Journal de santé et d'informatique médicale

Informed Consent For Patient Data Processing In Electronic Health Records

Abstract

Mmh Jayasekara

Objective To report the results of a systematic review of national eHealth policies of different countries in relation to patient consent in patient data processing in electronic health records Method eHealth policies of 19 (14.07%) countries are reviewed with regard to patient consent, from a total of 135 countries that are indexed in the World Health Organization Directory of eHealth Policies. 68 (50.37%) policies were excluded based on language and 67 policies in English were selected for further consideration. These 67 (49.62%) policies were further evaluated resulting in exclusion of 43 (31.85%) policies due to policies being outdated and 5 (3.70%) due to broken links. Finally, a total of 19 (14.07%) countries were selected for the review. Results 57.89% out of 19 countries require patients’ informed consent to store patient data, 26.32% allow selective storage of patient data as defined by the patient, 89.47% require patients’ informed consent when sharing or transferring or accessing patient data, 68.42% of the countries allow patients access their own EHR, 73.68% facilitate correction/modification in EHR, and 26.32% facilitate deletion of patient records. 89.47% of countries highlight mechanisms to assure privacy and security of EHR. Conclusion Policymakers’ emphasis on various ethical concerns raised by EHRs has been increased highlighting patient rights related to eHealth as well as the requirement for compliance to different standards and regulations. eHealth policies must address requiring patients’ informed consent in processing of patient data whereas patients have the ability to grant or withhold consent to different processing operations related to their EHR. Furthermore, facilitating patients with access to their own records, facilitating patients with modification, correction and deletion of EHR are widely discussed topics.The questions on consent referred to an individual's electronic health record, which was described in the survey as ‘computer records with complete and detailed health information’. Although the removal of name and address might not ensure anonymity, we used these measures here as being most relevant to conceptions of personal identity, to denote the difference between identifiable and de-identified records. By mentioning that these identifiers would be removed, we also refer to situations were these would not be visible by, for example, researchers performing database queries.

Additional questions captured socio-demographic characteristics and other personal information (birth year, sex, ethnicity, highest educational qualification attained, confidence with computers), as well as patterns of personal healthcare use (types of health services accessed in the six months before the survey).

Only respondents who provided complete data across all independent and dependent variables of interest were included in the final sample (N = 3157). We examined the frequencies of the missing values and used Pearson's Chi-squared test to establish whether differences existed between the analysis sample and the missing sample in the socio-demographic factors, and the distribution of responses on the three questions of interest. Using logistic regression we determined whether certain factors were associated with an individual's inclusion in the final analysis sample.

Descriptive statistics were used to summarise the characteristics of respondents included in the survey sample, and to examine the distribution of responses on the three questions of interest. We examined bivariate associations between the three outcome variables, and between each of the outcome questions and the independent variables, using Pearson's Chi-squared test. Using a multivariate regression model, the associations between each of two outcome questions (consent for de-identified EHRs use and awareness of EHRs) and the socio-demographics and healthcare use were analysed, adjusting the regression analysis for potential clustering at each of the recruitment sites. As a theoretically important consideration, prior awareness of EHRs was also included as an independent variable in the multivariate model for consent preferences. Each regression model was assessed using Hosmer-Lemeshow's goodness of fit test, specifying a grouping of 10. We reported all results at the 95% significance level, and performed the analysis using Stata IC version 11. Full details of the study protocol and the original survey questionnaire have been published elsewhere [49].

In relation to public and patient views on consent options for data sharing, this study illustrates that the majority of respondents (91%) would expect to be explicitly asked for consent before their identifiable EHR is accessed, regardless of the reason for access—including for use by healthcare professionals. When sharing de-identified records (name and address removed), fewer participants (51%) said they would expect explicit consent to be sought before data sharing for care, research and healthcare planning. Socio-demographic factors and personal characteristics were further associated with consent preferences. Respondents who identified themselves as belonging to an ethnic group other than ‘White British’, or who were less confident with computers, and those with lower educational qualifications were more likely to expect to be asked for explicit consent before their de-identified records were accessed.

In terms of awareness of EHRs, many participants reported having heard of EHRs before taking part in the survey. However, a sizable minority (41%) reported not being aware of EHRs. Older respondents were more likely to have heard of integrated records. Individuals who identified themselves as belonging to non-White British ethnic groups were less likely to report being aware of EHRs. Those with lower educational qualifications and those reporting less confidence in using computers were also less likely to report having heard of EHRs. Participants who had interacted more with health services seemed to be more exposed to information about EHRs, and the NHS was the second most frequent source of information. Awareness of EHRs was associated with a greater likelihood of reporting acceptance of implicit consent as a model to govern de-identified health information sharing.

As participants reported not being aware of EHRs before the survey, some could have been formulating their views at the time of completing the questionnaire. Responses might have also depended.