Data governance framework for the implementation of automated healthcare-associated infection surveillance using large language models: Privacy-by-design with open-source de-identification pipeline

Clicks: 7
ID: 337759
2026
Article Quality & Performance Metrics
Overall Quality
Not rated
Combines reader engagement with the AI quality analysis. This article has not been analysed, so there is no overall score — reader engagement is measured and shown alongside.
AI Quality Assessment
Not analyzed
Readership in this journal
Emerging

Ranked #608 of 635 articles by views in Clinical infectious diseases : an official publication of the Infectious Diseases Society of America

Most read Least read

Bar heights use a square-root scale. Only the 120 most-read articles are drawn; the journal has 635 in total.

Mint this article as an NFT
Not yet minted

Create a permanent, verifiable on-chain record of this article on the Scimatic Network. The NFT is held in your Journament account, and you can withdraw it to your own wallet at any time.

5 SUSD one-off · no wallet required
Abstract
Abstract Background Healthcare-associated infection (HAI) surveillance remains heavily dependent on manual review of electronic medical records (EMRs), limiting scalability, reproducibility, and between-hospital comparability. Large language models (LLMs) may support extraction of clinically relevant information from unstructured text, but implementation is constrained by data protection, governance, and workflow integration challenges. Within an ECDC-funded feasibility project on healthcare-associated bloodstream infection (HA-BSI) surveillance in Italian hospitals, we developed an implementation framework to address these barriers. Methods The framework combines a Data Protection Impact Assessment used as a design instrument, categorization of data into raw, derived, and aggregated tiers, an on-site assisted de-identification workflow, and a tiered LLM deployment model. LLMs are used for structured clinical information extraction only, while final case classification is performed through a transparent, deterministic, rule-based algorithm based on ECDC definitions. Results The project produced an operational workflow in which identifiable clinical records remain under hospital control and only locally reviewed de-identified outputs are transferred for downstream research processing. It also led to development of an open-source human-in-the-loop redaction prototype. Key implementation barriers included variable EMR maturity, document export constraints, and lengthy ethics, institutional, and data protection approval cycles. Final LLM benchmarking and surveillance-performance evaluation remain ongoing. Conclusions Trustworthy LLM-assisted surveillance may depend on governance and implementation architecture as much as on model capability. The proposed framework provides a feasibility model requiring further validation across hospitals, languages, record systems, and LLM versions. This study describes a privacy-by-design workflow for using large language models to extract clinical information from Italian hospital records while preserving local data control, enabling deterministic ECDC case-definition matching for healthcare-associated bloodstream infection surveillance through on-site de-identification and human oversight.
Reference Key
openalex_W7224154999 Use this key to autocite in the manuscript while using SciMatic Manuscript Manager or Thesis Manager
Authors
Journal Clinical infectious diseases : an official publication of the Infectious Diseases Society of America
Year 2026
DOI
10.1093/cid/ciag560
URL
Keywords Keywords not found

Citations

No citations found. To add a citation, contact the admin at info@scimatic.org

No comments yet. Be the first to comment on this article.