Biometric linkage of longitudinally collected electronic case report forms and confirmation of subject identity: An open framework for ODK and related tools

BACKGROUND

Access to official identification credentials is a crucial step in providing access to (among others) social and fiscal services, political franchise, free travel, birth registration and social engagement. An estimated one-billion people, and more than half of all people living in low- and middle-income countries (LMICs), possess no form of officially recognised identification credentials (1). Identifying, and later confirming the identity of individuals living as members of what The World Bank described as the ‘invisible billion’ is a substantial challenge not only to excluded individuals and communities, but also to governments and other agencies acting in the interest of excluded communities. Within the sphere of public health work carried out in locales where official identification credentials are not available, there have been historical challenges when agencies have needed to identify and to later confirm the identity of participants/subjects of research, clinical trials and interventions.

Clinical trials provide a powerful use-case for the development of novel systems for identifying and confirming identity of stakeholders from the invisible billion. Trials commonly aim to demonstrate the [a] efficacy and [b] safety of a public health intervention; outcomes that with rare exception require data collection to be longitudinal, heterogeneous, asynchronous and complex. The veracity of trial data is a paramount concern of Good Clinical Practice (GCP), the international standards for conduct and reporting of trials; but no gold standard method exists for confirming participant identities at different stages in the progress of a participant through a trial’s protocol. This raises problems that [a] different case report forms (CRFs) which nominally relate to the same participant might in fact derive from two or more distinct individuals and [b] serious adverse events (SAEs) could be inappropriately attributed (or not) to the trial intervention. The first problem compromises the study design and conclusions, whilst the second could lead to the early halting (or inappropriate continuance) of the trial, false positive/negative results and serious patient, community or public health harms.

Such studies are bound by a range of national and international data laws such as the General Data Protection Regulation (EU, 2016/679). Among other laws of similar effect, GDPR (2) protects the data of participants (also known as “data subjects”) from improper processing, whilst simultaneously enshrining in law their broad-ranging legal rights to access, edit or request the erasure of data about them, including data derived from any information and biological specimens they may have provided during their participation. Thus, researchers must be able to effectively identify any participant and link them to their data in order to comply with requests for data deletion.

Digital authentication mechanisms based on biometric data have been proposed as a potential cornerstone in the future of inclusive and trusted identification methods (1). The recent availability of low-cost biometric hardware sensors and software makes it possible to rapidly, affordably and securely sample and store, alongside clinical trial (or other) data, a unique and invariant biological signature (or biometric “template”) of a study participant. By later being able to compare any two templates (i.e. from different CRFs), records can be linked and the identity can be confirmed in a way that is quantifiable, reproducible and automatable. Fingerprint templates are well described data entities that are regulated in the international standard ISO 19794-2:2005 (3,4) and the interoperable ANSI INCITS 378-2004 standard. Templates do not take the form of a photograph or image of a recognisable fingerprint; rather they are an encoded text representation of the characteristic features of the fingerprint. Although iris (5), ear (6) and other sources of biometric templates have been explored and may be preferable in some contexts, fingerprints remain the most familiar form of biometric datum.

The development of novel biometrics systems has taken place alongside the rapid development of electronic data collection (EDC) systems. Historically, clinical trials relied on the use of paper CRFs, but over the last 15-20 years, there has been a widespread shift towards the use of electronic systems. The rate of adoption of EDCs in research and trials has been globally uneven, partly because of the relatively slower development of web infrastructure and limited penetration of the internet in some countries, regions and communities. A raft of EDC tools aimed specifically at work in LMICs have recently become available. These predominantly app-based tools, which include ODK (7), Ona Data (8), KoBoToolbox (9), SurveyCTO (10), CommCare by Dimagi (11) Enketo (12), REDCap (13), OpenClinica (14) and DHIS2 (15) all have the capability to function without reliable internet connections and can be used to generate digitised data sets of very high quality in even the most inhospitable and complex settings (16). Several of these platforms (ODK, SurveyCTO, KoBoToolbox, Ona and CommCare) are derived from a common code-base (ODK) and have overlapping functions, but none of these software platforms currently provide a robust built-in method for capturing verifiable biometric proof of identity data that can be used to later [1] link CRFs that were collected at different times or [2] confirm the identity of a participant requesting deletion of their data.

Low cost and portable biometrics sensors, used in combination with electronic data collection tools such as ODK, provide a potential solution to the problems of participant identification and CRF linkages. In this study, we report the development of a novel open-source app and associated method for capturing and matching ANSI INCITS 378-2004 fingerprint templates during data collection with ODK and related data tools. By focussing on the use of predominantly open-source code with an affordable (<£50) and mass-produced model of fingerprint sensor, we make this platform freely available to all global users of ODK, Ona, KoBoToolbox, SurveyCTO and CommCare.

METHODS

RESULTS

All code and working software releases of the app and CLI (v0.3) are provided in Supplementary File 1. The most recent version of the app and CLI are available from our code repository (21).

Template matching

Overall, 1,010 true positive fingerprint template pairs (n = 2,020 individual templates) were provided by 202 consenting participants with different skin tones, qualities and conditions (Table 1). 1,010 true negative pairs were synthesised as described above. The mean score for a comparison between templates of a true positive pair was S = 163.0 (median 159.4, min 0.6, max 472.7, IQR 97.0 - 219.5). For true negative template pairs, the mean score was S = 5 (median 3.6, min 0.0, max 31.3). ROC analysis of 1,010 true positive and 1,010 true negative template pairs revealed an area under the curve (AUC) of 0.99 (Figure 1A). At the threshold score (T) of T = 27, the fingerprint matching algorithm had a false positive rate of 0.001 and true positive rate of 0.95. A threshold of T = 27 was subsequently used as the cut-point between mismatched (S < 27) and matched (S >= 27) template pairs. A total of 52 (5.14%) true positive pairs were falsely classified as negative. Among the true negative template pairs, just one pair returned a false positive result (S = 31.26).

View this table:

• View inline
• View popup
• Download powerpoint

Table 1: Characteristics of study participants and their skin.

• Download figure
• Open in new tab

Figure 1:

A. ROC analysis (Single Finger). The area under the ROC curve for any pair of fingerprint templates was 0.99. This analysis was based on 1,010 true positive and 1,010 true negative template pairs. B. Assay performance variations by finger. There was a progressive (from thumb to pinkie) decrease in the average score of a true positive template pair according to which finger was used. C. ROC analysis (score summed across thumb, index and middle finger) The area under the ROC curve was 1.00, indicating a perfect delineation between true positives and true negatives. D. Summed scores of three-finger scanning among true positive and true negative groups.

The majority of participants (n = 170, 84.16%) received positive matches (S > 27) for all five fingers. Of the remaining 32 participants, 18 (8.91%) received positive matches for four fingers, with nine (4.46%), two (0.4%) and one (0.1%) participants receiving positive matches at three, two or one fingers respectively. Compared to the average values for thumb templates, relative values of S (RS) were significantly and progressively lower for template pairs representing the index (RS = -34.2, SE = 8.0), middle (RS = -43.7, SE = 8.1), ring (RS = -68.6, SE = 8.1) and pinkie (RS = -87.0, SE = 8.1) fingers (Figure 1B, Table 2).

View this table:

• View inline
• View popup
• Download powerpoint

Table 2: Factors associated with increased or decreased scores

Average relative scores for true positive template pairs were lower when collected from people aged over 50 (RS = -70.9, SE = 11.9) and higher when collected from people who described their overall skin condition as ‘very good’ (RS = 26.4, SE = 8.6). There appeared to be no variation in the average score of a true positive template pair on the basis of skin tone, moisture level, or greasiness (Table 2). There was some evidence for a slight reduction in scores when the participant had applied creams or lotions to their hands on the day of sampling (RS = -11.6, SE = 5.9) although this did not appear to be confirmed among those who had applied oils, emollients or medications. The presence of rough or smooth patches on the fingertips did not appear to affect the average score (Table 2).

There was a 94.9% probability that any two fingerprint templates taken from a single finger would return a positive match (defined as S > 27). The probability that there would be at least one positive result among any two template pairs taken from two fingers of the same individual was 99.0%. Using three, four or five fingers, the probability of returning at least one positive result (S > 27) rose to 99.6%, 99.8% and 100% respectively.

Using the sum of the scores from two (AUC = 0.997), three (AUC = 1.0), four (AUC = 1.0) or five (AUC =1.0) fingers indicated a general improvement in the performance of the matching algorithm with an increasing number of fingers used. In this data set, we found that a perfect classifier (AUC = 1) could be achieved when three fingers (thumb + index + middle) were used (Figure 1C, 1D). In the three-finger model, the mean summed score for a true positive was ΣS = 557.18 (median 557.18, min 71.94, max 1046.43, IQR 402.79-686.03). For true negatives, the mean summed score was ΣS = 16.53 (median 14.3, min 3.99, max 57.22) (Figure 1D). The gaps between the highest values of a true negative and the lowest values of a true positive in each classifier were 13 (three fingers), 12.3 (four fingers) and 62.7 (five fingers) units. This indicated that among the three classifiers where AUC=1.0 (i.e. the models where three, four or five fingers were combined), there was an additional performance gain from using more fingers, as the separation between the positive and negative groups (and consequently the proportion of all possible threshold values where the classifier worked perfectly) increased.

DISCUSSION

Scant literature addresses topics of participant (mis)identification in research and trials, but in clinical care the subject is better explored (23,24) and highlights that patient mis-identification is common even in high income countries (HICs) with well-developed health information systems. In resource-restricted settings, challenges are magnified, particularly when complex longitudinal data collection centres around the use of experimental medical products, or the surveillance of infectious diseases in remote locales (16).

The current generation of mobile data collection software is well developed for use in these settings, with off-grid functionality the norm; but no system historically provided a simple to use method to support participant identification. We have created open-source code and related applications that introduce options for fingerprint template capture, and workstation-based template matching when collecting data with ODK’s native smartphone app ODK Collect. We have tested and confirmed that the app also works with the majority of other software that have been forked (copied and further developed as separate software, usually by an independent developer group) from the ODK project. This includes KoBoToolbox, Ona and SurveyCTO, which together with CommCare (compatibility unconfirmed) and ODK have a dominant market share of mobile data collection tools used in public health, humanitarian activities, election monitoring and elsewhere. The system is not currently compatible with major data collection systems that are not based on ODK’s code (i.e. OpenClinica, DHIS2, REDCap and Go.Data).

There appeared to be several factors that significantly influenced the quality of template matching. Most importantly, we highlighted that for the purposes of clinical trials, it was insufficient to rely on scanning just one fingerprint template in each CRF. The data presented here indicate that the matching of a single fingerprint template pair has absolute accuracy of around 95%. This is perhaps acceptable for confirming identity during the process of a data subject access request, where any issues of false-negative results might be rectified in most cases by trying again with a new scan from the same finger. 95% accuracy is meanwhile too low for the practical purposes of needing to confirm links between data. A recent clinical study protocol aimed to vaccinate 500,000 participants (25). Assuming 10 CRFs per participant and single scanning of fingerprint templates on each CRF, then we estimate that there would be 5,000,000 comparisons, of which around 250,000 linked records would not match because of the 5% error rate. At such scales, subtle (i.e. 3-4 decimal places) increases in classifier performance could translate into substantial decreases in the actual number of errors in a real world setting. By using multi-finger scanning (and then summing the matching scores), we reduced the error to levels that were undetectable in our test data. We also saw that whilst our relatively small data set was underpowered to discern the subtle performance increases in AUC of a ROC analysis when four or five fingers were used (compared to three fingers where AUC = 1), there was evidence from the growing separation of the negative and positive populations that using more fingers would continue to decrease error in the system and improve accuracy. We therefore recommend that all users of the system should collect a minimum of three and ideally more fingerprint templates in each CRF. We found that the average score for a matched pair was highest for thumb templates and that each subsequent finger moving towards the pinkie had a lower average score. When choosing which fingers to scan, it may be valuable to prioritise fingers accordingly.

Certain participant characteristics influenced the probability of obtaining a high matching score from a pair of templates collected from the same finger. We found that template pairs from those who self-described as having ‘very good’ skin condition were more likely to produce high scores. The score neither appeared to be influenced by skin tone or greasiness, nor by the presence of rough or smooth areas. Template pairs from people aged over 50 were substantially lower (RS = -70) than those from people aged 20-30. In this study, we focused on the use of fingerprint templates taken from the right hand and we are therefore unable to determine whether there could be performance differences when using templates from the left hand.

The Keppel app and CLI is not the first biometrics platform that is compatible with the ODK ecosystem. Simprints (26) is well-developed software which is compatible with ODK-like systems, as well as with DHIS2. This platform openly shares code (27) but its use may require a managed account provided by the not-for-profit Simprints Technology Ltd. Use of Simprints also appears to require access to proprietary scanner hardware, access to which may also require direct collaboration with the company. Whilst Simprints does have wider functionality than the system presented here (including contactless biometrics and on-device matching/verification), our project is novel in being designed around low cost, off-the-shelf hardware and a fully “open software - open documentation” model which makes setup simple, which can be used by any project using compatible software and which does not require support from, partnership with, or subscriptions provided by any third party.

Most trials have tens, hundreds or thousands of participants, meaning that compute times for the Keppel CLI are negligible in most cases, even when multi-finger scanning and multiple CRFs are used. The CLI was however highly performant at scale and we predict that in a very large trial with 15,000,000 templates (500,000 participants, 10 CRFs, three-finger scanning) the CLI could process all required template comparisons in around one week of wall-clock time on a higher-end consumer laptop (2.3 GHz, 8 Core Intel i9, 64 GB RAM). Using a high-performance cluster would reduce this in proportion to the number of CPUs available (for instance, wall clock time would be around 15 minutes if using a 96 CPU cluster).

Limitations of this study include that the first release of the Keppel app does not perform on-device matching or verification, and that the app works with just one specific and proprietary hardware scanner device. To ameliorate the risk that the compatible hardware may become obsolete, we encoded the app in such a way that further devices (including sensors for other biometrics) could be added with relative ease. Our open-source code is also available for community-led maintenance and further development. This study was performed during the COVID-19 pandemic at a time when collecting fingerprints was a non-trivial process. As such, we did not achieve a sample size that would have allowed us to estimate with greater precision the level of error that remained when performing four- or five-finger scanning. Our error estimates are therefore indicative and should be interpreted only to show that multi-finger scanning is the preferable method of sampling. We were also unable to include children and infants in the study (because of risk assessments related to COVID-19) and are consequently not able to use these data to assess whether the system performs well in young and very young people. This will be a topic of future study.

The use-case for these tools in clinical trials, medical informatics, research and health care is extensible to the broader use-cases of humanitarian electronic data management tools. Central to the value of low cost and reliable bioinformatics tools in action for public good are deployments that will address the problems of the excluded “missing billion”. We anticipate that the tools presented here, along with those which will emerge from continuous open-source developments of the code-base, will contribute to efforts that will provide official and semi-official identification credentials; thereby enhancing political franchise, supporting free and fair elections, enabling birth registration & census and providing solutions to many other personal identification challenges in resource-restricted settings.

ETHICS STATEMENT

Ethical permission for the study was granted by the London School of Hygiene & Tropical Medicine Observational Research Ethics Committee (Ref. 22562). Before taking part, participants were provided with written information about the study and were able to ask project staff questions about the study before providing verbal and electronic informed consent to take part. The study was fully anonymous and the study team did not keep any record of the name or other personal information about the identities of the participants. In order to allow participants to change their minds and to leave the study at any time, the study information sheets carried unique codes that were stored on the project database. Any participant who wished to leave the study was instructed to contact the project team at any time and to provide the code number(s) of records which would then be permanently deleted.

DATA AVAILABILITY STATEMENT

The latest release of the app and CLI, along with all code relating to this work, are available at the project home page: https://github.com/LSHTM-ORK/ODK_Biometrics. Copies of all code and release version 0.3 are provided as supplementary data. The Keppel App runs on Android Devices. The app works in combination with one of ODK Collect, KoBo Collect and SurveyCTO Collect but may work with other similar apps. The Keppel CLI was programmed in Kotlin and is platform independent. All code is released on the MIT Licence (https://opensource.org/licenses/MIT). At the time of writing, the Mantra MFS100 Biometric C-Type Fingerprint Scanner was widely available from online retailers as well as from the manufacturer www.mantratec.com. Some code used in this project was based on the Mantra MFS100 Software Development Kit, which at time of writing was available from Mantra Softech https://download.mantratecapp.com/. Fingerprint data cannot be shared for ethical reasons.

COMPETING INTERESTS

Callum Stott is employed as a software developer for GetODK Inc.

FUNDING

This research is funded by the Department of Health and Social Care using UK Aid Funding as part of the UK Vaccine Network, and is managed by the National Institute for Health and Care Research. The views expressed in this publication are those of the author(s) and not necessarily those of the Department of Health and Social Care. (PR-OD-1017-20001)

AUTHORS’ CONTRIBUTIONS

ChR, CS, SL & MM Conceptualised the study. CS & ChR wrote and tested the code and documentation. ZC, MST, MM & SL collected the Data. ChR performed the statistical analysis. All authors contributed to writing, reviewing and approving the content of the manuscript.