Data shar­ing has been vital for health­care plan­ning and research in tack­ling Covid-19. Look­ing beyond the pan­dem­ic, the wealth of data and insights our bod­ies offer can dri­ve future drug dis­cov­ery and the devel­op­ment of med­ical tech­nolo­gies. 

But there’s a prob­lem: a sig­nif­i­cant pub­lic reluc­tance to allow health­care ser­vices to share per­son­al health data. A June 2021 sur­vey by the Infor­ma­tion Commissioner’s Office (ICO) and Har­ris Inter­ac­tive found that only 47% of peo­ple would allow the NHS to pass on their data to pub­lic sec­tor com­pa­nies if it were used to improve the deliv­ery of health­care. The fig­ure is 42% for pri­vate com­pa­nies. 

It’s no sur­prise that a good pro­por­tion of the pub­lic have reser­va­tions. Every­one hopes their data is shared appro­pri­ate­ly and respon­si­bly, yet there were 2,431 data secu­ri­ty inci­dents report­ed to the ICO in the three months to the end of Sep­tem­ber. Of these, 435 were in the health­care sec­tor. Many more will have gone unre­port­ed.

There’s already been back­lash to NHS Digital’s new process for data held by GP prac­tices – the Gen­er­al Prac­tice Data for Plan­ning and Research (GPDPR) data col­lec­tion. Despite promis­es that anonymised data will only be used for health­care pur­pos­es and not shared with mar­ket­ing or insur­ance com­pa­nies, more than 1 mil­lion peo­ple opt­ed out of GPDPR over the sum­mer. NHS Dig­i­tal deferred the Sep­tem­ber roll-out of the scheme. 

Data sharing reluctance

The dilem­ma of whether to share health­care data isn’t iso­lat­ed to the UK, of course. It’s an endem­ic issue. A report pub­lished in The Lancet in Octo­ber argued that coun­tries need to strength­en pub­lic safe­guards on the use of dig­i­tal health data to avoid grow­ing inequal­i­ties in med­ical out­comes. 

Any con­cerns the pub­lic may have had about data shar­ing will have been exac­er­bat­ed by the pan­dem­ic. Take con­tact trac­ing apps, known more broad­ly as Con­tact Trac­ing and Advice Ser­vice (CTAS). While test, track and trace is now ubiq­ui­tous on smart­phones, research from Finland’s Aal­to Uni­ver­si­ty School of Busi­ness has found that income and edu­ca­tion lev­els are often deter­min­ing fac­tors in down­load­ing and using such apps. 

Yan­qing Lin, a doc­tor­al can­di­date from the busi­ness school’s depart­ment of infor­ma­tion and ser­vice man­age­ment who helped lead the research, says: “We know that the effec­tive­ness of CTAS depends high­ly on pub­lic accep­tance and adop­tion, but it’s been less accept­ed among those who are at a social dis­ad­van­tage and may have a low trust in author­i­ties and sur­veil­lance.”

We have robust mech­a­nisms to ensure anonymi­ty and safe­ty of patient data … There needs to be an edu­ca­tion cam­paign to demon­strate this to the pub­lic

Unequal access to smart­phones and vary­ing degrees of dig­i­tal lit­er­a­cy are oth­er fac­tors deemed to influ­ence a person’s reluc­tance to share data. A com­mon con­cern is that data will be used for more than just infec­tion con­trol.

“Those with greater access to tech­nol­o­gy and who have a high­er edu­ca­tion and income tend to be more accept­ing of dig­i­tal con­tact trac­ing,” Lin adds. 

The research con­clud­ed that accep­tance is like­ly to be high­er if CTAS uses pri­va­cy fea­tures or decen­tralised data stor­age. 

Trust issues

Dig­i­tal trac­ing apps can be designed in dif­fer­ent ways. A cen­tralised design means data is stored and processed by a cen­tral data­base; a decen­tralised design sees per­son­al devices man­age most of the data stor­ing and pro­cess­ing, with the cen­tral data­base play­ing just a minor role, Lin explains. 

Anoth­er issue in focus is iden­ti­fy­ing data: how it’s man­aged and stored secure­ly and who can access it. NHS trusts have pre­vi­ous­ly been inves­ti­gat­ed over staff access­ing patient records with­out autho­ri­sa­tion. Oth­er trusts have acci­den­tal­ly leaked the names and dates of birth of dia­betes patients and email address­es of HIV patients. 

Giv­en that peo­ple are wor­ried about what hap­pens to their data once it’s no longer in their hands, how best can the health­care sec­tor man­age data, espe­cial­ly when it’s licensed to pri­vate med­ical tech­nol­o­gy or drug dis­cov­ery com­pa­nies?

Louise Full­wood is health­care and data expert at law firm Pin­sent Masons; she worked in med­ical research before retrain­ing as a lawyer. Accord­ing to Full­wood, one way to allay data wor­ries is to use what’s known as a fed­er­at­ed data­base mod­el rather than a cen­tralised data­base mod­el. 

When a cen­tralised mod­el is used, there’s a high­er chance of data being mis­used or shared in a way that peo­ple wouldn’t be hap­py with, says Full­wood. How­ev­er, a fed­er­at­ed mod­el brings the analy­sis to the data as opposed to mov­ing big data­bas­es to licensees.

Full­wood gives the exam­ple of a drug com­pa­ny that wants to access a health­care ser­vice data­base to get a bet­ter under­stand­ing of poten­tial caus­es of can­cer. Grant­i­ng it access to a big, cen­tralised data­base presents risks. Under the fed­er­at­ed mod­el, how­ev­er, the data­base isn’t trans­ferred, remain­ing with the health­care ser­vice. 

“The drug com­pa­ny can inter­ro­gate the data­base using soft­ware to run spe­cif­ic ques­tions, such as what pro­por­tion of men who reg­u­lar­ly take drug X go on to devel­op prostate can­cer,” says Full­wood. “The drug com­pa­ny doesn’t get access to indi­vid­ual datasets, just aggre­gat­ed answers.”

As drug devel­op­ment and med­ical inno­va­tion con­tin­ues to advance, nation­al health­care ser­vices must get a bet­ter grasp on data shar­ing. 

“We have robust mech­a­nisms to ensure anonymi­ty and safe­ty of patient data,” says Dr Steve Arling­ton, pres­i­dent of the Pis­toia Alliance. The group was set up by rep­re­sen­ta­tives from life sci­ences and phar­ma­ceu­ti­cal com­pa­nies includ­ing AstraZeneca and Pfiz­er to break down health­care research and devel­op­ment bar­ri­ers. 

“There needs to be an edu­ca­tion cam­paign to demon­strate this to the pub­lic and to com­mu­ni­cate the wider altru­is­tic val­ue of shar­ing their health data.”

The fail­ure by health­care ser­vices to reas­sure the pub­lic on data shar­ing could have an adverse impact on future treat­ment and patient out­comes. 

---

What the UK can learn from other countries

Accord­ing to the Open Data Insti­tute, the UK tops the Euro­pean rank­ings of the qual­i­ty and imple­men­ta­tion of poli­cies on sec­ondary use of health data. This is defined as the use of data to improve care plan­ning and deliv­ery, drug devel­op­ment, research and pol­i­cy­mak­ing. How­ev­er, the coun­try is lag­ging behind when it comes to the ethics of its poli­cies. 

As the 2021 research states, “a suc­cess­ful ecosys­tem for sec­ondary use of health data requires the trust of peo­ple and patients [and] eth­i­cal and account­abil­i­ty frame­works.”

Here’s what some oth­er Euro­pean coun­tries that fare bet­ter on ethics are doing to improve access and con­trol of health records. 

Iceland

This was the first coun­try to devel­op a patient-fac­ing appli­ca­tion pro­gram­ming inter­face for access­ing health records, back in 2017. The Direc­torate of Health worked with UK firm Digi.me to enable cit­i­zens to down­load dig­i­tal copies of their health records.

Finland

My Kan­ta Pages pro­vides patients with access to their records, regard­less of whether they use pub­lic or pri­vate health­care ser­vices. They can also upload data from smart­phone apps and wear­ables. The sys­tem is designed to improve trans­paren­cy by allow­ing patients to see who’s viewed, processed or han­dled their data. 

Netherlands 

Med­Mij is a nation­al stan­dard for secure data exchange between health­care users and providers. Cit­i­zens can reg­is­ter with accred­it­ed apps, web­sites or oth­er dig­i­tal tools to retrieve their med­ical data. It’s regard­ed as a move towards a more patient-cen­tric approach to health­care.

---