Hi, welcome! Today I'll share highlights of our paper - Towards Responsible Data Practices
in Digital Health: a case study of an open source community's journey.
For some context, I'd like you to imagine yourself at your most recent clinical visit sitting with
your health care provider, even remotely. As you seek and receive care your interactions with
your clinician and the health care system generate massive amounts of information.
Primarily these data are used by your clinical team in providing you care and,
if you're unwell, to guide your clinician to a diagnosis and treatment.
Yet as you know, these data also offer massive potential beyond your direct care, including informing public health disease
surveillance interventions, supporting a huge spectrum of research, and informing health policies.
But, as a patient what you decide to share may not only have direct consequences on
your own care but it may also impact the health of your community or beyond.
On the health policy front in 2016, the European Union passed a strong personal data protection
law that requires organizations to obtain your preferences for how they may share and use your
personal data. Many places around the world have adopted similar legislation including
Panama, Kenya, Uganda, South Africa, Nigeria and the state of California. From a human computer interaction
vantage point we know that data flow is mediated by the technologies that we build and research
which leads us to our broad, multi-stage research question: how can digital health stakeholders best operationalize data privacy?
We think about this research topic in two layers. The top layer is to understand
what are the best practices and policies in organizational data sharing and use.
The bottom layer looks at the interaction between healthcare providers and patients.
Here we want to understand the best practices in patient consent, which is the critical link
where patient privacy rights are established and documented between individuals and organizations.
This case study covers two components: (1) a literature scoping review and
(2) a participatory redesign of policies and practices to guide an open source digital health organization
Our literature scoping review explored two questions:
(1) what are the ethical and practical dimensions of collecting, sharing, and using routine data?
and (2) what are the best practices in informed consent?
We searched five databases for empirical research and policy papers using scoping review literature
methods. We fully reviewed over 100 papers. For more details on our methods please see our paper
We highlight here a summary of our findings. For data sharing and use the literature we found:
focuses on the ethics and practices of sharing data collected for research studies, rather than
captured for routine care. There was a variety in data sharing models, particularly for research data.
Several studies outlined the need for and composition of data governance models.
There were also many discussions around how to share aggregate or de-identified data
where the papers noted the many difficulties of truly creating de-identified datasets in the era of big data.
In terms of informed consent, again the papers we reviewed
focused on how to conduct patient informed consent for enrollment in research studies.
Many studies highlighted the importance of staff training given that consent is
complicated; requires specific knowledge about data use; and often takes a long time to do.
Additionally the scoping review identified many gaps in the literature.
Overall it was difficult to synthesize our findings into robust categories.
There is a lot written across the many disciplines on this big topic of data privacy and from many vantage points.
We think our difficulty synthesizing is emblematic of the complex landscape.
Many of the empirical studies also took place in higher income countries
Our search of the main global health database did not uncover many articles.
We suspect more country-specific inquiries and searches are warranted.
We are also surprised by the gap in empirical studies of consent processes for routine care settings.
This is potentially influenced by the newness of the EU-style legislation
It is also possible that additional literature or database searches may uncover useful research.
Finally there was a surprising lack of studies on digitally enabled consent.
In our review, we found only one reference to digital consent and it came from a US clinic that was
simply entering information from a paper consent form into a database.
More work here is needed.
Now, turning to the second part of our case study, where we explored
participatory redesign of a digital health's organizational policies and practices.
Here we explored the question of: what are the critical elements to data sharing agreements
digital health policies and internal practices that can support responsible data practices?
Overall, this redesign process highlighted that policies and agreements and human resource requirements
are highly interdependent.
Frankly it's a detailed and labor-intensive process
to harmonize policies and processes.
We also recognize that there is great need for this kind of work.
We heard from many similar partners that stronger data policies and agreement templates would be useful
and Medic Mobile plans to share their templates after full legal review.
Our research squad found it exciting to reconfigure partnership agreements to make them
more user-friendly.
We found, for example, that Medic Mobile required several kinds of data sharing and use agreements,
so we worked to bucket out different partnership types to better suit specific project needs.
We also work to make the data use agreement a one stop shop document
for partners and Medic Mobile staff to understand the project-specific terms for data sharing and use.
For our next steps, we'd like to co-design and reimagine informed consent
how can technology facilitate the consent process and support personal data rights
This case study showcases the complexity of extending data rights.
It also highlights that literature currently focuses on data generated from research
with with vast opportunity to reimagine consent and data sharing for routine care.
Informed consent would also benefit from more attention from the HCI community.
There's an unspoken requirement for digital infrastructures
that were not articulated in the literature that we found.
These infrastructures are highly complex to design
and will require rapid evolution to keep pace with data privacy standards
Thank you for listening. Please feel free to contact us with any questions or ideas.