Skip to main content
Article

Patient Consent Management for Healthcare Data Reuse

N/A
COVID 19 Coronavirus

By Kirsten Beasley and Doris Fischer-Sanchez | May 24, 2021

Do your patients know how you are using their data? A brief overview of public preferences toward data sharing consent mechanisms.

Public consent to data reuse, sharing and linking practices is a critical component of a transparent health-data ecosystem and requires that patients:

  1. be aware of and understand how their data are being used and
  2. choose which of their data are shared, with whom, for what purpose and how; especially when commercial aspects are a feature.

It is no coincidence that lack of public awareness (and the corresponding lack of appropriate consent) was at the core of many recent public data sharing controversies. See our Big Data in Healthcare Whitepaper for more information.

A primary goal should be to foster better public awareness and understanding of health data reuse and ensure that the consent mechanisms used can best facilitate that.”

Kirsten Beasley | Head of Healthcare Broking,
North America
Willis Towers Watson

Therefore, a primary goal should be to foster better public awareness and understanding of health data reuse and ensure that the consent mechanisms used can best facilitate that.

The GDPR standards of consent provide a good framework to consider; Article 4 of GDPR defines consent as:

  • Freely given: the person must not be pressured into giving consent or suffer any detriment if they refuse.
  • Specific: the person must be asked to consent to individual types of data processing.
  • Informed: the person must be told what they're consenting to.
  • Unambiguous: language must be clear and simple.
  • Clear affirmative action: the person must expressly consent by doing or saying something.1

There are multiple different types of consent mechanisms that are used within the healthcare industry to facilitate consent to reuse people’s health data.

In their broadest forms, consent models are either opt-in or opt-out.

Opt-in approaches require people to take an affirmative action to grant their consent.

Conversely, with an opt-out approach people must take an affirmative action to withdraw their consent (without which, consent is deemed given).

Opt-out models are not compliant with GDPR requirements for express consent.

or opt-out consent must be actively withdrawn or is deemed given and for opt-in, it means affirmative order of consent.
Consent models are either opt-in or opt-out.

The spectrum of consent granularity

There is a spectrum of consent, that provides patients with increasingly granular opportunities to clarify and document how, when and why their data are to be used.

There is a spectrum of consent, that can offer to/seek from patients increasingly granular opportunities to clarify and document how, when and why their data are to be used.
Consent models on a spectrum
Spectrum of consent granularity
Consent models Degree/nature of granularity
Blanket consent Consent to an unlimited range of options with no restrictions.
Broad consent People consent to an unspecified variety of future research projects subject to a few restrictions.
Tiered consent People can choose to give broad consent for specific types of purposes, users, institutions etc.
Meta consent People express how and when they want to be asked for consent in the future. A form of tiered consent whereby people can choose differing levels of consent for different categories: e.g. users, uses, institutions etc.
Specific informed consent Consent for each differing use (and user) of data at every point in time.

An increasingly lauded approach to consent is dynamic consent, which includes a personalized communication interface which allows for ongoing engagement with people about the reuse of their data in rapidly changing environments.

A dynamic consent approach puts the individual at the centre and allows for interactions over time so that people can alter their choices.

Public preference?

The evidence indicates that patients’ and the public views towards which consent models they prefer are highly varied and often influenced by other factors, such as: disease state, culture and individual attitudes towards privacy.

This is mirrored by the wide variety of public attitudes towards data sharing generally; which typically differ according to individual factors and various combinations of: the nature of the data user, the purpose of the data use and how the data will be used.

Whilst, there is no universal agreement on what consent model/mechanism best addresses public concerns about data reuse, in general, the involvement of commercial companies and any element of profit making amplify public desire for greater control of their data preferences.

This is supported by evidence that consent preferences differ by entity-type, with people desiring more control over their data when for-profit entities are involved (even with clear public benefit).2

Other governance considerations

In the absence of globally consistent approaches to consent and regulation (including fines and penalties), governance structures should consider the use of multiple mechanisms to ensure data reuse/selling and linking are appropriate:

  • Public awareness and engagement campaigns (to facilitate informed choices); including the publishing of data reuse practices and policies.
  • Consent mechanisms that facilitate patients’ determination of how all their different types of health data are used, by whom and for what purpose(s).
  • Benefit sharing agreements between all stakeholders.
  • Independent oversight structures.
  • Auditing mechanisms to ensure appropriate uses.
  • Purpose of use reviews to consider data reuse requests.

Conclusion

Consent choices related to commercial involvement in health data reuse are: 1) not binary, 2) complex, 3) reliant on individual and system factors and 4) have several dependencies – including greater transparency and awareness.2

Healthcare companies, policy makers and other stakeholders that want to reuse, share or link patient data must balance this diversity of opinion against the need for pragmatic, cost-effective and realistically implementable solutions to obtain consent.

Whatever consent model is chosen, entities should seek to enhance public awareness and understanding about how their health data are used and foster greater public engagement in their choices surrounding the use of their data.

Please note this article is focused on adult consent, as there are additional considerations for minors, individuals with mental health concerns and potentially caregivers.

Sources

1 https://gdpr-info.eu/art-4-gdpr/

2 Beasley, K. (September 2020) Patient and public attitudes towards secondary use of health-related data, with particular focus on themes of commercialism: a two-phased scoping review

Authors

Head of Healthcare Broking, North America

Leader, Clinical and Enterprise Risk Management
National Healthcare Industry Practice

Related content tags, list of links Article Healthcare Life Sciences COVID-19 (Coronavirus)
Contact Us