Implementing informed consent in federated medical research: a blueprint designed to safeguard data subject rights in Germany

The establishment of the complementary infrastructures Medical Informatics Initiative (MII) and the Network of University Medicine (NUM) has significantly advanced the medical research landscape in Germany. Both infrastructures focus on the cross-institutional integration of health data as the basis for strengthening medical research, with the MII focusing on the standardization and integration of routine university clinical data and the NUM representing a central infrastructure for clinical studies and data sharing. Within the project 'NUM Routine Data Platform' (NUM-RDP), a federated record linkage approach was implemented across 34 affiliated German university hospitals. Accordingly, a federated Trusted Third Party (fTTP) performed pseudonymization and privacy-preserving record linkage across all the participating sites. This work aims to extend the established fTTP approach to managing consent and withdrawal while considering the current legal frameworks and research initiatives for the use of health data.

A concept for an extended fTTP, termed 'fTTP Consent', is proposed to bridge communication gaps between different sites, facilities and components. This allows for central coordination for the implementation of patients' consent decisions regarding the storage, transfer and scientific use of their health data in a uniform manner.

Two practical use cases for an 'fTTP Consent' have been identified and conceptualized. First, the cross-site improvement of workflows and automated processes should be performed to ensure that consent data are correct in formal, legal, semantic and syntactic terms. Second, the cross-site improvement of automated notification processes for new or updated consent data, including respective withdrawal- and objection-processes, should be performed.

In this study, the 'fTTP Consent' has been proposed to reduce communicatory and personnel efforts. The correct and up-to-date realization of data subject rights should be ensured using the NUM-RDP as an example. The designed concept could help to overcome challenges in different consent scenarios (opt-in, opt-out). Furthermore, it could streamline communication and data linkage processes between institutions and countries in future research projects.