A data flow process for confidential data and its application in a health research project

Samantha S. R. Crossfield; Kieran Zucker; Paul Baxter; Penny Wright; Jon Fistein; Alex F. Markham; Mark Birkin; Adam W. Glaser; Geoff Hall

doi:10.1371/journal.pone.0262609

Peer Review History

Original SubmissionSeptember 13, 2021
8 Oct 2021 Decision Letter - Pandi Vijayakumar, Editor PONE-D-21-29276A data flow process for confidential data and its application in a health research projectPLOS ONE Dear Dr. Crossfield, Thank you for submitting your manuscript to PLOS ONE. After careful consideration, we feel that it has merit but does not fully meet PLOS ONE’s publication criteria as it currently stands. Therefore, we invite you to submit a revised version of the manuscript that addresses the points raised during the review process. Please submit your revised manuscript by Nov 22 2021 11:59PM. If you will need more time than this to complete your revisions, please reply to this message or contact the journal office at plosone@plos.org. When you're ready to submit your revision, log on to https://www.editorialmanager.com/pone/ and select the 'Submissions Needing Revision' folder to locate your manuscript file. Please include the following items when submitting your revised manuscript: A rebuttal letter that responds to each point raised by the academic editor and reviewer(s). You should upload this letter as a separate file labeled 'Response to Reviewers'. A marked-up copy of your manuscript that highlights changes made to the original version. You should upload this as a separate file labeled 'Revised Manuscript with Track Changes'. An unmarked version of your revised paper without tracked changes. You should upload this as a separate file labeled 'Manuscript'. If you would like to make changes to your financial disclosure, please include your updated statement in your cover letter. Guidelines for resubmitting your figure files are available below the reviewer comments at the end of this letter. If applicable, we recommend that you deposit your laboratory protocols in protocols.io to enhance the reproducibility of your results. Protocols.io assigns your protocol its own identifier (DOI) so that it can be cited independently in the future. For instructions see: https://journals.plos.org/plosone/s/submission-guidelines#loc-laboratory-protocols. Additionally, PLOS ONE offers an option for publishing peer-reviewed Lab Protocol articles, which describe protocols hosted on protocols.io. Read more information on sharing protocols at https://plos.org/protocols?utm_medium=editorial-email&utm_source=authorletters&utm_campaign=protocols. We look forward to receiving your revised manuscript. Kind regards, Pandi Vijayakumar, Ph.D Academic Editor PLOS ONE Journal Requirements: When submitting your revision, we need you to address these additional requirements. 1. Please ensure that your manuscript meets PLOS ONE's style requirements, including those for file naming. The PLOS ONE style templates can be found at https://journals.plos.org/plosone/s/file?id=wjVg/PLOSOne_formatting_sample_main_body.pdf and https://journals.plos.org/plosone/s/file?id=ba62/PLOSOne_formatting_sample_title_authors_affiliations.pdf 2. Thank you for stating the following in the Acknowledgments Section of your manuscript: "We would like to acknowledge the funding and support from Macmillan Cancer Support (106451), the Economic and Social Research Council (ES/L011891/1) and Medical Research Council (MR/L01629X)." We note that you have provided funding information that is not currently declared in your Funding Statement. However, funding information should not appear in the Acknowledgments section or other areas of your manuscript. We will only publish funding information present in the Funding Statement section of the online submission form. Please remove any funding-related text from the manuscript and let us know how you would like to update your Funding Statement. Currently, your Funding Statement reads as follows: "SSRC, KZ, PB, PW, JF, AWG and GH were supported by Macmillan Cancer Support (106451) [https://www.macmillan.org.uk/]. SSRC and AFM were supported by the Medical Research Council Leeds Medical Bioinformatics Centre (MR/L01629X) [https://gtr.ukri.org/projects?ref=MR%2FL01629X%2F1]. Mark Birkin was supported by the Economic and Social Research Council (ESRC) Consumer Research Data Centre (ES/L011891/1) [https://www.cdrc.ac.uk/]. The funders had no role in study design, data collection and analysis, decision to publish, or preparation of the manuscript." Please include your amended statements within your cover letter; we will change the online submission form on your behalf. 3. We note that you have indicated that data from this study are available upon request. PLOS only allows data to be available upon request if there are legal or ethical restrictions on sharing data publicly. For more information on unacceptable data access restrictions, please see http://journals.plos.org/plosone/s/data-availability#loc-unacceptable-data-access-restrictions. In your revised cover letter, please address the following prompts: a) If there are ethical or legal restrictions on sharing a de-identified data set, please explain them in detail (e.g., data contain potentially sensitive information, data are owned by a third-party organization, etc.) and who has imposed them (e.g., an ethics committee). Please also provide contact information for a data access committee, ethics committee, or other institutional body to which data requests may be sent. b) If there are no restrictions, please upload the minimal anonymized data set necessary to replicate your study findings as either Supporting Information files or to a stable, public repository and provide us with the relevant URLs, DOIs, or accession numbers. For a list of acceptable repositories, please see http://journals.plos.org/plosone/s/data-availability#loc-recommended-repositories. We will update your Data Availability statement on your behalf to reflect the information you provide. 4. Please include your full ethics statement in the ‘Methods’ section of your manuscript file. In your statement, please include the full name of the IRB or ethics committee who approved or waived your study, as well as whether or not you obtained informed written or verbal consent. If consent was waived for your study, please include this information in your statement as well. Additional Editor Comments: Based on the comments of the reviewers, I recommend major revision. [Note: HTML markup is below. Please do not edit.] Reviewers' comments: Reviewer's Responses to Questions Comments to the Author 1. Is the manuscript technically sound, and do the data support the conclusions? The manuscript must describe a technically sound piece of scientific research with data that supports the conclusions. Experiments must have been conducted rigorously, with appropriate controls, replication, and sample sizes. The conclusions must be drawn appropriately based on the data presented. Reviewer #1: Yes Reviewer #2: Yes ******** 2. Has the statistical analysis been performed appropriately and rigorously? Reviewer #1: Yes Reviewer #2: Yes ****** 3. Have the authors made all data underlying the findings in their manuscript fully available? The PLOS Data policy requires authors to make all data underlying the findings described in their manuscript fully available without restriction, with rare exception (please refer to the Data Availability Statement in the manuscript PDF file). The data should be provided as part of the manuscript or its supporting information, or deposited to a public repository. For example, in addition to summary statistics, the data points behind means, medians and variance measures should be available. If there are restrictions on publicly sharing data—e.g. participant privacy or use of data from a third party—those must be specified. Reviewer #1: Yes Reviewer #2: Yes ****** 4. Is the manuscript presented in an intelligible fashion and written in standard English? PLOS ONE does not copyedit accepted manuscripts, so the language in submitted articles must be clear, correct, and unambiguous. Any typographical or grammatical errors should be corrected at revision, so please note any specific errors here. Reviewer #1: Yes Reviewer #2: Yes ****** 5. Review Comments to the Author Please use the space provided to explain your answers to the questions above. You may also include additional comments for the author, including concerns about dual publication, research ethics, or publication ethics. (Please upload your review as an attachment if it exceeds 20,000 characters) Reviewer #1: Linking the research datasets of patients without divulging the sensitive medical information of patients and hospitals is very difficult. This research work, in this line, has proposed a dataflow protocol for anonymous linked datasets for research purposes. It is accomplished by Comprehensive Patient Records study in Leeds, United Kingdom with data from two providers which contains the details of 3, 65, 193 patients. The protocol design has been verified by research advisory groups. The authors have received the legal advice for this protocol that it maintains ethical as well as legal requirements. This protocol will be very useful during the Covid-19 situations to analyze and identify any useful patterns. The use of OpenPseudonymiser for creating secure digests and linking the digests while preventing backward engineering seems to be very useful. Reviewer #2: Authors presented a technological impact of trust in Social Government during COVID-19 crisis. Though, paper covers important topic, technical contribution of this paper is limited. Also, following comments need to be addressed in the revised manuscript: -Highlight your contribution clearly in Abstract section. -Mention the quantitative findings of this research in the abstract section. -Fig. 1 is not explained properly. -Also, in some figures, captions are not proper. -Introduction section needs to be re-written to improve its quality and readability. -Put some more light on concept of the paper and its usability to the industry and society. -Paper needs to polish and provide a detailed explication of theoretical aspects such as conditions and theorems, and practical issues like algorithms, rules and possible applications. -Following are some of relevant and recent references which can be referred in the revised manuscript: Provably Secure Data Sharing Approach for Personal Health Records in Cloud Storage Using Session Password, Data Access Key, and Circular Interpolation, Capability based outsourced data access control with assured file deletion and efficient revocation with trust factor in cloud computing, IoT-based big data secure management in the fog over a 6G wireless network, Efficient escrow-free CP-ABE with constant size ciphertext and secret key for big data storage in cloud, A novel CNN based security guaranteed image watermarking generation scenario for smart city applications. -In the conclusion section, I suggest, to highlighting the new discovery, new inventions and new aspects of the research. -Improve overall flow of this paper for better understanding. ****** 6. PLOS authors have the option to publish the peer review history of their article (what does this mean?). If published, this will include your full peer review and any attached files. If you choose “no”, your identity will remain anonymous but your review may still be made public. Do you want your identity to be public for this peer review?** For information about this choice, including consent withdrawal, please see our Privacy Policy. Reviewer #1: No Reviewer #2: No [NOTE: If reviewer comments were submitted as an attachment file, they will be attached to this email and accessible via the submission site. Please log into your account, locate the manuscript record, and check for the action link "View Attachments". If this link does not appear, there are no attachment files.] While revising your submission, please upload your figure files to the Preflight Analysis and Conversion Engine (PACE) digital diagnostic tool, https://pacev2.apexcovantage.com/. PACE helps ensure that figures meet PLOS requirements. To use PACE, you must first register as a user. Registration is free. Then, login and navigate to the UPLOAD tab, where you will find detailed instructions on how to use the tool. If you encounter any issues or have any questions when using PACE, please email PLOS at figures@plos.org. Please note that Supporting Information files do not need this step. https://doi.org/10.1371/journal.pone.0262609.r001
Revision 1
11 Nov 2021 Author Response Thank you for the feedback and opportunity to address the comments raised. We have added our response to all points raised by the reviewers in line below, and in the attached 'Response to Reviewers' document. Line references correspond to the attached ‘Revised Manuscript with Track Changes’. Reviewer #1: Linking the research datasets of patients without divulging the sensitive medical information of patients and hospitals is very difficult. This research work, in this line, has proposed a dataflow protocol for anonymous linked datasets for research purposes. It is accomplished by Comprehensive Patient Records study in Leeds, United Kingdom with data from two providers which contains the details of 365, 193 patients. The protocol design has been verified by research advisory groups. The authors have received the legal advice for this protocol that it maintains ethical as well as legal requirements. This protocol will be very useful during the Covid-19 situations to analyze and identify any useful patterns. The use of OpenPseudonymiser for creating secure digests and linking the digests while preventing backward engineering seems to be very useful. Many thanks for your review and feedback. Reviewer #2: Authors presented a technological impact of trust in Social Government during COVID-19 crisis. Though, paper covers important topic, technical contribution of this paper is limited. Also, following comments need to be addressed in the revised manuscript: -Highlight your contribution clearly in Abstract section. We believe that this manuscript contributes a linkage and anonymisation approach with clear steps for creating a research dataset in line with ethico-legal requirements. We also produced a research dataset that has important value for cancer research and describe how it has been made accessible. We have now clarified this by highlighting the issue, study aim and contribution in the abstract (lines 28-30, 34-36 and 52-53). -Mention the quantitative findings of this research in the abstract section. The main findings of the research were that a) a data flow protocol was defined for linking and anonymising data with ethico-legal approval; and b) the data flow protocol was successfully applied in a case study in which data regarding 365,193 patients was linked and anonymised from two healthcare providers. The invaluable cancer dataset that was created is now available for use in research We have now highlighted this more clearly in the abstract (lines 43-49) -Fig. 1 is not explained properly. Thank you for the opportunity to provide further clarity. The data flow protocol that is defined in the manuscript was utilised in a case study. Figure 1 depicts the parties involved in data handling in this case study: the data transfers, the linkage and anonymisation actions performed, and the research access granted to the final (linked and anonymised) research dataset. We have now added a description of the information in Figure 1 (lines 289-290) and further clarified the caption for Fig 1 (lines 308-309). -Also, in some figures, captions are not proper. We have now amended the captions for both Fig 1 and Fig 2, by adding further descriptive detail (lines 307-312). -Introduction section needs to be re-written to improve its quality and readability. The Introduction section has been refined throughout, to clarify the issues that the manuscript addresses and to improve readability (lines 65-67, 76-80, 86-87, 93-99, 106-114, 119-123, 132-136). -Put some more light on concept of the paper and its usability to the industry and society. As described above, we have now defined the aim and contribution more clearly in the Abstract, and also in the Conclusions section as described in response to a further comment below. We have also elaborated on the concept of the paper and its contribution to industry and society in the Introduction (lines 132-136) and Discussion (lines 316-322). -Paper needs to polish and provide a detailed explication of theoretical aspects such as conditions and theorems, and practical issues like algorithms, rules and possible applications. We have now refined the flow of this paper through general changes throughout. We have also now explicitly referenced the technical detail of the data flow and worked examples of pseudonymisation that are provided in the Supporting Information (lines 279-281). The glossary of terms in the Supporting Information, which provides further explication, is also now referenced. Further, we have now highlighted the possible application of the described approach in addressing practical issues in enabling the secondary use of data for research (e.g. Abstract, Conclusions, and lines 316-322). We have made explicit that the protocol is shared and access to the CPR dataset is made available, both in order to assist in future research projects (lines 268, 321-324). -Following are some of relevant and recent references which can be referred in the revised manuscript: Provably Secure Data Sharing Approach for Personal Health Records in Cloud Storage Using Session Password, Data Access Key, and Circular Interpolation, Capability based outsourced data access control with assured file deletion and efficient revocation with trust factor in cloud computing, IoT-based big data secure management in the fog over a 6G wireless network, Efficient escrow-free CP-ABE with constant size ciphertext and secret key for big data storage in cloud, A novel CNN based security guaranteed image watermarking generation scenario for smart city applications. Thank you for providing references to these manuscripts, which have now been cited as relevant (lines 74-75). -In the conclusion section, I suggest, to highlighting the new discovery, new inventions and new aspects of the research. The manuscript contributes a) a data flow protocol for linkage and anonymisation, b) description of a case study that successfully utilised the data flow protocol, in the healthcare domain, and information on how to request access to the resultant dataset; and c) a proposed approach and recommended criteria for cross-accreditation between organisations that handle data. The Conclusions section has now been amended to highlight these three contributions (lines 472-481. -Improve overall flow of this paper for better understanding. We have now improved the flow of this paper to aid understanding, through general changes applied throughout the manuscript. Attachments Attachment Submitted filename: Response to Reviewers.docx https://doi.org/10.1371/journal.pone.0262609.r002
24 Nov 2021 Decision Letter - Pandi Vijayakumar, Editor PONE-D-21-29276R1A data flow process for confidential data and its application in a health research projectPLOS ONE Dear Dr. Crossfield, Thank you for submitting your manuscript to PLOS ONE. After careful consideration, we feel that it has merit but does not fully meet PLOS ONE’s publication criteria as it currently stands. Therefore, we invite you to submit a revised version of the manuscript that addresses the points raised during the review process. Please submit your revised manuscript by Jan 08 2022 11:59PM. If you will need more time than this to complete your revisions, please reply to this message or contact the journal office at plosone@plos.org. When you're ready to submit your revision, log on to https://www.editorialmanager.com/pone/ and select the 'Submissions Needing Revision' folder to locate your manuscript file. Please include the following items when submitting your revised manuscript: A rebuttal letter that responds to each point raised by the academic editor and reviewer(s). You should upload this letter as a separate file labeled 'Response to Reviewers'. A marked-up copy of your manuscript that highlights changes made to the original version. You should upload this as a separate file labeled 'Revised Manuscript with Track Changes'. An unmarked version of your revised paper without tracked changes. You should upload this as a separate file labeled 'Manuscript'. If you would like to make changes to your financial disclosure, please include your updated statement in your cover letter. Guidelines for resubmitting your figure files are available below the reviewer comments at the end of this letter. If applicable, we recommend that you deposit your laboratory protocols in protocols.io to enhance the reproducibility of your results. Protocols.io assigns your protocol its own identifier (DOI) so that it can be cited independently in the future. For instructions see: https://journals.plos.org/plosone/s/submission-guidelines#loc-laboratory-protocols. Additionally, PLOS ONE offers an option for publishing peer-reviewed Lab Protocol articles, which describe protocols hosted on protocols.io. Read more information on sharing protocols at https://plos.org/protocols?utm_medium=editorial-email&utm_source=authorletters&utm_campaign=protocols. We look forward to receiving your revised manuscript. Kind regards, Pandi Vijayakumar, Ph.D Academic Editor PLOS ONE Journal Requirements: Please review your reference list to ensure that it is complete and correct. If you have cited papers that have been retracted, please include the rationale for doing so in the manuscript text, or remove these references and replace them with relevant current references. Any changes to the reference list should be mentioned in the rebuttal letter that accompanies your revised manuscript. If you need to cite a retracted article, indicate the article’s retracted status in the References list and also include a citation and full reference for the retraction notice. Additional Editor Comments : Based on the reviewers comments, I recommend the paper for minor revision. [Note: HTML markup is below. Please do not edit.] Reviewers' comments: Reviewer's Responses to Questions Comments to the Author 1. If the authors have adequately addressed your comments raised in a previous round of review and you feel that this manuscript is now acceptable for publication, you may indicate that here to bypass the “Comments to the Author” section, enter your conflict of interest statement in the “Confidential to Editor” section, and submit your "Accept" recommendation. Reviewer #1: (No Response) Reviewer #2: (No Response) ******** 2. Is the manuscript technically sound, and do the data support the conclusions? The manuscript must describe a technically sound piece of scientific research with data that supports the conclusions. Experiments must have been conducted rigorously, with appropriate controls, replication, and sample sizes. The conclusions must be drawn appropriately based on the data presented. Reviewer #1: Yes Reviewer #2: (No Response) ****** 3. Has the statistical analysis been performed appropriately and rigorously? Reviewer #1: Yes Reviewer #2: (No Response) ****** 4. Have the authors made all data underlying the findings in their manuscript fully available? The PLOS Data policy requires authors to make all data underlying the findings described in their manuscript fully available without restriction, with rare exception (please refer to the Data Availability Statement in the manuscript PDF file). The data should be provided as part of the manuscript or its supporting information, or deposited to a public repository. For example, in addition to summary statistics, the data points behind means, medians and variance measures should be available. If there are restrictions on publicly sharing data—e.g. participant privacy or use of data from a third party—those must be specified. Reviewer #1: Yes Reviewer #2: (No Response) ****** 5. Is the manuscript presented in an intelligible fashion and written in standard English? PLOS ONE does not copyedit accepted manuscripts, so the language in submitted articles must be clear, correct, and unambiguous. Any typographical or grammatical errors should be corrected at revision, so please note any specific errors here. Reviewer #1: Yes Reviewer #2: (No Response) ****** 6. Review Comments to the Author Please use the space provided to explain your answers to the questions above. You may also include additional comments for the author, including concerns about dual publication, research ethics, or publication ethics. (Please upload your review as an attachment if it exceeds 20,000 characters) Reviewer #1: The proposed work is about the utilization of valuable health data of patients. The idea of patient confidentiality is clearly maintained by anonymizing the data and linking them together for research and other application purposes. The authors claim that, the work has potential applications not only in England and European Union as the handled datasets is pertaining to these geographical locations, but to the global scale. But, I suggest the authors clarify in what way is this research work related to security. Apart from this, many worthwhile contributions such as 1. "An efficient anonymous authentication and confidentiality preservation schemes for secure communications in wireless body area networks" 2. "A new SmartSMS protocol for secure SMS communication in m-health environment" 3. "An efficient anonymous authentication and key agreement scheme with privacy-preserving for smart cities" to be added to the review section of this article to make it oriented towards confidentiality and security concerns. As a whole, this research work is a novel proposal by the authors and if the suggestions are incorporated, the paper can be considered for possible publication in your esteemed journal. Reviewer #2: A data flow process for confidential data and its application in a health research project is presented in this paper. Paper is revised well. It can be accepted now. ****** 7. PLOS authors have the option to publish the peer review history of their article (what does this mean?). If published, this will include your full peer review and any attached files. If you choose “no”, your identity will remain anonymous but your review may still be made public. Do you want your identity to be public for this peer review?** For information about this choice, including consent withdrawal, please see our Privacy Policy. Reviewer #1: No Reviewer #2: No [NOTE: If reviewer comments were submitted as an attachment file, they will be attached to this email and accessible via the submission site. Please log into your account, locate the manuscript record, and check for the action link "View Attachments". If this link does not appear, there are no attachment files.] While revising your submission, please upload your figure files to the Preflight Analysis and Conversion Engine (PACE) digital diagnostic tool, https://pacev2.apexcovantage.com/. PACE helps ensure that figures meet PLOS requirements. To use PACE, you must first register as a user. Registration is free. Then, login and navigate to the UPLOAD tab, where you will find detailed instructions on how to use the tool. If you encounter any issues or have any questions when using PACE, please email PLOS at figures@plos.org. Please note that Supporting Information files do not need this step. https://doi.org/10.1371/journal.pone.0262609.r003
Revision 2
9 Dec 2021 Author Response Thank you for the feedback and opportunity to address the comments raised. We have added our response to all points raised by the reviewers in line below, and as described in the attached 'Response to Reviewers'. Line references correspond to the attached ‘Revised Manuscript with Track Changes’. Reviewer #1: The proposed work is about the utilization of valuable health data of patients. The idea of patient confidentiality is clearly maintained by anonymizing the data and linking them together for research and other application purposes. The authors claim that, the work has potential applications not only in England and European Union as the handled datasets is pertaining to these geographical locations, but to the global scale. But, I suggest the authors clarify in what way is this research work related to security. As described in lines 432-435, use of the protocol encourages consideration of the wider information security and governance framework, including the adoption of mechanisms for secure data transfer and restricting data access as appropriate. We acknowledge that the research has not directly developed any security feature, but rather the research work relates to security through guiding protocol users through the steps and security measures to be considered during linkage and anonymisation exercises. We have therefore now clarified that the protocol relates to the linkage and anonymisation of data, rather than security directly (lines 299, 305). Apart from this, many worthwhile contributions such as 1. "An efficient anonymous authentication and confidentiality preservation schemes for secure communications in wireless body area networks" 2. "A new SmartSMS protocol for secure SMS communication in m-health environment" 3. "An efficient anonymous authentication and key agreement scheme with privacy-preserving for smart cities" to be added to the review section of this article to make it oriented towards confidentiality and security concerns. Thank you for these references. We have now discussed and cited these as appropriate in the manuscript (lines 73, 112-113, 406-408, 423-424). As a whole, this research work is a novel proposal by the authors and if the suggestions are incorporated, the paper can be considered for possible publication in your esteemed journal. Many thanks for your review and guidance. Reviewer #2: A data flow process for confidential data and its application in a health research project is presented in this paper. Paper is revised well. It can be accepted now. Many thanks for your review and feedback. Attachments Attachment Submitted filename: Response to Reviewers.docx https://doi.org/10.1371/journal.pone.0262609.r004
31 Dec 2021 Decision Letter - Pandi Vijayakumar, Editor A data flow process for confidential data and its application in a health research project PONE-D-21-29276R2 Dear Dr. Crossfield, We’re pleased to inform you that your manuscript has been judged scientifically suitable for publication and will be formally accepted for publication once it meets all outstanding technical requirements. Within one week, you’ll receive an e-mail detailing the required amendments. When these have been addressed, you’ll receive a formal acceptance letter and your manuscript will be scheduled for publication. An invoice for payment will follow shortly after the formal acceptance. To ensure an efficient process, please log into Editorial Manager at http://www.editorialmanager.com/pone/, click the 'Update My Information' link at the top of the page, and double check that your user information is up-to-date. If you have any billing related questions, please contact our Author Billing department directly at authorbilling@plos.org. If your institution or institutions have a press office, please notify them about your upcoming paper to help maximize its impact. If they’ll be preparing press materials, please inform our press team as soon as possible -- no later than 48 hours after receiving the formal acceptance. Your manuscript will remain under strict press embargo until 2 pm Eastern Time on the date of publication. For more information, please contact onepress@plos.org. Kind regards, Pandi Vijayakumar, Ph.D Academic Editor PLOS ONE Additional Editor Comments (optional): Based on the comments of the reviewers, I strongly accept this paper for publication. Reviewers' comments: Reviewer's Responses to Questions Comments to the Author 1. If the authors have adequately addressed your comments raised in a previous round of review and you feel that this manuscript is now acceptable for publication, you may indicate that here to bypass the “Comments to the Author” section, enter your conflict of interest statement in the “Confidential to Editor” section, and submit your "Accept" recommendation. Reviewer #1: All comments have been addressed Reviewer #2: All comments have been addressed ******** 2. Is the manuscript technically sound, and do the data support the conclusions? The manuscript must describe a technically sound piece of scientific research with data that supports the conclusions. Experiments must have been conducted rigorously, with appropriate controls, replication, and sample sizes. The conclusions must be drawn appropriately based on the data presented. Reviewer #1: Yes Reviewer #2: Yes ****** 3. Has the statistical analysis been performed appropriately and rigorously? Reviewer #1: Yes Reviewer #2: Yes ****** 4. Have the authors made all data underlying the findings in their manuscript fully available? The PLOS Data policy requires authors to make all data underlying the findings described in their manuscript fully available without restriction, with rare exception (please refer to the Data Availability Statement in the manuscript PDF file). The data should be provided as part of the manuscript or its supporting information, or deposited to a public repository. For example, in addition to summary statistics, the data points behind means, medians and variance measures should be available. If there are restrictions on publicly sharing data—e.g. participant privacy or use of data from a third party—those must be specified. Reviewer #1: Yes Reviewer #2: Yes ****** 5. Is the manuscript presented in an intelligible fashion and written in standard English? PLOS ONE does not copyedit accepted manuscripts, so the language in submitted articles must be clear, correct, and unambiguous. Any typographical or grammatical errors should be corrected at revision, so please note any specific errors here. Reviewer #1: Yes Reviewer #2: (No Response) ****** 6. Review Comments to the Author Please use the space provided to explain your answers to the questions above. You may also include additional comments for the author, including concerns about dual publication, research ethics, or publication ethics. (Please upload your review as an attachment if it exceeds 20,000 characters) Reviewer #1: (No Response) Reviewer #2: A data flow process for confidential data and its application in a health research project is presented in this paper. It can be accepted now. ****** 7. PLOS authors have the option to publish the peer review history of their article (what does this mean?). If published, this will include your full peer review and any attached files. If you choose “no”, your identity will remain anonymous but your review may still be made public. Do you want your identity to be public for this peer review?** For information about this choice, including consent withdrawal, please see our Privacy Policy. Reviewer #1: No Reviewer #2: No https://doi.org/10.1371/journal.pone.0262609.r005
Formally Accepted
10 Jan 2022 Acceptance Letter - Pandi Vijayakumar, Editor PONE-D-21-29276R2 A data flow process for confidential data and its application in a health research project Dear Dr. Crossfield: I'm pleased to inform you that your manuscript has been deemed suitable for publication in PLOS ONE. Congratulations! Your manuscript is now with our production department. If your institution or institutions have a press office, please let them know about your upcoming paper now to help maximize its impact. If they'll be preparing press materials, please inform our press team within the next 48 hours. Your manuscript will remain under strict press embargo until 2 pm Eastern Time on the date of publication. For more information please contact onepress@plos.org. If we can help with anything else, please email us at plosone@plos.org. Thank you for submitting your work to PLOS ONE and supporting open access. Kind regards, PLOS ONE Editorial Office Staff on behalf of Dr. Pandi Vijayakumar Academic Editor PLOS ONE https://doi.org/10.1371/journal.pone.0262609.r006

Open letter on the publication of peer review reports

PLOS recognizes the benefits of transparency in the peer review process. Therefore, we enable the publication of all of the content of peer review and author responses alongside final, published articles. Reviewers remain anonymous, unless they choose to reveal their names.

We encourage other journals to join us in this initiative. We hope that our action inspires the community, including researchers, research funders, and research institutions, to recognize the benefits of published peer review reports for all parts of the research system.

Learn more at ASAPbio .