Keywords
Clinical research - informatics - privacy - ethics - access and data sharing - trust - consent - public engagement and involvement
Introduction
Advances in research capability heralded by Electronic Healthcare Records (EHRs) and more recently genomics, the Big Data paradigm, and richer data gathering through personal mobile devices bring to the fore new challenges for health data sharing that lie between privacy protection and access to those data. Appropriate balancing of personal privacy with the potential benefits of health data reuse to improve care represents a wicked dilemma.
In early 2016, an editorial in the British Journal of General Practice[1] explored the importance of considering the confidential therapeutic relationship as the context of data acquisition to guide how to govern the uses of data for purposes beyond that context of confidence and trust. The primacy of the therapeutic relationship helps us to appreciate the essence of the wicked problem: it is one of an individual desire for privacy which can be set aside when the individual chooses to do so – which one controls as part of the trusting relationship with his/her healthcare provider. But data reuse beyond that relationship cedes control to unknown others with whom the individual has no relationship at the time the individual originally shared the data. In approaching this survey, we have decided to apply this lens to develop an understanding of the current and evolving challenges.
Nearly two years on, the literature re-emphasises how data is becoming richer, its capture more personal and more revealing. It has also revealed the extent to which mechanisms by which the clinical research informatics community can assure privacy and justify access are not as robust as expected or assumed. Whilst public awareness is increasing and transparency in research and protection are becoming more paramount and mandated under an international law with the forthcoming enforcement of the EU General Data Protection Regulation (GDPR)[2], the objective of this review is to uncover current key challenges to clinical research informatics and emphasise how understanding of these issues for both data subjects and data sharing beneficiaries is a particular challenge so that the clinical research informatics community can start to develop ways of thinking meaningfully about the requirements of solutions.
Methods
As the aim of this review was to survey current approaches to the wicked problem of appropriate reuse of clinical information, the authors adopted a modified thematic review approach focused on understanding the dilemma space in a pragmatic way in order to provide a useful platform to support reasoned debate about the development of solutions. Neither meta-analysis nor extensive critique of the shortlisted literature formed part of the methodology. Rather, the research team focused on the identification of a tractable research question within the ‘wicked’ dilemma space, the development of a robust search strategy, data gathering, and the synthesis of key findings.
Research Question and Scoping Questions
The authors agreed the core research question would focus on the dilemmas in balancing privacy and access needs when re-using health data for clinical research. Inherent in this question is the recognition that individuals have many changing roles and identities, and that the dilemma goes way beyond a binary view of private individual vs. public citizen. We agreed to consider scoping questions that would help us to narrow search terms, query articulation, and points of relevance as we retrieved and reviewed the literature.
These scoping questions assessed how key concepts were understood in the literature, how well privacy risks and access needs were balanced, and the extent to which consented or unconsented clinical research informatics endeavours had any impact. We started by asking “what is understood by privacy in the legal, ethical, and societal contexts?” and “what is understood by access to data shared to support health research?”. Questions further included “how are privacy needs met and do they honour expectations when health data is accessed?”, “how well are privacy and access needs balanced in health–related research and is there a tradeoff?”, and “what bearing does consented and non-consented research have?” to help guide our review.
Search Terms
In considering our research questions and focus, we listed a series of query terms related to the scoping questions and manually cross referenced them with MeSH terms. We first developed a scoping query that would narrow our search for literature on MEDLINE to sharing and reuse of data to support clinical research informatics that included genomics, mobile health, Big Data, clinical data warehouses, and repositories in scope. We focused on clinical, epidemio-logical, bioinformatics, omics, cohort, and evaluation studies.
In combination with the scoping query, we developed queries that were related to privacy, consent, data protection, information security, trust and trusting relationships, and ethics. We also agreed that public engagement and involvement were an important area to consider in our scoping questions given their significance to transparency, the understanding of public and individual expectations, and trust. These concepts were further expanded using indexed and MeSH terms, and the final set of terms was agreed by each author. These queries are available on request.
Paper Selection, Data Extraction, and Analysis
The queries were run on MEDLINE on 20th November 2017 for manuscripts published between 1st January 2014 and 20th November 2017 in line with the 2018 IMIA Yearbook scope for review. In total, 4,779 publications were returned. Titles were reviewed in the first instance to shortlist according to their relevance to the scoping and research questions, and an agreement was reached on which to discard. No language restrictions were placed on publications as the authors were prepared to seek translators to help translate the papers or a translation may have been otherwise available online, though no publication fell into this category.
Of the 197 manuscripts shortlisted for review on the abstract, it was agreed that the full text article of 18 of the manuscripts should be reviewed. For the first stage of manuscript selection, the lead reviewer (NL) screened articles based on titles and abstracts and only eliminated articles clearly not relevant to the research question. The authors also agreed that the cyber / information security manuscripts retrieved in particular appeared predominantly to be descriptive of technical solutions tested in vitro and provided little insight for the research questions.
After the identification and removal of duplicates, all reviewers independently screened titles and abstracts against the inclusion criteria to identify potentially relevant papers. Articles identified for potential inclusion by the three reviewers were obtained and a final assessment was made by two authors to confirm their eligibility. Consensus between the reviewers was reached by discussion and a final list of articles to be read in detail was made. Where there was disagreement between authors, the authors agreed they would go with the majority view, though no disagreement arose.
The manuscripts selected for potential inclusion were divided and assigned to each author. At least two authors reviewed each of the manuscripts independently to extract data and confirm relevance to the research questions. Then, authors reviewed the data and agreed on findings.
To minimise the risk of bias, data were extracted using a structured approach that included the following information: methods, study design, duration, and setting; aims and inclusion criteria; number of participants eligible, included, and evaluated; participant characteristics (age, gender, career stage); outcomes on which authors collected measurements, including qualitative evidence analysis of participant views where we will report results relevant to this review; and notes on any important limitations of the study.
In synthesising results from the data, we drew broadly on methods for thematic research described by Thomas and Harden[3]. Qualitative data was extracted and the main findings grouped together in order to identify themes which reflect similarities and differences in content to identify the key dilemmas for health data reuse in clinical research informatics.
Results
We describe the 18 papers that were reviewed in detail. The findings from the data analysis have been grouped into the following five themes to identify the key dilemmas for sharing health data to support clinical research. These include Ethical Concerns, Consent and Control, “Hamstrung” Trust: Low Awareness vs. Appetite to Learn and Engage, Legal and Practical Concerns, and Societal Values.
Ethical Concerns
De Lusignan et al. use their literature review and consensus building approach to develop a framework to honour privacy and ethical concerns around data access[4] where they identify the challenges in bringing together enough experts with the capabilities to honour the requirements of the ethical framework. From the ethical perspective, they promote a series of questions derived from Willison et al.[5]. These questions focus on identifying potential burdens and harms and who must bear them and whether they are justified, whether participant selection is fair and appropriate, whether informed consent is warranted and feasible, what level of engagement is appropriate and what the social implications are of the data access, and what the potential longer-term consequences are.
Research facilitated by mobile apps raise the profile of ethical concerns around data sharing. Moore et al.[6] identify concerns about whether fundamental ethical principles as espoused in the Nuremberg Code are being followed across the board. App-mediated research poses a unique risk to privacy which participants may not be aware of (e.g. around GPS data use). This is a point that was also picked up by Nebeker et al. who reported that participants were concerned about wearing devices that could track their locations along with concerns about impacts on lifestyle privacy and security[7].
Arora et al. further illustrate the ethical concerns with the issues of limited understanding of technology used for mHealth research. They highlight that if people don't understand the technology they won't be able to meaningfully grasp the risks versus benefits. Since it takes time to help educate and develop awareness, mobile health researchers should focus on developing systems that enhance participant privacy[8].
Consent and Control
Nebeker et al. emphasise that “creating a meaningful informed consent process is critical and will likely require involving participants as partners who are willing to review and modify consent language and processes to increase access and understanding”[7].
The qualitative study performed by Spencer et al.[9] illustrates the nuances of consent where participants did not talk about the time varying nature of consent, but rather spoke about the value of using the dynamic consent system to make a one-off decision if they wanted to opt-out.
Dynamic consent also features in the discussion piece by Williams et al.[10], which recognises that dynamic consent implies an e-Infrastructure and whilst it may provide a portal for research participants to consent or revoke consent, it does not provide an ethical framework to account for variances in rights, needs, and understanding of participants.
This raises a key issue around consent related to the points raised by Arora et al.[8] which is also illustrated in the qualitative study performed by Audrey et al.[11] that identifies uncertainties around effectiveness of anonymisation. This causes further doubt around the validity of informed consent as a cornerstone of good governance and the extent to which research participants understand different types of consent and what they are/are not consenting to.
Big Data supported health research casts further scrutiny on consent: Rothstein recognises consent as being something that shows respect for autonomy and dignity of the individual, despite citing other work that consent for Big Data is too expensive and that consent is fetishised. He argues that a robust opt out is ethically equivalent to opt in and that ticking an opt out box is no different than ticking an opt in box in terms of effort[12].
Balas et al. in their literature review of Big Data clinical research identify public concerns around the reuse of data in terms of security and a preference for research on aggregate data only. They find that reuse by clinical professionals and others for the benefit of others (i.e. community health) directly impacts autonomy whether participants would have consented or not. They emphasise that confidentiality is a mandate to protect anything shared in a trusting relationship, but that this can be overridden if sharing the data mean benefits for society that outweigh the individual's interests in keeping it private[13].
In the systematic review by Aitken et al.[14] that focused on public responses to health data sharing and linkage, a large number of studies were identified reporting that assurances of individuals’ confidenti-ality were crucial for public supporting the reuse of health data for research. This was largely associated with anonymisation of data, although the review notes that ano-nymisation was not an absolute guarantee of confidentiality. The review also reported a recognition that the anonymisation process is imperfect and does not adequately protect privacy.
Autonomy and control were identified in the review as key factors, but there was no clear consensus found on what the control looked like. Respondents also wanted to strike a balance between control and efficiency of research, where consent was seen as a key requirement for research acceptability, but there was some acceptability for practicality and not to hinder research.
Grande et al.[15] highlight the importance of purpose and make the point that whilst consent is emphasised in research, it is important to consider purpose as well because that has a great deal of impact on people's opinions.
“Hamstrung” Trust: Low Awareness vs. Appetite to Learn and Engage
Discussions around consent and participation must be considered while taking into account the identified low awareness of data sharing and use. Spencer et al. highlight that participants reported low levels of awareness of how their personal information is stored and shared for research where there was some fear of the unknowns, and whilst patients were supportive of sharing their anonymised EHR for research, they noted a lack of transparency and awareness around the use of the data making it difficult to secure public trust[9].
The systematic review from Aitken et al. also point to a discernible appetite for more information around research and its governance. Assurances of safeguards were identified as essential for support but there was low awareness of the research practice and ethical processes in place. Knowledge about what was involved with research helps to increase acceptance[14].
The findings by Nebeker et al. in the context of mobile apps add further weight to the need to properly engage with participants and for efforts to educate individuals so that they can develop an improved ability to make informed decisions around studies that involve mobile sensing technology. Such education about technologies used in research “can reduce barriers associated with a lack of familiarity and, subsequently, increase trustworthiness of the research enterprise”[7].
Legal and Practical Concerns
There are numerous examples of guidelines and codes of practice around legal and practical good practice, perhaps relecting both the inherent wickedness of the space as well as deficiencies both in the current articulation and use of law and of its role in addressing a wicked issue. De Lusignan et al. provide a set of practical questions from their consensus work for data protection, focusing on identifying responsibility for the accountability of the data and where it will be stored, who will have access to it, whether there is an audit trail to indicate the data were legally obtained, whether it is suficiently anonymised, restrictions for secondary processing of the data, whether their accuracy be verified and any processing is documented, and whether individuals can opt out of its processing[4].
Eagleson et al. define an 11-point set of guidelines derived from literature pertaining to information security assurance mechanisms, including authentication, audits, access controls based on roles and patient preferences by way of consent, and a patient-controlled privacy policy[16]. They also highlight how transparency can keep researchers accountable and that sharing security dilemmas and solutions can help to keep projects from having to implement the same security mechanisms from scratch.
A qualitative study by Shabani et al. provides insight into concerns around the practical and legal considerations in the US. The study conducted interviews and presents responses from data access regulators (Data Access Controllers or DAC). The study raises key points about practical challenges for managing access to data[17], in particular, the study questions the adequacy of access reviews which look at whether access should be granted for processing.
Qualifications of applicants to process data are assessed but the checks are inconsistent and have a “low bar” where the qualification criteria are fragmented or poorly defined. This involves “googling” applicants and requesting numbers of publications, but this is only to check their afiliation with an organisation. The study raises the point of a bona ide researcher but reports that what this means is not clear. Nebeker et al. also point out that “those who donate their data for research probably expect that the research will be carried out by those with demonstrated competence in the field”[7].
DACs discussed the monitoring of the uses of data once accessed. However, this is limited to checking on publications and intellectual property registrations, while they can request reports from data accessors, but this is hard to regulate since there are many international collaborators. The overriding point was the study “...showed the DAC members and experts are ambivalent about the effectiveness and consistency of the current access review procedures, and oversight process...”.
Sanctions were identified as important but there is no professional code that governs researchers. The DACs favour Codes of Practice where sanctions could be specified and they feel that holding the employer responsible for the activities of his/her staff would provide an appropriate basis to apply sanctions.
Aitken et al. identified in their systematic review that security was an important factor, where fallibility of IT systems and human errors are understood to be key risks. There appears to be a tolerance for security risks that participants identified as always being possible because they also valued the benefits of research[14].
Genomics research also raises particular concerns around security. Wang et al. in the US illustrate that genomic data for which identifiers have been removed is unprotected, yet re-identification risks are significant. De-identified data are often obtained using cursory broad consent but these risks can clearly increase as more ‘side’ data become accessible. Risks are therefore not communicated and are not static so re-identification risk increases with both technological advances in linkage plus increased knowledge about a specific individual offering a more complete picture. This is illustrated by the work of Gymrek and colleagues who managed to identify several male participants of the 1000 Genomes Project using their Y-chromosome markers, their family structure, and online genetic genealogy databases[18].
Societal Values
Liyanage et al.[19] identify an increased risk to privacy inherent with the increased use of data from multiple sources and they illustrate the risks to privacy that need to be balanced with the benefits of data sharing. They work towards the development of a privacy and ethics framework to help strike a balance between those risks and the right to a higher attainable level of health. They recognise the legitimate concerns of citizens to protect their ethics and privacy where their health data is used to improve health sector performance.
The systematic review by Aitken et al.[14] identified concerns of misuses and proliferation of data to third parties and for surveillance, with lower concern over political use. There were concerns over stigma and discriminatory treatment and insurance premium issues for research participants, but they found that private company uses and profitability were acceptable if it was for the public good. Many studies reported that concerns to personal privacy were balanced with the recognition of the importance of societal benefits anticipated. Two studies reported that some participants prioritised societal benefits over personal privacy.
Spencer et al. found that 98% considered the altruistic benefits of sharing data outweighed the risks of data falling in wrong hands[9]. Additionally, they emphasise the importance of trust, finding that most participants felt confident NHS Trusts manage records securely and anonymity was preserved when data was used for research. A majority expressed satisfaction towards governance arrangements in the UK NHS but acknowledged no system can be completely secure. A small minority described concerns about risks to their privacy speculating that those with more sensitive health conditions may be more guarded with what happens to their health information.
Discussion
[Table 1] summarises the challenges the review has uncovered related to the themes that the review identified and the solutions we propose for how to tackle them based on the review and developments, particularly around preparations for the new General Data Protection Regulation in the European Union (GDPR).
Table 1
Summary of challenges and proposed solutions
|
Item no.
|
Challenge identified in literature
|
Theme
|
Proposed solutions
|
|
1.
|
Are fundamental rights protected, particularly if participants are unaware of the risks involved where they don't understand the underlying technology (e.g. location data and privacy)?
|
Ethical Concerns
|
Engagement with participants and ensuring they understand the nature of the research and new technologies being studied.
|
|
2.
|
Are there enough experts to oversee ethical concerns and dilemmas, particularly as data reuse and management increase and evolve?
|
Ethical Concerns
|
Share ethical oversight with greater reliance on informed and engaged professionals and lay representations (see item 6 below).
|
|
3.
|
Meaningfulness of consent if participants do not understand what they are consenting to.
|
Consent and Control / “Hamstrung” Trust
|
Closely follow the developments for GDPR preparation across EU, particularly with regards appropriateness of consent as a legal basis for processing data where other bases may be more appropriate; where consent is sought to participate in research data reuse must be understood, particularly with regards transparency.
|
|
4.
|
Purpose of data reuse is not always clear and awareness of reuse is limited
|
Consent and Control / “Hamstrung” Trust
|
Ensure that engagement with participants and public clearly articulates purposes and benefits in a way that can be understood and challenged, as required by GDPR for transparency; be clear on the rights of participants, particularly with the new GDPR requirements.
|
|
5.
|
Demonstrating accountability and transparency around data reuse in a provable and clear manner
|
Legal and Practical
|
GDPR now requires proof of compliance and accountability as well as transparency with regards data use so preparations to support this are key to handling these challenges within and outside the EU. Approval mechanisms must be rigorous and must be independently verifiable, and should always be transparent.
|
|
6.
|
Competence of data users as a means to demonstrate trustworthiness and assure compliance
|
Legal and Practical
|
Training and education around data protection must focus more on contextual understanding and less on “tick-box” learning, where understanding must be demonstrated in line with GDPR and other developments; assessment of competence must also have formal, independently verifiable processes that are clearly defined and transparent.
|
|
7.
|
Reliability of anonymity is more limited than often expected, particularly given it has been proven false
|
Consent and Control / Legal and Practical / “Hamstrung” Trust
|
Claims around anonymity of datasets must be verified more clearly and should take into account the context of data processing and the time-limited nature of anonymity.
|
|
8.
|
Risks to privacy are often more severe than expected, particularly with regards the fallibility of IT systems and where more data sets are processed for reuse purposes
|
Societal Values
|
Clearly articulate the risks involved so individuals can make an informed decision about balancing their contribution to societal benefits and risks against their own privacy and wellbeing. Ensure preparations for GDPR compliance are in line with its requirements around transparency and accountability for handling data, and its emphasis on the need for security.
|
|
9.
|
Some contexts, particularly where sensitive health issues are concerned, carry greater anxieties around privacy and more reluctance to participate.
|
Societal Values
|
Understand the context of data acquisition and reuse, and ensure the concerns and anxieties of the studied population are taken into account.
|
The review has highlighted some of the challenges for sharing and reusing health data across the evolving landscape of clinical informatics research which can be distilled into four key challenges: (1) uncertain reliability of consent as a cornerstone of trust due to limits to understanding and awareness of data sharing; (2) ethical challenges around equity and autonomy; (3) ambitious overly theoretical governance frameworks lacking practical validity; and (4) a clear desire for further public and individual engagement to achieve clearer and more nuanced knowledge dissemination around data sharing practice and governance frameworks.
The challenges we have identified are not new concepts but the landscape has increased in complexity and uncertainty with the advances in omics and mobile health research, and even key messages with regards to using basic EHR data for research are not getting across. A recurrent theme was that our ability to share data has outstripped our ability to clearly and appropriately articulate ways of managing it. An analysis by van Staa et al. highlights the importance of transparency, public involvement, evidence of credible science and clear benefit, and public confidence that data is held securely and appropriately anonymised are critical to the success of Big Data research[20].
These points are consistent with our findings across the spectrum of clinical research informatics, but we propose that the lack of understanding around health data sharing, lack of clarity on what people are consenting to and the resulting problems in earning individual trust lie at the heart of the wicked problem. For this reason, we elected to review the literature with a high-level lens, focused as it is on the relationship of trust between the private individual and healthcare providers when the individual chooses to relinquish some of that privacy.
The review returned several publications that claim to handle technical security issues that threaten privacy, propose methods to limit risks to privacy and provide a basis for offering other technical or procedural solutions, but do not take into account the problems of consent and understanding risks in context, particularly with respect to genomics. This represents a significant ethical challenge in terms of there being a very strong case for participants to be informed. The review recognises that the threats to data security vary according to context and data type, and highlights the special issues raised by the integration of genomic data.
Rather than focussing on which consent mechanisms are most favoured by the public, it may be more valuable to focus on how relationships are built up (and conversely eroded) and how trust can be facilitated within research and data reuse through data linkage processes including through public engagement and involvement. Studies overwhelmingly suggest an appetite for more information about current research practices and uses of data. The public should not be conceived only as subjects of information provision but there remains a public interest and enthusiasm for more meaningful forms of public engagement or involvement.
With the new GDPR coming into force across the European Union and garnering wider international interest, the clinical research informatics community now has a mandatory goal but also an opportunity to tackle some of the wickedness. GDPR enhances the need for transparency and meaningful dialogue around data processing with data subjects, a better understanding of the role of consent in research, and offers the basis for a more meaningful discussion with participants based on new and clearer rights. Those who rely on data sharing should embrace these as opportunities and prepare to be more accountable for their practices as guided by the regulation and engage more meaningfully and more publicly. This will go a long way in navigating the problem between sharing data and advancing care through clinical research informatics.
We suggest that our findings are the basis for a much-needed full systematic review aimed at gaining further traction on developing a far more nuanced understanding of the wicked problem(s) we are grappling with than has hitherto been the case. It seems reasonable that this be performed after GDPR has been enforced, as this is likely to have an impact on our understanding of the challenges and how they can be handled. It further seems pertinent to incorporate changes in protocols, attitudes, concerns, and security risks as genomics research continues to thrive.
Conclusions
The review has spotlighted some key dilemmas that need to be addressed by the clinical and health informatics community. Whilst elaborate security and ambitious ethical frameworks exist, there remains a lack of understanding and knowledge for patients which undermines the ethical basis under which such frameworks operate.
Without real transparency or understanding, trust is harder to earn, and despite a recognition of the importance of consent and confidentiality, consent cannot be the cornerstone of trust if people do not understand what they are consenting to and cannot meaningfully assert control over what they choose to share when they subsequently and inadvertently relinquish it later on without their knowledge.
No one perspective – be it technical, legal, societal, or ethical– holds the answer to this wicked problem. It is a combination of perspectives that we have focused on so that we can start to understand how to make the data sharing problem less wicked.
Clinical research informatics advances rely on tackling the wicked problems of data reuse. A lack of understanding around the context of data acquisition and sharing undermines the foundations of trust and attempts to protect privacy, but there is however a clear public enthusiasm to learn more about the research technologies and governance, and to engage with the endeavours. This, with the additional legal requirements of GDPR and the challenges set by the new advances in genomics research, provides an opportunity for enhanced collaborations between agencies and an engagement tailored according to specific contexts and individual needs so that the research community will learn to honour personal privacy more meaningfully and effectively, justify access with more transparency and detail, and better protect equity and autonomy.
