The use of personal health information outside the circle of care: consent preferences of patients from an academic health care institution

Background Immense volumes of personal health information (PHI) are required to realize the anticipated benefits of artificial intelligence in clinical medicine. To maintain public trust in medical research, consent policies must evolve to reflect contemporary patient preferences. Methods Patients were invited to complete a 27-item survey focusing on: (a) broad versus specific consent; (b) opt-in versus opt-out approaches; (c) comfort level sharing with different recipients; (d) attitudes towards commercialization; and (e) options to track PHI use and study results. Results 222 participants were included in the analysis; 83% were comfortable sharing PHI with researchers at their own hospital, although younger patients (≤ 49 years) were more uncomfortable than older patients (50 + years; 13% versus 2% uncomfortable, p < 0.05). While 56% of patients preferred broad consent, 38% preferred specific consent; 6% preferred not sharing at all. The majority of patients (63%) preferred to be asked for permission before entry into a contact pool. Again, this trend was more pronounced for younger patients (≤ 49 years: 76%). Approximately half of patients were uncomfortable sharing PHI with commercial enterprises (51% uncomfortable, 27% comfortable, 22% neutral). Most patients preferred to track PHI usage (61%), with the highest proportion once again reported by the youngest patients (≤ 49 years: 71%). A majority of patients also wished to be notified regarding study results (70%). Conclusions While most patients were willing to share their PHI with researchers within their own institution, many preferred a transparent and reciprocal consent process. These data also suggest a generational shift, wherein younger patients preferred more specific consent options. Modernizing consent policies to reflect increased autonomy is crucial in fostering sustained public engagement with medical research. Supplementary Information The online version contains supplementary material available at 10.1186/s12910-021-00598-3.

action for sharing even de-identified health information outside the circle of care, with patients contesting claims that they actually provided informed consent, and questioning whether de-identification is truly possible [1,2]. Furthermore, patients are becoming aware of potentially controversial PHI uses (e.g. for gene editing, and some AI applications), and some are noting the increasing monetary value of PHI (e.g. to commercial companies) [3][4][5].
Indeed, the use of PHI for research without explicit consent is occurring [3,6], leading some health law experts to raise the concern that consent issues are poised to become a major social controversy [4,7]. While some provisions in law permit the use of de-identified PHI for research without explicit consent, previous studies report that many patients do not distinguish between identifiable versus de-identified or anonymized data, and that they wish to be asked for consent even when PHI is de-identified [8,9]. Proper informed consent is the foundation upon which trusting relationships are built; a wellrecognized principle in health law, and prominent feature of international codes of ethics including the Declaration of Helsinki and the Nuremburg Code [10][11][12][13]. Beyond institutional privacy obligations, the duty of physicians to protect the privacy of their patients is sacrosanct, enshrined in normative documents including the Hippocratic Oath and professional codes of ethics [14]. While advocates for non-consensual access to PHI for research do exist, many scholars have been unequivocal that further public engagement is crucial to ensure the use of PHI is ethically defensible and patient-centered [4,9,10,[15][16][17].
Patient preferences for consent have been empirically studied for upwards of two decades, illuminating a diverse array of needs and views. In a large-scale European study, 61% of participants were concerned over third party access to PHI; participants were strongly averse to sharing with health insurance and private pharmaceutical companies [18]. In studies by Willison and by Joly, Canadian patients also expressed significant concern over commercial uses of PHI [9,15,19]; with 57% indicating that de-identified PHI should not be used at all for marketing/commercial purposes [15]. Multiple studies also report that substantial majorities of patients wish to be consulted before their de-identified PHI is used for research purposes [16,20,21], even after being fully informed of the potential drawbacks such as less research being conducted [14]. Furthermore, many patients desired more specific options beyond one-time broad consent [16,[22][23][24]; in a comprehensive systematic review "the most notable finding is that many people do not favor broad consent for either research itself or for research and subsequent wide data sharing [24]. " Taken together, these reports illuminate a consistent trend that if PHI is to be used outside one's own care, the opportunity for information control is considered an important element of respect for persons [8,15].
While these studies have amplified patient voices within medical literature, policy changes have lagged, resulting in an unfortunate chasm between knowledge and practice. Indeed, previous studies have noted that healthcare organizations have a pervasive tendency to disregard mounting evidence that patients desire more information and control [3,25,26]. Therefore, the purpose of the current study was to acquire an in-depth understanding of the contemporary and specific consent needs of cancer patients at a large academic hospital to inform its own institutional consent policies.

Participants and procedure
A clinical research coordinator (CRC) invited patients in the waiting rooms of five radiation oncology clinics (breast, prostate, lung, thyroid, palliative) to complete a 10-min iPad survey ("Appendix 1") from January to December, 2019. Full Research Ethics Board (REB) approval was granted from the University Health Network (UHN). The only inclusion criterion was being a patient at the cancer centre, and consent was provided verbally. Completed surveys were stored separately, not linked to patients' names or medical records.

Survey
An original 27-item survey was developed specifically for this study, and comprised of four sections of multiple choice and 5-point Likert-scale questions. The survey was designed in consultation with a diverse array of experts from medicine, digital technology, bioethics, and public health policy. It was reviewed in-person with three patient partners to ensure readability and clarity. The welcome message was vital to protect the integrity of responses from a health literacy perspective ("Appendix 1"); we could not assume that all patients would be aware that their PHI holds value outside their own care and is sought-after by external sources. Five sections followed; Section 1: Asking for your Consent to Share; 2: Recipients; 3: Commercialization; 4: Tracking Sharing & Results; and 5: Background Questions.

Sample size justification
As a proof-of-concept survey study, sample size was chosen by convenience, hence statistical power calculation was not necessary. Our targeted sample size of 50 participants within each disease site would provide a confidence interval range of the preference rate (95% CI: 0.36-0.64) as 0.28 with high accuracy.

Statistical analysis
Patient demographics were summarized using descriptive statistics. Distribution of responses to study questions were summarized using frequencies and percentages. Missing responses were not included in the denominator when calculating percentages. Results were also stratified by demographics to assess differences between groups, and the Chi-square test was utilized post-hoc to identify statistically significant differences between groups. Clinics were collapsed into palliative versus curative to identify potential differences based on prognosis. Analyses were conducted using SAS version 9.4 (Cary, NC). For the Chi-square analyses, the 5-point scales for questions 7 to 17 were collapsed to 3-point scales, due to small cell size in some sub-groups.

Results
A total of 272 patients agreed to participate, with 222 (82%) completing the survey. The 18% who did not complete it were interrupted due to the timing of their appointment, or they expressed difficulty in understanding the questions. Approximately 70% of those approached agreed to participate. Our demographic reporting (Table 1) was limited to age, gender, treatment stage, and clinic due to a substantial proportion of patients being reluctant to share income and education information, and patient-reported ambiguity over the classification of ethnicity (e.g. many fit within multiple categories).

Discussion
The vast majority (83%) of participants were comfortable sharing PHI with researchers at their own institution, while most wished to be asked first and apprised of its potential uses. This observation is reassuring, and reflects a generally positive attitude towards locally conducted research. The fact however, that a minority (17%) did not report comfort sharing PHI with even host institutional researchers is noteworthy, particularly since these participants had already agreed to complete a research survey.
Though willingness to complete a research survey does not necessarily correlate with willingness to share PHI, it seems reasonable to suggest that those already participating in research may hold more favorable attitudes to sharing their PHI with researchers. Thus, reality may reflect a higher proportion of the patient population that is not comfortable sharing PHI even with local researchers. This underscores the importance of addressing this challenge in organizational policy, applicable to even low-risk retrospective studies. One of our key observations relates to the effect of age on PHI sharing. Not only were younger patients more likely to report discomfort sharing with host institutional researchers and commercial companies without host institutional involvement, they were also more likely to prefer: (a) study-specific consent; (b) to be asked for permission before contact pool entry; (c) the ability to track PHI use; and (d) to receive study results. This is compelling evidence of a generational shift whereby younger patients raised in cultures of increasingly immersive technology (particularly more so than those 75 + years of age) are more hesitant to share, and desire more control over the use of their information. Our findings are consistent with previous observations that younger people prefer more control with respect to research participation than older individuals [18,21,24]. Whether these preferences will evolve over time remains to be seen, but it is possible that being raised in a technological era with platforms such as Facebook ™ and Google ™ renders this generation less trusting of institutions. Indeed, trust in institutions is commonly lowest amongst younger populations [27,28]. It may be likely that this desire will be sustained as these individuals age and become major users of health care. It would be prudent, therefore, for health care organizations to acknowledge this trend, and to adapt consent policies correspondingly.
In our study, significantly more women preferred specific consent options and held higher levels of discomfort sharing PHI than did men (Q1; Q16), a finding which has been noted previously [19,24]. Acknowledgement by health organizations of these gender differences is a step toward greater respect and inclusion; reforming existing policies to be more equitable and forward thinking would constitute significant progress.
Given that substantial groups of patients prefer studyspecific consent (38%), and would like the opportunity to consider their consent decisions and be asked again later (49%), further exploration of how practicably to provide these options is warranted. These findings are consistent with previously reported studies [22,23,29,30] reflecting many patients' general reluctance for a broad consent or no-consent model.
Debate has also been ongoing regarding opt-in versus opt-out approaches for research contact pools. Some major health organizations employ or advocate for an opt-out approach whereby patient names and select PHI (e.g. age, gender, diagnosis, clinics & programs accessed, etc.) are automatically entered into databases, and patients can contact the institution to opt-out [31]. While this streamlines the process for researchers, some have challenged the ethical defensibility and legality of sharing potentially sensitive PHI outside the circle of care without active consent [20]. The current data provide strong support for an opt-in strategy, wherein a majority of respondents (63%), and an even greater majority of younger respondents (76%) preferred to be asked for permission before entry (Q6). This corroborates previously reported observations of patients preferring opt-in [9,15,21,32]. To return to our earlier observation, it is particularly notable that the majority of patients who already agreed to participate in a research survey still wished to be asked permission before contact pool entry. One could reasonably infer that an even higher percentage of those not partaking in research surveys would prefer to be asked for permission. The success of medical research hinges on public trust in health institutions. Our findings lead us to assert that the precarious assumption of consent under an opt-out system risks undermining patients' trust in research hospitals-trust that has been tested in a number of high profile cases and is not easily regained once eroded [1,2].
The considerable level of patient discomfort with PHI being shared with for-profit commercial companies warrants broad attention. More than half of our patients (51%) reported being uncomfortable sharing with industry recipients (Q10; Fig. 2). This aligns with previous investigations in the cancer patient population, whereby low levels of trust towards industry and insurance recipients have also been reported [23]. While it appears that direct collaborations between health organizations and industry may mitigate some level of discomfort, it does not diminish it completely (51% to 28%). These results corroborate a significant and growing body of evidence that suggests that patients desire more transparency and control over commercial PHI use [9,11,15,[18][19][20][32][33][34][35][36][37][38]. We recommend that patients be provided with an active opt-in choice as to whether they wish to share PHI with commercial companies. While this proposition is likely to face strong resistance within some research and industry circles, we submit that the continuation of a practice known to cause significant discomfort in the majority of patients is a governance misstep by healthcare organizations which purport to be committed to patient-centered care and respectful of the principle of patient self-determination. At the very least, it seems uncontroversial to suggest that patients should be given the option to choose whether or not their PHI can be shared with industry when their own health organization is not an active research partner.
Our results also reflect a substantial preference to be informed of secondary PHI use (61%), and to receive results of studies using their PHI (70%). This indicates that patients truly take an interest in research uses of PHI, and in clinical research findings in general. These observations again align with existing evidence; in a 2019 broad systematic review, participants almost never expected financial compensation, but "they demanded information on the research results" [30]. Admittedly, respecting this preference will require investment in technological tracking systems, but dynamic digital platforms do exist and should be employed [39]. Although significant work is required upfront, these investments promise significant yields in the long term; patients previously reluctant to share may become more willing if more information is provided. At minimum, health organizations could ensure that results are accessible through a publically available database. It is notable that higher proportions of patients in follow-up stages of care prefer to track PHI use (72%) and to receive study results (81%). To our knowledge, this is a novel finding indicating that as patients approach the end of their care journey, the desire for information not only remains, but becomes more pronounced. This underscores the enduring nature of this preference, and further emphasizes the need for health care organizations to provide meaningful options. It is also important to highlight that the majority of patients with a palliative diagnosis (60%; n = 25) also desired the option to receive study results. The opportunity to learn how one's own PHI has contributed to the advancement of medical science may hold value and meaning for patients, including those at the end of life.
Our findings should be interpreted within the context of several limitations. Our participants were limited to those with cancer in radiation oncology clinics at a large academic centre, within a publically funded healthcare system. As such, we cannot be certain that preferences can be generalized to more diverse populations. We also acknowledge that patients may not have had extensive background knowledge on the benefits and drawbacks of each consent strategy. Although we endeavored to provide as much information as possible, we were cognizant of patients' limited time, and kept the survey to a palatable 10-min. Finally, as we have noted, our findings reflect only the preferences of patients who were willing to participate in a survey. While we have attempted to extrapolate the implications for patients not interested in research participation, we acknowledge the more speculative nature of these observations.

Conclusions
Our results underscore the importance of patient-centered consent and data governance policies that accurately reflect the identified preferences of patients. We note a consistent desire for greater transparency and autonomy, and our results particularly reveal a generational shift wherein younger patients prefer more informed consent options. Multiple factors must be considered including the consent process itself, the technological infrastructure to operationalize, and the nature of the broader healthcare system. Amongst the most readily achievable changes, we strongly recommend: (a) opt-in approaches to seek permission for research contact; and (b) the provision of genuine opportunities for uncertain patients to consider their consent decisions and revisit them later. While the following introduce more complexity, we also recommend providing options to choose: (a) broad or study-specific consent; (b) the conditions under which PHI may be shared with commercial companies; (c) whether to track secondary PHI use; and (d) whether to receive results of studies using PHI. We would be remiss to allow these results to reverberate in an esoteric echo chamber; further work must uncover strategies to translate these findings into effective policy changes. While this seems like a vast undertaking, the very technological advancements that have prompted the need for massive volumes of PHI can no doubt be applied to the design and implementation of modern consent platforms that exemplify a respect for well-identified patient values and preferences.

Survey
Hello and welcome, You are being invited to participate in this survey because you are a patient at the Princess Margaret Cancer Centre within the University Health Network (UHN). It will only take about 10 min and your answers are anonymous (i.e., not linked to your name or medical record).
During your care at UHN, health information (e.g., your medical record with diagnoses, test results, and images such as x-rays), and biological samples (e.g., blood, tissues, or bodily fluids drawn for medical procedures) are collected and stored. The main purpose of collecting and storing your information and samples is for your own treatment and care.
Your health information and biological samples are also very valuable for other purposes. They can be used to help find new ways to detect, treat, prevent, and possibly cure many health-related problems such as cancer, diabetes, and heart disease. Researchers within UHN, and at other hospital-based research institutes, universities, and health-related companies request access to your information and samples for these reasons. The purpose of this survey is to help us understand your preferences on the way we ask for your consent to share.
When you consent to sharing your health information or samples, security measures are in place to protect your privacy including removing your name and anything that could directly identify you. There is still a small risk that donated information or samples could be traced back to you.
The choice to do this survey is completely up to you. Your decision will not affect your treatment or care in any way. During the completion of the survey, you are free to withdraw at any time and your answers will be deleted. There are no known risks or direct benefits to participating. If you consent to participating in this survey, please answer the questions on the following pages.
Thank you very much!

Section 3: Commercialization
When medical discoveries are made such as new treatments or cures for diseases, commercialization (i.e., selling for money) helps the discoveries to reach and help a great number of people. It also means that researchers and commercial companies may benefit financially. Patients who contribute their health information or samples do not get any money from this commercialization. We would like to understand how you feel about consenting to your health information or samples being used for projects that involve commercialization.
1. Sometimes for-profit companies (e.g., drug or insurance companies) develop partnerships with UHN and we work together on medical research projects. How comfortable are you consenting to share your information or samples (with your name and direct identifiers removed) for these projects?