Public consent to data reuse, sharing and linking practices is a critical component of a transparent health-data ecosystem and requires that patients:
It is no coincidence that lack of public awareness (and the corresponding lack of appropriate consent) was at the core of many recent public data sharing controversies. See our Big Data in Healthcare Whitepaper for more information.
“A primary goal should be to foster better public awareness and understanding of health data reuse and ensure that the consent mechanisms used can best facilitate that.”
David Kennedy | GB Health & Social Care Practice Leader
Willis Towers Watson
Therefore, a primary goal should be to foster better public awareness and understanding of health data reuse and ensure that the consent mechanisms used can best facilitate that.
The GDPR standards of consent provide a good framework to consider; Article 4 of GDPR defines consent as:
There are multiple different types of consent mechanisms that are used within the healthcare industry to facilitate consent to reuse people’s health data.
In their broadest forms, consent models are either opt-in or opt-out.
Opt-in approaches require people to take an affirmative action to grant their consent.
Conversely, with an opt-out approach people must take an affirmative action to withdraw their consent (without which, consent is deemed given).
Opt-out models are not compliant with GDPR requirements for express consent.
There is a spectrum of consent, that provides patients with increasingly granular opportunities to clarify and document how, when and why their data is to be used.
| Consent models | Degree/nature of granularity |
|---|---|
| Blanket consent | Consent to an unlimited range of options with no restrictions. |
| Broad consent | People consent to an unspecified variety of future research projects subject to a few restrictions. |
| Tiered consent | People can choose to give broad consent for specific types of purposes, users, institutions etc. |
| Meta consent | People express how and when they want to be asked for consent in the future. A form of tiered consent whereby people can choose differing levels of consent for different categories: e.g. users, uses, institutions etc. |
| Specific informed consent | Consent for each differing use (and user) of data at every point in time. |
An increasingly lauded approach to consent is dynamic consent, which includes a personalized communication interface which allows for ongoing engagement with people about the reuse of their data in rapidly changing environments.
A dynamic consent approach puts the individual at the centre and allows for interactions over time so that people can alter their choices.
The evidence indicates that patients’ and the public views towards which consent models they prefer are highly varied and often influenced by other factors, such as: disease state, culture and individual attitudes towards privacy.
This is mirrored by the wide variety of public attitudes towards data sharing generally; which typically differ according to individual factors and various combinations of: the nature of the data user, the purpose of the data use and how the data will be used.
Whilst, there is no universal agreement on what consent model/mechanism best addresses public concerns about data reuse, in general, the involvement of commercial companies and any element of profit making amplify public desire for greater control of their data preferences.
This is supported by evidence that consent preferences differ by entity-type, with people desiring more control over their data when for-profit entities are involved (even with clear public benefit).2
In the absence of globally consistent approaches to consent and regulation (including fines and penalties), governance structures should consider the use of multiple mechanisms to ensure data reuse/selling and linking are appropriate:
Consent choices related to commercial involvement in health data reuse are: 1) not binary, 2) complex, 3) reliant on individual and system factors and 4) have several dependencies – including greater transparency and awareness.2
Healthcare companies, policy makers and other stakeholders that want to reuse, share or link patient data must balance this diversity of opinion against the need for pragmatic, cost-effective and realistically implementable solutions to obtain consent.
Whatever consent model is chosen, entities should seek to enhance public awareness and understanding about how their health data are used and foster greater public engagement in their choices surrounding the use of their data.
Please note this article is focused on adult consent, as there are additional considerations for minors, individuals with mental health concerns and potentially caregivers.
1 https://gdpr-info.eu/art-4-gdpr/
2 Beasley, K. (September 2020) Patient and public attitudes towards secondary use of health-related data, with particular focus on themes of commercialism: a two-phased scoping review
