Perceptions of anonymised data use and awareness of the NHS data opt-out amongst patients, carers and healthcare staff

Abstract

Background

England operates a National Data Opt-Out (NDOO) for the secondary use of confidential health data for research and planning. We hypothesised that public awareness and support for the secondary use of health data and the NDOO would vary by participant demography and healthcare experience. We explored patient/public awareness and perceptions of secondary data use, grouping potential researchers into National Health Service (NHS), academia or commercial. We assessed awareness of the NDOO system amongst patients, carers, healthcare staff and the public. We co-developed recommendations to consider when sharing unconsented health data for research.

Methods

A patient and public engagement program, co-created and including patient and public workshops, questionnaires and discussion groups regarding anonymised health data use.

Results

There were 350 participants in total. Central concerns for health data use included unauthorised data re-use, the potential for discrimination and data sharing without patient benefit. 94% of respondents were happy for their data to be used for NHS research, 85% for academic research and 68% by health companies, but less than 50% for non-healthcare companies and opinions varied with demography and participant group.

Questionnaires showed that knowledge of the NDOO was low, with 32% of all respondents, 53% of all NHS staff and 29% of all patients aware of the NDOO.

Recommendations to guide unconsented secondary health data use included that health data use should benefit patients; data sharing decisions should involve patients/public. That data should remain in close proximity to health services with the principles of data minimisation applied. Further, that there should be transparency in secondary health data use, including publicly available lists of projects, summaries and benefits. Finally, organisations involved in data access decisions should participate in programmes to increase knowledge of the NDOO, to ensure public members were making informed choices about their own data.

Conclusion

The majority of participants in this study reported that the use of healthcare data for secondary purposes was acceptable when accessed by NHS. Academic and health-focused companies. However, awareness was limited, including of the NDOO. Further development of publicly-agreed recommendations for secondary health data use may improve both awareness and confidence in secondary health data use.

Plain English summary

Health data from routine care can be pseudonymised (with a link remaining to the patient but identifying features removed) or anonymised (with identifying features removed and the link to the patient severed) and used for research and health planning; termed “secondary use”. The National Health Service (NHS) is a single publicly-funded health service for the United Kingdom (UK). The NHS supports secondary data use with a National Data opt-out system. The potential benefits of data secondary use are clear but concerns have been raised. Although the Data Opt-Out is publicised, it is unclear how much public awareness there is of this scheme. We report a patient and publicly created and delivered series of activities including > 350 people; with young adults, patients, NHS staff and the public; to assess concerns, knowledge and acceptance of data sharing.

Perceptions of and support for secondary health data use varied depending on who was asked (by age, gender) and their experience of health services (Staff member, patient, member of the public). Knowledge of schemes to limit secondary data use (such as the UK National Data Op-Out) was low, even among NHS staff. The main concerns of sharing health data included onward data use, the potential for discrimination and exploitation and commercial gain from data use with no benefit to patients. Despite this, most participants agreed with health data sharing with NHS, academic and commercial health-based entities. Agreed, co-created themes to increase the acceptability of health data secondary use included education about ‘Opt-out’ schemes, health service oversight of data use (as the most trusted partner), public and patient involvement in data sharing decisions and public transparency.

Introduction

The National Health Service (NHS) is a single publicly-funded health service for the United Kingdom (UK) which is free at the point of need to the entire population. The NHS necessarily holds identifiable patients’ medical records within specific NHS organisations [1] but this is confidential [2] and classed as sensitive [3]. Electronic health records (EHRs) facilitate data sharing, which is beneficial for the individual [4] especially when care is co-delivered across organisations [5]. Also, EHRs facilitate health data sharing for health service planning, research and innovation, termed secondary use [6] but this usually involves anonymised data [7].

Previous research suggests there is general support for sharing confidential health data for research and planning [8] but there are public concerns [2, 9, 10], especially where data is not fully anonymised or made available for commercial use [8, 11]. This was recently highlighted [12] with 2080 UK citizens who responded to an online survey reporting they were willing to share their data in the following percentages; with academic or medical research institutions (50.3%); a pharmaceutical company (19.8%) or a tech company with an aim to improve health care (12.2%). Little information was provided about the characteristics or healthcare utilisation of the respondents [12] and it is unclear if these preferences might be context dependent – for example people may support the secondary use of health data if people were frequent users of healthcare services or care-givers, or if data sharing was overseen by an organisation local to the participant.

The UK’s NHS is a centralised health system in which the secondary use of data is supported but the capability to opt-out of confidential data use exists, although there is some variation across the UK. In England, organisations can apply to use specific data fields from all patient records, unless patients have ‘opted out’ through the National Data Opt-Out (NDOO) or where there are specific exemptions, such as the recent Control of patient information (COPI) notice for COVID-19 [13, 14]. Where patients have not ‘opted-out’, it is presumed that they have no objection to their data being used for secondary purposes, within the limits of national guidance [2, 14, 15].

Although the NDOO is publicised online and physically in healthcare organisations, studies suggest there is variable public awareness of this scheme [16]. Suggested frameworks to maximise the secondary use of health data often do not include patients’ and citizens’ views [17] although the importance of these views are widely recognised [18]. There is a national consultation to review the Caldicott Principles which guide data use, including consideration of an additional principle that patients’ and service users’ expectations must be considered and informed when confidential information is used [19].

PIONEER is a Health Data Research Hub in acute care, developed to curate routinely-collected health data from unplanned healthcare contacts across community and hospital providers and then facilitate the transparent and ethical use of anonymised data for research and innovation purposes, with a direct aim of improving NHS patient care. PIONEER is based in the West Midlands and to ensure data use reflected the wishes of patients’ whose data are included in the hub, a regional patient and public involvement and engagement (PPIE) programme was initiated, to assess current knowledge and perceptions of health data use.

We hypothesised that public awareness and support for the secondary use of health data and the NDOO would vary by participant demography and healthcare experience. To assess this, we aimed to explore patient/public/carer/NHS staff and NHS volunteer awareness and perceptions of secondary data use, grouping potential ‘data access researchers’ by NHS, academia, healthcare commercial and non-healthcare commercial backgrounds. We aimed to assess the awareness of the NDOO system amongst these groups. Third, we aimed to co-develop with patients, carers and members of the public recommendations to consider when sharing unconsented health data for research.

Methods

PIONEER is an ethically-approved research database and analytical environment (East Midlands – Derby Research Ethics 20/EM/0158). This PPIE work was conducted following ethical approval from the University of Birmingham Ethical Committee (reference ERN_20–0118).

Setting and activity

The project included patients and staff from University Hospitals Birmingham NHS Foundation Trust (UHB), one of the largest NHS Trusts in England, with 2750 beds, more than 22,000 staff, a fully EHR (Prescribing Information and Communication System) and a shared primary and secondary care record (Your Care Connected). Members of the public were recruited from public stands and public involvement groups across the West Midlands. For more details of participant recruitment and questionnaire delivery see the online supplement and the individual activities, below.

The project included six activities, running between February 2019 and July 2020, as shown in Table 1.

Table 1 The structure of patient and public activity

Public members and patients were involved in all stages of the design, delivery, analysis and dissemination of this work.

Participants in the workshops and questionnaire respondents were told that the purpose of the project was to support the development of working practices for PIONEER. Interpreters were used as required.

Patient workshop

An open workshop was held with patients of UHB. To be considered a “patient” for this workshop, participants had to self-declare that they had been admitted to UHB hospital within the past year and were members of a patient support group. There were no other inclusion or exclusion criteria. The workshop lasted 4 h with a scribe to take notes. Identified themes were then approved by attendees.

Public workshop

To be considered a “public member” for this workshop, participants had to self-declare that they had not been admitted to UHB or any other hospital within the past year. People were asked to self-report their area of residence, age, gender, ethnicity, whether they had been a patient at UHB any other hospital outside of the last 12 months and whether they were a care-giver to people with health challenges (or could choose not report any of these groupings). There were no other inclusion or exclusion criteria. The workshop lasted 4 h with whole group discussion and smaller break out groups. The workshop and break-out groups were audio-recorded with a scribe to take notes. Themes and action points were recorded and then approved by attendees.

Questionnaire co-creation and delivery

A short questionnaire was developed by patient/public members and the PIONEER Health Data Research Hub team. See Table S1 of the online supplement for the questions asked. Verbal consent was given by all participants and where children under the age of 18 were approached, their parent, legal guardian or responsible adult provided verbal consent. Participants were asked to self-report their age group, ethnicity, gender, and to place themselves into one of six groups (patient, care-giver, visitor to hospital, NHS staff, NHS volunteer, public member) or they could choose not to report any of these groupings.

Feedback sessions

Participants at the patient working group and public workshop were invited to a further meeting where the results of the questionnaire were presented and discussed. In a free discussion, participants considered thse results and formed agreed founding principles for data access processes. The workshops were audio-recorded with a scribe to take notes. The identified principles were then approved by attendees.

Data analysis

Stakeholder workshop audio-recordings were transcribed. Notes of group discussions were also reviewed. As data was collected, thematic analysis was undertaken in an iterative process, searching for commonly expressed views, feelings or words. Summaries and initial themes of the workshops and working groups were shared with participants for their feedback. Participants commented on the findings and particularly on any areas that they felt had been misunderstood. They were also encouraged to make further comments and agree themes.

Demographic data from the questionnaire (age, sex, ethnicity) was compared to the 2011 Birmingham census data and Jan 2019 – Jan 2019 UHB patient episode data. Statistical analyses were performed using IBM SPSS statistics. Comparisons between groups were performed using Chi squared and Fisher Exact tests. A p value of < 0.05 was considered statistically significant.

Results

Patient workshop

Twelve Birmingham-based patients were included with a median age of 68 years (range 39–78), 58.3% identified as female, the rest as male. They had a median of 3 admissions to hospital in the last year (IQR 2–3.5) and all had chronic respiratory diseases. Five members of the group described themselves of Black, Asian or minority ethnic (BAME) background (41.7%) and seven as of White ethnic group (58.3%).

There was unanimous agreement that routinely collected health data could improve healthcare, with recent examples discussed [20]. The agreed, key concerns about health data use were;

• 1. Unauthorised data re-use or sharing.

• 2. Re-identification of the individual

• 3. Data used to discriminate against groups or the individual.

• 4. Data being used to generate commercial profit which did not benefit the NHS or UK population.

A key area of discussion was the question of who controlled access to the data. The participants agreed it was important that a trusted partner oversaw data access and use, with the NHS identified as the most trusted partner in the UK. There was agreement that data minimisation was the most appropriate model for access to unconsented health data; with a defined project and data fields, and in accordance with the ‘5 safes’ [21].

83.3% people present had not heard of the National Data opt-out. All thought that data access decisions should be decided in consultation with patients.

The following key points were agreed to help build specific recommendations:

• 1. Data use was supported if there were benefits to NHS patients or wider population.

• 2. Most were not aware of the NHSE National Data Opt-Out.

• 3. Oversight of data use should be provided by the NHS as the most trusted organisation.

• 4. Unconsented data use should be limited to what is needed;

• 5. Patient/public involvement in data access decisions.

• 6. Transparency of data use. There should be an open dialogue with public and patients.

For direct quotes from the workshop, see Table S2 of the online supplement.

The public workshop

This workshop was attended by 30 delegates. 46.7% were based in Birmingham, 43.3% in the wider West Midlands and 10.0% external to the West Midlands. 46.7% identified as male, 50% as female and 3.3% preferred not to say (0% preferred to self-define gender outside of these groupings). Median age was 52 years (range 23–84) with 20% identifying themselves as from BAME backgrounds. 76.7% had been to an NHS hospital for care previously (but not in the past 12 months and none were undergoing active follow up or treatment). 23.3% self-defined themselves as care-givers for another person with health challenges.

93.3% were happy for health data to be used for research and innovation processes, however all agreed there were risks with health data use

Without knowledge of the patient workshop results, the public workshop agreed the main risks of health data sharing were;

• 1. Onward data sharing or use without approval

• 2. Data used against the individual or communities (discrimination and exploitation)

• 3. Re-identification of the individual

• 4. Commercial gain from data use (and especially misuse) with no benefit to patients or the UK.

13.3% were concerned about commercial organisations accessing data. All agreed that there should be a searchable record of supported health data access requests. Participants agreed unanimously that patients and the public should be involved in data access processes. Sensitive data or rare conditions were felt more challenging because of the potential consequences or ease of re-identification and that relevant groups should be involved in these data access processes. 76.7% had not heard of the NHS National Data Opt-Out.

The results of the patient workshop were then shared and the group were then asked to consider and agree principles for PIONEER and to form the basis for recommendations to data providers when considering health data secondary use. These were as follows;

• 1. Health data use with meaningful benefits back to NHS patients and citizens was supported.

• 2. Data sharing with healthcare providers, academic staff and commercial entities should be considered, as long as there was community support and public awareness campaigns to inform people about how their data was being used.

• 3. Knowledge of the National Data Opt-Out was low and needed to be improved.

• 4. Preferably, data should remain in close proximity or within the NHS, with data sharing overseen by the NHS.

• 5. Data access should be limited to what is needed for a specific project, with agreements about who accesses the data and for how long (in essence, applying the principles of data minimisation).

• 6. There should be patient/public involvement in data access decisions and key advice sought, especially where sensitive fields or rare conditions were included.

• 7. There should be transparency in how health data is used, including publicly available lists of projects, summaries and benefits.

For direct quotes from the workshop, see Table S2 of the online supplement.

Questionnaire results

Demographic details for those that completed the questionnaires are shown in Table 2.

Table 2 Demographics of the 308 participants who completed the questionnaires. All category responses were self-defined by respondents

Demographics of those completing the questionnaire were broadly comparable to patients who used UHB services but there was less representation of Asian participants than the Birmingham catchment area, based on the 2011 census data. See Figure S2 of the online supplement.

Current use of anonymised data

Figure 1 and Table 3 show how respondents thought their healthcare data was currently used. 96.1% thought their data was used for their own healthcare, 71.0% to improve general NHS services and 60.2% used by research by NHS staff. The majority of participants did not think their health data was used by external agencies including university researchers, or staff from healthcare-focused or non-healthcare focused companies.

Fig. 1

Perception of where healthcare data is currently used. Respondents were asked whether they thought that their health data was currently used for seven purposes, as listed, with a possible answer of yes (shown in grey), no (in black) or unsure (white). All participants answered this question

Table 3 Perception of how anonymised health data is currently used. Respondents were asked whether they believed that their health data was currently used for the seven purposes outlined

Comparing the categories of data use, there was no difference in responses by gender or ethnicity. In general, adult volunteers at the hospital thought that health data was currently being used for more purposes than any other group of respondents. Amongst adult respondents, more staff thought data was currently used for research by NHS researchers than those who were patients (73.5% vs 48.5%, p < 0.0005).

National Data opt-out (NDOO)

In total, 31.8% were aware of the NDOO. Table 4 shows the percentage of respondents aware of the Opt-Out within each demographic group. A higher proportion of women than men were aware of the NDOO (36.9% vs 24.2%, p = 0.021). A lower proportion of those under 18 years old were aware of the NDOO compared to those who were over 18 years old (10.3% vs 36.8%, p < 0.0005). More NHS staff and volunteers were aware of the Opt-Out compared to those with all other groups (p < 0.0005) and the groups least aware of the NDOO were members of the public, with less than 20% being aware (Fig. 2).

Table 4 Awareness of NHS National Data Opt-Out scheme. Respondents were asked whether they were aware they could opt-out of their anonymised health data being used

Fig. 2

Awareness of NHS data opt-out scheme. Percentage of respondents who were aware of the NHS data opt-out scheme by reason for visiting the hospital or members of the public. All participants answered this question

Acceptable data use

Figure 3 and Table 5 demonstrate the percentage of respondents that would be happy for their anonymised health data to be used for each potential purpose. Three categories were acceptable to more than 90% of respondents: organising NHS services (95.1%); improving NHS services (95.1%); and research by NHS researchers (93.8%). Fewer participants were happy for their data to be used for university researchers than by NHS staff (84.9% vs 93.8%, p < 0.0005), although support was high. Over 65% of respondents were happy for their data to be used by healthcare-focused companies but just over 40% were happy for their data to be used by non-healthcare-focused companies. A higher proportion of those aged 12–17 years old were happy for their anonymised data to be used by healthcare-focused companies compared to those aged 65–74 years or 75–84 years (86.4% vs 55 and 33.3%, p = 0.001). Less women than men were happy with data use for organising services (92.3% vs 99.2%, p = 0.01), projects that improve NHS services (92.8% vs 98.3%, p = 0.031), and research by NHS researchers (91.6% vs 97.5%, p = 0.038). There were no other significant differences between responses by gender, ethnicity or reason for visit.

Fig. 3

Acceptability of the use of anonymised health data by purpose. Respondents were asked whether they would be happy for their anonymised health data to be used for seven purposes. All participants answered this question

Table 5 Acceptability of the use of anonymised health data by purpose Respondents were asked whether they would be happy for their anonymised health data to be used for seven purposes, without being asked for their consent

Current use compared to acceptable use

Responses for each category were assessed, comparing how respondents thought data was currently used and whether they would be happy for the data to be used. For all categories, a significantly higher proportion of respondents said they would be happy for their data to be used than thought it was currently used for this purpose (Table 6).

Table 6 Comparison of proportion of respondents who think their health data is currently used for each suggested purpose, compared to the proportion that would be happy for their data to be used in this way

Feedback groups

The results of the questionnaires were presented and discussed with the patient and public workshop attendees. There was agreement across the attendees that health data use was broadly supported, especially when the researchers were associated with organisations related to healthcare. Also, that as knowledge of the NHS National Data Opt-Out was low, people did not have the opportunity to exercise their right to opt out through a potential lack of awareness. The seven principles to guide unconsented health data use described above were ratified without change and were put forward as recommendations for organisations who are involved in providing access to health data.

Discussion

Different countries operate different legal frameworks for health data access, with the UK choosing a National Data Opt-Out (NDOO) [14] working within the principles of the General Data Protection Regulation (as defined initially by the European Union [22] and Information Commissioner’s Office [23]. Recent questionnaires suggest variable support for data access, but this may depend on the population asked. Few people have asked young adults and the views of frequent healthcare users or care-givers may differ from those without chronic illnesses. There may be regional differences related to where the data is stored and which organisation is Data Controller. The PIONEER Hub contains health data from the West Midlands and so the opinions of local patients and citizens were sought. We describe the initial phases of a program of work to explore these themes.

In general, there was little knowledge of, but then support for the use of anonymised health data for secondary purposes by NHS, academic and commercial organisations, providing there was a link to healthcare and that there was patient and public involvement and engagement in data-sharing decisions and outcomes. Only research by non-healthcare-focused commercial organisations received less than 50% support. The reported support for health data use in the current paper are much higher than reported recently [12]. The reasons for the disparity are unclear. This might reflect differences in the population questioned, or the inclusion of patients and visitors to hospital and NHS staff. The current study included people who self-selected to take part in this series of workshops or who agreed to answer a questionnaire, and therefore views expressed may not be reflective of the wider population and could form a source of bias including selection and sampling bias. However, the demographics of respondents were broadly similar to the West Midlands population, and information was available for translation as needed. A wider survey of the population would be needed to reduce bias, although even here non-response bias can be difficult to overcome [24]. In the current study, participants were asked to comment on healthcare-focused or non-healthcare-focused companies, but there are a wide variety of healthcare companies and people might feel more comfortable with health data secondary use if different examples of benefit could be clearly provided across this diverse sector.

Awareness of the NDOO system was low including in NHS staff. This suggests that increased education is needed for the public, patients and carers, as well as those working in healthcare. In the patient and public workshops within the current study, it was agreed that knowledge of the NDOO was low and needed to be improved. Currently, training about the secondary use of health data or the NDOO is not taught routinely to healthcare professionals or healthcare students and there are minimal opportunities for patients or public members to be informed about health data use for research and planning. Introducing the benefits that come from health data secondary use and the NDOO within the mandatory training undertaken annually by healthcare staff may be an effective means to increase awareness. Providing more opportunities for non-healthcare professionals to learn about the NDOO through webinars or public events may also increase awareness, with data providers working synergistically.

Previous surveys also suggest that public citizens have greater confidence in data use for research conducted through the NHS than by pharmaceutical companies [25]. In our study, the NHS was consistently identified as the most trusted partner to hold data or make decisions on health data use, mirroring the findings of a recent OneLondon event [26] and previous research [11, 27].

The results from our study are in keeping with those recently published from Understanding Patient Data, which described a majority of people believing the public should be involved in decisions about how NHS data is used and that benefits from health data partnerships should be shared across the NHS [28].

The principles of data minimisation (access only to what data was needed and no more, by only those who needed to access the health data) viewed favourably by our participants has also been highlighted in previous engagement events [26] and may help to increase acceptability of data use for secondary purposes [29].

Those aged 13 years or older were included here as individuals can choose to use the NDOO from the age of 13 (see [30] for more details). Our results suggest those under 18 may be more accepting of anonymised data use by healthcare-focused companies than older adults, and that they had lower awareness of the NDOO that adults (10% aware), but this requires further study. A previous study of the perception of electronic health records found that 60% of young people did not understand how healthcare records could be beneficial to research, which improved after education [31].

This study has limitations. The sample size was limited, especially of patients in the initial workshop and results should be interpreted with this in mind, including the potential for bias. Participants included patients, carers, NHS staff, NHS volunteers and members of the public within the West Midlands, and should not be extrapolated across other populations, nor considered to definitively represent the views of the local or wider population. Further work is needed to understand if perceptions of health data use differ across different groups or communities. Workshops allowed for a more in-depth assessment of patient and public perceptions, but did not fully explore why participants would not be happy for their data to be used for specific purposes.

Conclusion

This study highlights the continued lack of awareness of the secondary use of health data and the NDOO. There is a clear need to increase awareness of and provide greater clarity about the use of health data for research and planning, including the benefits this can provide to patients and the wider public. Related to this is a need to inform people (including healthcare staff) about the NDOO within the UK, enabling people to make an informed decision about how aspects of their health data are used. Potential means to do this might include information about data use and the NDOO during healthcare student courses or during the annual mandatory healthcare training that all healthcare professionals must attend. For patients, information could be provided during admissions to hospital or out-patient attendances. For members of the public, a series of public events, including webinars, leaflets and meetings, may enhance public knowledge. Developing and testing the most effective means to enhance knowledge requires further research.

Patients and members of the public co-developed a series of recommendations for data-providers to consider when engaging in data sharing activities, which included considering patient benefit, transparency and patient/public involvement, proximity to healthcare services and data minimisation. These require ratification by different public groups and further research to test if the implementation of these recommendations reduces concerns or increases public confidence in data sharing. However, these recommendations are concordant with individual outputs made by other public workshops, and were unanimously agreed by patients, care-givers and members of the public, suggesting they should be considered in data sharing activities.