacy},
abstract = {Since the first whole-genome sequencing, the biomedical research community has made significant steps to- wards a more precise, predictive and personalized medicine. Genomic data is nowadays widely considered privacy-sensitive and consequently protected by strict regulations and released only after careful consideration. Various additional types of biomedical data, however, are not shielded by any dedicated legal means and consequently disseminated much less thoughtfully. This in particular holds true for DNA methylation data as one of the most important and well-understood epigenetic element influencing human health.
In this paper, we show that, in contrast to the aforementioned belief, releasing one’s DNA methylation data causes privacy issues akin to releasing one’s actual genome. We show that already a small subset of methylation regions influenced by genomic variants are sufficient to infer parts of someone’s genome, and to further map this DNA methylation profile to the corresponding genome. Notably, we show that such re-identification is possible with 97.5% accuracy, relying on a dataset of more than 2500 genomes, and that we can reject all wrongly matched genomes using an appropriate statistical test. We provide means for countering this threat by proposing a novel cryptographic scheme for privately classifying tumors that enables a privacy-respecting medical diagnosis in a common clinical setting. The scheme relies on a combination of random forests and homomorphic encryption, and it is proven secure in the honest-but-curious model. We evaluate this scheme on real DNA methylation data, and show that we can keep the computational overhead to acceptable values for our application scenario.},
keywords = {},
pubstate = {published},
tppubtype = {article}
}

@article{goodman2017identified,
title = {De-identified genomic data sharing: the research participant perspective},
author = {Goodman, Deborah and Johnson, Catherine O and Bowen, Deborah and Smith, Megan and Wenzel, Lari and Edwards, Karen},
editor = {Springer},
doi = {10.1007/s1268},
issn = {1868-6001},
year = {2017},
date = {2017-04-05},
journal = {Journal of Community Genetics},
volume = {8},
pages = {1-9},
abstract = {Combining datasets into larger and separate datasets is becoming increasingly common, and personal identifiers are often removed in order to maintain participant anonymity. Views of research participants on the use of de-identified data in large research datasets are important for future projects, such as the Precision Medicine Initiative and Cancer Moonshot Initiative. This quantitative study set in the USA examines participant preferences and evaluates differences by demographics and cancer history. Study participants were recruited from the Northwest Cancer Genetics Registry and included cancer patients, their relatives, and controls. A secure online survey was administered to 450 participants. While the majority participants were not concerned about personal identification when participating in a genetic study using de-identified data, they expressed their concern that researchers protect their privacy and information. Most participants expressed a desire that their data should be available for as many research studies as possible, and in doing so, they would increase their chance of receiving personal health information. About 20% of participants felt that a link should not be maintained between the participant and their de-identified data. Reasons to maintain a link included an ability to return individual health results and an ability to support further research. Knowledge of participants’ attitudes regarding the use of data into a research repository and the maintenance of a link to de-identified data is critical to the success of recruitment into future genomic research projects.},
keywords = {},
pubstate = {published},
tppubtype = {article}
}

@article{humbert2017quantifying,
title = {Quantifying Interdependent Risks in Genomic Privacy},
author = {Humbert, Mathias and Ayday, Erman and Hubaux, Jean-Pierre and Telenti, Amalio},
year = {2017},
date = {2017-01-01},
journal = {ACM Transactions on Privacy and Security (TOPS)},
volume = {20},
number = {1},
pages = {3},
publisher = {ACM},
keywords = {},
pubstate = {published},
tppubtype = {article}
}

@article{wagner2017evaluating,
title = {Evaluating the Strength of Genomic Privacy Metrics},
author = {Wagner, Isabel},
year = {2017},
date = {2017-01-01},
journal = {ACM Transactions on Privacy and Security (TOPS)},
volume = {20},
number = {1},
pages = {2},
publisher = {ACM},
keywords = {},
pubstate = {published},
tppubtype = {article}
}

@article{wan2017expanding,
title = {Expanding Access to Large-Scale Genomic Data While Promoting Privacy: A Game Theoretic Approach},
author = {Wan, Zhiyu and Vorobeychik, Yevgeniy and Xia, Weiyi and Clayton, Ellen Wright and Kantarcioglu, Murat and Malin, Bradley},
year = {2017},
date = {2017-01-01},
journal = {The American Journal of Human Genetics},
publisher = {Elsevier},
keywords = {},
pubstate = {published},
tppubtype = {article}
}

@article{shi2017overview,
title = {An overview of human genetic privacy},
author = {Shi, Xinghua and Wu, Xintao},
year = {2017},
date = {2017-01-01},
journal = {Annals of the New York Academy of Sciences},
volume = {1387},
number = {1},
pages = {61--72},
publisher = {Wiley Online Library},
keywords = {},
pubstate = {published},
tppubtype = {article}
}

@article{chen2017princess,
title = {PRINCESS: Privacy-protecting Rare disease International Network Collaboration via Encryption through Software guard extensionS},
author = {Chen, Feng and Wang, Shuang and Jiang, Xiaoqian and Ding, Sijie and Lu, Yao and Kim, Jihoon and Sahinalp, S Cenk and Shimizu, Chisato and Burns, Jane C and Wright, Victoria J and others},
year = {2017},
date = {2017-01-01},
journal = {Bioinformatics},
pages = {btw758},
publisher = {Oxford Univ Press},
keywords = {},
pubstate = {published},
tppubtype = {article}
}

@article{Raisaro2017,
title = {Addressing Beacon re-identification attacks: quantification and mitigation of privacy risks},
author = {Raisaro, Jean Louis and Tramèr, Florian and Ji, Zhanglong and Bu, Diyue and Zhao, Yongan and Carey, Knox and Lloyd, David and Sofia, Heidi and Baker, Dixie and Flicek, Paul and Shringarpure, Suyash and Bustamante, Carlos and Wang, Shuang and Jiang, Xiaoqian and Ohno-Machado, Lucila and Tang, Haixu and Wang, XiaoFeng and Hubaux, Jean-Pierre},
url = {https://academic.oup.com/jamia/article/3038412/Addressing},
doi = {10.1093/jamia/ocw167},
issn = {1067-5027},
year = {2017},
date = {2017-01-01},
journal = {Journal of the American Medical Informatics Association},
volume = {0},
number = {0},
pages = {1--8},
keywords = {},
pubstate = {published},
tppubtype = {article}
}

@article{huang2017sqc,
title = {SQC: Secure Quality Control for Meta-Analysis of Genome-Wide Association Studies.},
author = {Huang, Zhicong and Lin, Huang and Fellay, Jacques and Kutalik, Zolt'an and Hubaux, Jean-Pierre},
year = {2017},
date = {2017-01-01},
journal = {Bioinformatics (Oxford, England)},
keywords = {},
pubstate = {published},
tppubtype = {article}
}

@article{mclaren2016privacy,
title = {Privacy-preserving genomic testing in the clinic: a model using HIV treatment},
author = {McLaren, Paul J. and Raisaro, Jean Louis and Aouri, Manel and Rotger, Margalida and Ayday, Erman and Bartha, István and Delgado, Maria B. and Vallet, Yannick and Günthard, Huldrych F. and Cavassini, Matthias and Furrer, Hansjakob and Doco-Lecompte, Thanh and Marzolini, Catia and Schmid, Patrick and Di Benedetto, Caroline and Decosterd, Laurent A. and Fellay, Jacques and Hubaux, Jean-Pierre and Telenti, Amalio and Study, ;the Swiss HIV Cohort},
url = {http://www.nature.com/doifinder/10.1038/gim.2015.167},
doi = {10.1038/gim.2015.167},
issn = {1098-3600},
year = {2016},
date = {2016-08-01},
journal = {Genetics in Medicine},
volume = {18},
number = {8},
pages = {814--822},
publisher = {Nature Publishing Group},
keywords = {},
pubstate = {published},
tppubtype = {article}
}

@article{shimizu2016efficient,
title = {Efficient privacy-preserving string search and an application in genomics},
author = {Shimizu, Kana and Nuida, Koji and R"atsch, Gunnar},
year = {2016},
date = {2016-01-01},
journal = {Bioinformatics},
volume = {32},
number = {11},
pages = {1652--1661},
publisher = {Oxford Univ Press},
keywords = {},
pubstate = {published},
tppubtype = {article}
}