Fig. 1

Step-by-step overview of linkage procedure. IMA DWH: InterMutualistic Agency Data Warehouse; TTP VI CBSS: Trusted Third Party Crossroads Bank for Social Security; SPOC NIC: Single Point of Contact National InterMutualistic College; BCR: Belgian Cancer Registry; TTP eHealth: Trusted Third Party eHealth; StatBel BE: Statistics Belgium; SCRA: Small Cells Risk Analysis; SSN: Social Security Number; C1/C2: coding 1/2; Explanatory note: The linkage procedure consisted of 13 steps (cf. arrows Fig. 1). Step 1: All cases from Belgian decedents since January 1, 2010 are selected in the IMA databases with their specific identifier coded (C2). These are then decoded (C1) by the TTP VI (CBSS). Step 2: The security officer of the National InterMutualistic College decodes the identifiers (C1) into actual social security numbers. Step 3.1: The IMA subset of social security numbers is sent by secure means to the separate TTP eHealth. Step 3.2: TTP eHealth receives the social security numbers from all cases in the Cancer Registry selected for the study (decedents since January 1, 2010). Step 4.1 and 4.2: To avoid any party from having access to both the sensitive data and the social security numbers, the established principle of random transport numbers (RN) is used. TTP eHealth assigned these RNs for the selected cases from IMA (4.1) and BCR (4.2) and provides these RNs to both data agencies in order to transmit the sensitive data safely to the TTP VI (CBSS). Step 4.3: TTP eHealth recodes the social security numbers into a final code that can be made available to the researchers (Cproject). These are sent, with the RNs as a cross reference coding, to the TTP VI (CBSS). Step 5: The selected cases and the corresponding requested data from the Cancer Registry are securely transmitted to the TTP VI (CBSS). Step 6: The selected IMA cases (but not yet the corresponding requested data) are securely transmitted to the TTP VI (CBSS). Step 7: The selected cases are transferred to the IMA datawarehouse (based on C2) so as to allow the selection of all data corresponding to these cases. Step 8: The selected cases and the corresponding requested data from IMA are securely transmitted to the TTP VI (CBSS). Step 9: The social security numbers and corresponding RNs are transferred safely to Statistics Belgium in order to allow selection of the correct cases. A social security number has already been attributed by Statistics Belgium to every case in the death certificate data (which do not contain the social security numbers) based on a deterministic linkage between the death certificate database and the national registry database based on date of birth, sex, and municipality of residence. Step 10: Statistics Belgium sends the requested data from the selected cases to TTP VI (CBSS) who links these with the data from IMA and Cancer Registry using the RNs. Step 11: The TTP VI (CBSS) recodes all data one final time based on the Cproject coding. Step 12: A small cells risk analysis is performed to minimize the risk of re-identification based on a combination of variables. Step 13: The complete linked database is stored on a separate IMA data server, which is only accessible to the researchers through a Virtual Private Network (VPN) connection with secure token