Leping

AMENDMENT NO 1 OF PARTNERSHIP AGREEMENT FOR THE IMPLEMENTATION OF PROJECT FROM THE NORWEGIAN FINANCIAL MECHANISM UPON APPLYING FOR AND USING THE GRANT Estonian Ministry of Social Affairs, registry code 70001952, Suur-Ameerika 1, 10122 Tallinn, represented by Secretary General Maarjo Mändmaa (hereinafter “Applicant of the Grant”), University of Tartu, registry code 74001073, Ülikooli 18, 50090, Tartu, represented by Siret Rutiku (hereinafter “Project Partner 1”), hereinafter individually or collectively also referred to as “Applicant of the Grant” / “Project partner” or “Project partners” or “Parties”, considering the need to develop data serialization/deserialization tool analysis and proof of concept and the extension of the project end date until 30.04.2024, the Parties amend the partnership agreement no 2-2.1/1344-1, signed 01.02.2021 as follows: 1) article 4.1.1.2 is amended and worded as follows: “Provide sufficient amount of representative example data, data queries, and use cases of the data queries to Project partner for their tasks described in Annex 1 and Annex 3. Requirements for data are given in Annex 2.” 2) article 4.1.2.2 is amended and worded as follows: “Develop data serialization/deserialization tool analysis and proof of concept. The scope and details of the work are described in Annex 3.” 3) article 4.1.2.3 is added and worded as follows: “Exchange work results with Applicant of the Grant.” 4) article 5.11 is amended and worded as follows: “to store the original documentation related to the performance of the application, grant, and Project at least until 31 December 2031;” 5) replace current annexes with the annexes of this agreement (Annex 1 – Data obfuscation toolkit: problem, scope, tasks and deliverables; Annex 2 – Requirements for example data; Annex 3 - Data serialization/deserialization tool: project scope, plan and deliverables.) 6) the amendments will enter into force after signing the agreement. Applicant of the Grant: Maarjo Mändmaa Estonian Ministry of Social Affairs /name, signature/ Project partner 1: Siret Rutiku University of Tartu /name, signature/ Annex 1. Data obfuscation toolkit: problem, scope, tasks and deliverables. Problem description Applicant of the Grant manages large quantities of health data, but their use for research is limited, due to sensitivity of the data. There is a risk that due to the amount of details in the data, some individuals could be identified. Therefore, a software tool is needed for applying obfuscation methods on the data, so that detecting particular individuals would be much more difficult. Goal In this Project, a software for conducting data obfuscation is developed. Scope The following assumptions are made:  All input data is given in a single table format, no free text columns/fields.  Persons are already pseudonymized in input data (the obfuscation will not be applied to pseudonyms)  The (obfuscated) result of data query is a single table  The privacy has to be preserved in the context of single result table (if one combines several result tables, the privacy could be affected)  At least the following obfuscation methods are in the interest in this project (will be investigated): o Replacing exact date with year or range of years or year and month or year and quarter or asterisk (*) o Replacing exact address with settlement, city or county level data or asterisk (*) o Replacing exact diagnosis/drug/other hierarchical classifier code with upper level code or asterisk (*) o Replacing value from non-hierarchical classifier with asterisk (*) Tasks Task 1. Data audit, based on example data and queries. Data classification based on sensitivity and use cases. Task 2. Analysis of relevant privacy measures (e.g. k-anonymity, l-Diversity, t-Closeness, differential privacy, local and global sensitivity, etc.). Determine the minimal set of measures that are needed to quantify and assure the required level of privacy. Task 3. Analysis of relevant utility measures. Determine the set of utility measures to avoid data bias after obfuscation. Task 4. Develop obfuscation methods. Task 5. Optimization, based on example data queries, finding optimal balance of privacy and utility. Task 6. Building a software application based on the methods. Project partners agree that the user experience of the software is not the primary priority in this project and will be improved in next projects. Documentation. Task 7. Test and delivery of the software. Timeline Deliverables Estimated total reimbursement for University of Tartu: 153 500 euros (including 15% indirect costs). Month 4 – Data audit (document), describes the data, aggregation levels and sensitivity. Description and reasoning of selected set of privacy measures and utility measures (document). Reimbursement for University of Tartu: 5300 euros (including 15% indirect costs). Month 8 – Initial method tested for data obfuscation. Reimbursement for University of Tartu: 20000 euros (including 15% indirect costs). Month 12 – First prototype of the obfuscation software delivered (application files with source code, installation manual). Reimbursement for University of Tartu: 37100 euros (including 15% indirect costs). Month 16 – Improved version of the obfuscation software delivered with necessary documentation (application files with source code, installation manual, usage instructions) Reimbursement for University of Tartu: 62100 euros (including 15% indirect costs). Month 20 – Final version of obfuscation software delivered with necessary documentation. Reimbursement for University of Tartu: 29000 euros (including 15% indirect costs). Annex 2. Requirements for e data Example data must well represent the data that will be later used for obfuscation from the point of structure, content and size. A number of example datasets are highly recommended. These will be directly used for prototyping and testing the software. From the perspective of data structure, at least two kinds of structures are expected: 1. Narrow format – each row in the data table represents one event. Typical columns are: patient ID, date/datetime, event type, event ID  2. Wide format – each row in the data table is one patient, each column is a separate feature (diagnosis, drug, etc.). From the perspective of data types, at least the following data types are required: 1. Patient ID (pseudonym for linking data of the same patient) 2. Date 3. Diagnosis 4. Drug 5. Address (based on EHAK codes only) We expect that the example data is in CSV/TSV (comma-separated or tab-separated values) format. Annex 3. Data serialization/deserialization tool: project scope, plan and deliverables. Scope University of Tartu is responsible for developing the methods and first versions of the (de)serialization application components. It is the responsibility of TEHIK to prioritise the sections of medical documents that need to be (de)serialised, open access to test data and test environment and to deploy/run the applications. It is outside of the scope of this contract to build production applications based on the methods and tools of this work. Estimated total reimbursement for University of Tartu: 300760 euros (including 15% indirect costs). Timeline and tasks Main tasks and timeline is provided below. Sep 2022 Project kick-off, initial tasks for managing the project. Reimbursement for University of Tartu: 3760 euros (including 15% indirect costs). Oct 2022 – Jan 2023 University of Tartu Project partner Initial set-up of development Opening the access for the project team to TEHIK test environment environment Develop scripts for converting XML Develop and run the pipeline for importing medical data to JSON format and importing to documents to Vertica as XML including Vertica. anonymization where needed  Develop first version of data schema Deliver exact description of NAKIS data fields and for NAKIS populated with example existing mappings to CDA XML schemas to data UTARTU Reimbursement for University of Tartu: 51000 euros (including 15% indirect costs). Feb 2023 – May 2023 University of Tartu Project partner Improve data import scripts for NAKIS data tables Test and provide feedback of the scripts General decomposition of JSON documents into sections. Reimbursement for University of Tartu: 51000 euros (including 15% indirect costs). Jun 2023 – Sep 2023 University of Tartu Project partner Generalise automatic data extraction scripts Prioritise medical document types and outside the scope of NAKIS data tables relevant sections for extraction Test and provide feedback of the scripts Reimbursement for University of Tartu: 67000 euros (including 15% indirect costs). Oct 2023 – Jan 2024 University of Tartu Project partner Develop scripts for continuous improvement of data Test and provide feedback of the extraction scripts scripts Reimbursement for University of Tartu: 77000 euros (including 15% indirect costs). Feb 2024 – Apr 2024 University of Tartu Project partner  Testing Test and provide feedback for delivered software and documentation Refinement of existing scripts Write final documentation Reimbursement for University of Tartu: 51000 euros (including 15% indirect costs).