Principles for Health Information Collection, Sharing, and Use: A Policy Statement From the American Heart Association

Abstract

The evolution of the electronic health record, combined with advances in data curation and analytic technologies, increasingly enables data sharing and harmonization. Advances in the analysis of health-related and health-proxy information have already accelerated research discoveries and improved patient care. This American Heart Association policy statement discusses how broad data sharing can be an enabling driver of progress by providing data to develop, test, and benchmark innovative methods, scalable insights, and potential new paradigms for data storage and workflow. Along with these advances come concerns about the sensitive nature of some health data, equity considerations about the involvement of historically excluded communities, and the complex intersection of laws attempting to govern behavior. Data-sharing principles are therefore necessary across a wide swath of entities, including parties who collect health information, funders, researchers, patients, legislatures, commercial companies, and regulatory departments and agencies. This policy statement outlines some of the key equity and legal background relevant to health data sharing and responsible management. It then articulates principles that will guide the American Heart Association’s engagement in public policy related to data collection, sharing, and use to continue to inform its work across the research enterprise, as well as specific examples of how these principles might be applied in the policy landscape. The goal of these principles is to improve policy to support the use or reuse of health information in ways that are respectful of patients and research participants, equitable in impact in terms of both risks and potential benefits, and beneficial across broad and demographically diverse communities in the United States.

The American Heart Association (AHA) advocates for policies, funds research, and creates and disseminates clinical guidelines to encourage longer, healthier lives. As part of its mission, the AHA funds, supports, and encourages scientifically meritorious research and advocates for a broad strategic policy agenda at the local, state, and federal levels. This strategic policy agenda includes promoting access to quality, affordable health care; addressing primary and primordial prevention at a population level; and advancing heart disease and stroke research.¹ The goal of this document is to transparently establish the principles that the AHA will use when engaging in public policy related to data sharing and data privacy.

As electronic health record information becomes increasingly harmonized (ie, curating or normalizing data such that they can be compared and validated against each other)—along with advances in data curation, sharing, and analytic technologies—uses of health-related and health-proxy information (health information) are already accelerating research discoveries and patient care.² Broad data sharing can be an enabling driver of progress by, for example, providing data to develop, test, and benchmark innovative methods, scalable insights, and potential new paradigms for data storage and workflow.^3–5 Data sharing can also improve collaboration between researchers across multiple disciplines, resulting in significant new discoveries. Moreover, increased data circulation can create a valuable common resource that facilitates reproducibility of results, leading to a more robust evidence base and informed health decision-making.^6,7

Along with this promise come concerns about the sensitive nature of some health data, equity considerations about the involvement of historically excluded communities,⁸ and the complex intersection of laws attempting to govern behavior in this space. Even when the health information that is shared is deidentified, reidentification is increasingly common, especially given the prevalence of other kinds of information freely available on the internet.⁹ Data that include genomic or particular kinds of geolocation data are uniquely identifiable, meaning that even if they are stripped of the 18 identifiers (eg, name or date of service) included in the privacy rule of the Health Insurance Portability and Accountability Act of 1996 (HIPAA),¹⁰ they may still be unique to only 1 individual.¹¹ Data are also revealing associated phenotypic information never thought possible, such as when researchers recently reported that certain artificial intelligence models were able to predict self-reported race from medical image pixel data¹² or the identification of anonymous patients undergoing magnetic resonance imaging with facial recognition software.¹³ In addition, deidentified, or even identified, health information is being increasingly shared with commercial entities.¹⁴ This practice raises questions about contributor (eg, patient, research participant, stakeholder, or commercial customer; Table) preferences, as well as privacy concerns. In addition, even if health information is fully deidentified, risks related to individual privacy or “nonwelfare interests” remain (ie, “moral, religious, or cultural concerns about the future uses of their donations”).¹⁵

Table.

Definitions

Term	Definition
Contributor	A patient, research participant, or consumer of a product whose data are included in a research study or database
Health information analytics	The use of data analytics, including artificial intelligence, to examine health information
HIPAA business associate	A person or entity performing certain functions or activities that involve the use or disclosure of protected health information on behalf of, or which provides services to, a HIPAA-covered entity
Common rule	Subpart A of the human subjects research regulations that describes the basic Department of Health and Human Services policy for the protection of human research subjects

HIPAA indicates Health Insurance Portability and Accountability Act of 1996.

Data-sharing principles are therefore necessary across a wide swath of entities, including parties who collect health information, nongovernmental agencies (NGOs), funders, researchers, patients, legislatures, commercial companies, and regulatory departments and agencies. Education related to these core principles, including both their benefits and burdens for contributors or entities, is critical to ensure scientific progress while respecting those who contribute data. As the largest nonprofit funder of cardiovascular research in the United States (second only to the US government), the AHA is committed to tailoring guidance that spans its policy research and advocacy work, investigators, and funding.

The present policy statement first outlines some of the key equity and legal background relevant to health data sharing and responsible management. It then articulates the principles that will help guide the AHA’s engagement in public policy related to data collection, sharing, and use and inform its work across the biomedical research enterprise.

NEED TO INCREASE THE INCLUSION OF UNDERREPRESENTED COMMUNITIES IN RESEARCH COHORTS

Within the promising exponential expansion of the use and applicability of health information analytics lie concerns about misuse, misapplication, and biases.^16,17 Research with health information carries the extraordinary potential of improving health equity, but to leverage this opportunity fully, stakeholders must also consciously contribute to the development of a governance architecture founded on inclusion and equity. To do so, stakeholders must rely on improved methods of oversight, stewardship, and accountability. For example, medical algorithms are typically developed in high-resource medical settings such as academic medical centers because they are more likely to have been early adapters of electronic medical records and offer longitudinal data and reputational benefits.¹⁸ A recent study found that 71% of surveyed algorithms were trained on data sets from 3 coastal states (California, Massachusetts, and New York) and were not representative of the diversity of the nation.¹⁹

Research data sets have also historically been populated largely with participants who self-identify as non-Hispanic White and are of European ancestry.^20–26 Largely demographically or geographically homogeneous data sets can limit generalizability across diverse patient populations, resulting in potentially inaccurate recommendations for the populations not included in the data, compounding health care disparities.^27–32 Both historical and current reasons for the exclusion of certain populations from primary and secondary health research protocols can be closely tied to individual, institutional, and structural biases such as racism.^30,31 Accessibility is limited by access to the health care and research that generate health information in the first place, recruitment design, and different consent rates across communities.³² Trust can be further compromised by personal, technological, and institutional factors that include fear of data exploitation, lack of digital access, and historical abuses.³³ Increasing the trustworthiness of researchers and funders, as well as accessibility and comfort with database inclusion across historically excluded communities, is of utmost importance.³⁴

LAWS AND REGULATIONS

One challenge with ascertaining best practices to achieve these goals for health information collection, sharing, and use is the complex intersection of current laws governing this space. In the United States, 2 major federal regulatory regimes oversee health information collection: HIPAA¹⁰ and the Human Subjects Research Regulations (HSRR).^35,36 Although “covered entities” and human subjects researchers must comply with these regulations, they are complex and have many gaps in privacy protections.³⁷ The 21st Century Cares Act (2016) also required the development of a “trusted exchange framework” with an infrastructure and governance model for health information networks to share health information with each other. The resultant Trusted Exchange Framework and the Common Agreement was published in 2022.³⁸ That said, the health data collection and sharing space warrants additional policy and direction.

HIPAA sets out the rules for the disclosure and use of protected health information, defined as data that include “individually identifiable health information”³⁹ such as name, date of birth, or medical record number,⁴⁰ collected by covered entities. Covered entities, in turn, include hospitals, clinicians, or insurers,³⁹ which means that HIPAA protects only this limited area of health information. Entities outside of this definition (eg, NGOs, direct-to-consumer genetic testing companies) typically do not have to follow the HIPAA rules. Health data that are not individually identifiable or are deidentified are not covered by HIPAA, even for covered entities, and can be shared without consent from contributors.

There are several exceptions to the HIPAA protections even for covered entities. First, covered entities may share protected health information with public health authorities without contributor consent for situations such as controlling disease in a population (like the spread of coronavirus disease 2019 [COVID-19]), as legally mandated by state law enforcement (like in the case of suspected child abuse or neglect), or births or deaths.⁴¹ In addition, HIPAA allows covered entities to share identified data with business associates if they have a data use agreement in place. This “business associate agreement” exception has recently been used broadly.⁴² HIPAA permits the use of identifiable data for operations and quality improvement and allows covered entities to share and use health information for research without contributor consent if it is used in minimal-risk research (ie, not greater than that encountered in daily life or routine medicine) and granted an Institutional Review Board waiver or alteration.

The HSRR lay out the appropriate collection and sharing of individually identifiable health information collected from some research participants. Like HIPAA, health data that are not individually identifiable or are deidentified are not covered and can be shared without consent from the research participants. In addition, HSRR do not cover all identifiable health information collected for research purposes, only identifiable health information collected by researchers with federal funding or data collected or related to a US Food and Drug Administration–authorized product. Many academic medical centers also require all their researchers to follow HSRR under all circumstances to streamline compliance structures.⁴³

In 2018, regulators updated the Common Rule component of the HSRR (Subpart A) to address secondary research, among other things. Research informed consent forms must now include a disclosure, if relevant, that identified health information may be deidentified and used or shared for future studies without additional informed consent.⁴⁴ There are also disclosure requirements if a contributor’s specimens may be used for commercial profit (and whether the contributor will share in that profit) and whether the research might include whole-genome sequencing. There are, however, several major limitations to these new disclosure requirements: some are limited to biospecimens and do not cover health information⁴⁵; there are no equivalent mandated disclosures on the clinical side (above and beyond offering patients standard HIPAA disclosures)⁴⁶; and most patients neither read nor understand these disclosures.^47,48

To summarize, although both HIPAA and HSRR generally require explicit informed consent from a patient or research participant for the collection, sharing, and use of health information, they are limited to only individually identifiable information and cover only certain kinds of interactions, and there are many exceptions for minimal-risk research that may be done in many cases without the contributors’ consent or knowledge. Many contributors to secondary research are entirely unaware that their health information is being used in this manner. In addition, virtually no regulations comprehensively cover the collection, sharing, and use of health and health-proxy information by commercial companies, a lucrative industry that is expanding rapidly outside the auspices of general health privacy regulation.

Notably, although HIPAA and HSRR try to protect some identified health information from being shared in the first place, there are limited protections in place for the use of those data once they have been shared. An important example is the Genetic Information Nondiscrimination Act of 2008, which prohibits employers and some kinds of health insurance (but excludes long-term care or disability insurance) from discriminating against employees or insured individuals on the basis of genetic information.⁴⁹ In conjunction with the Office of Science Policy and Technology’s new guidance to ensure that federally funded research data equitably benefit all researchers,⁵⁰ the National Institutes of Health has put into place (effective in January 2023) stronger data privacy protections for health information generated during sponsored research.¹⁴ In addition, the Federal Trade Commission has increasingly regulated some components of data privacy as part of consumer protection. Last, several states have passed or are considering state-level data protection legislation.

As an example, California’s Consumer Privacy Act of 2020 has broader reach than HIPAA or HSRR. It creates both notice and access requirements for businesses that collect, sell, or disclose information. Consumers also can request that some kinds of information be deleted or not shared. The California Consumer Privacy Act has exceptions for research, but that research must be in the public interest. It can be challenging for entities such as commercial companies or NGOs to comply with state-level requirements that are more protective than federal law or are substantively different from each other. By default, many entities end up complying with the most restrictive state policy to ensure compliance with all state policies. For example, although the California Consumer Privacy Act technically applies only to personal information about California residents, many companies not based in California process data on California residents and may end up applying the more restrictive California standards to all data collection and use.⁵¹

In contrast to governing by the type of data being shared and used (eg, health information), the US federal approach to health data privacy protection is based on the type of entity that is controlling the data in the first place. Although this approach made sense when the regulations were conceptualized in the 1980s and 1990s, because health information was largely written or at least stored in paper copy by the entity that had originally collected it,⁴⁸ it is less comprehensive today now that health data are generated and increasingly shared electronically.

An alternative approach appears in the European Union’s General Data Protection Regulation of 2016, which governs personal data (including health information) that are processed by many kinds of both public and private entities. Processing data concerning health without consent is generally prohibited unless it falls under an exception such as for public health and scientific research. The General Data Protection Regulation includes requirements that entities must only collect and process as much data as necessary and notify individuals whose data they receive.⁵² The feasibility of an approach that attempts to identify data concerning health will face growing enforcement challenges as big data and artificial intelligence allow health-related inferences from innocuous data that seem unrelated to health.⁵³ Governance based on who originally collected the information no longer offers the American public comprehensive health data privacy protection.

AHA PRINCIPLES FOR HEALTH INFORMATION COLLECTION, SHARING, AND USE

Given the evolution in the health information landscape, the complex and limited legal protections in place for contributors, and the increasing use and value of health information to the AHA mission and priorities, we have assembled a set of key principles to help inform the AHA’s engagement in public policy and the research enterprise. The goal of these principles is to improve policy to support the use and reuse of health information in ways that are respectful toward contributors, equitable in impact in terms of both risks and potential benefits, and beneficial across broad and demographically diverse communities in the United States.

Principle 1

Funders of medical and scientific research should prioritize and support research generalizable to, or specifically designed for, historically underrepresented communities.

Given the vast disparities in access to health care and their impact on health, it is critical that health data practices are scrutinized through the lens of health equity and increasing access to scientific advances broadly generalizable across, or specifically designed for, demographically diverse patient populations. Data practices must be thoughtfully crafted and implemented with a focus on collective values such as privacy, equity, fairness, and public beneficence^54,55 that neither exacerbate existing health inequities nor create new ones.^56–58

Identifying and minimizing potential biases requires greater involvement of experts who are familiar with the nature of the biases in the data space, engagement of diverse communities of contributors, and mitigation strategies to reduce both intentional and unintentional biases in clinical implementation and deployment.^59–65 Research with health information derived from and generalizable to historically excluded communities is critical. Achieving this goal might require the further inclusion of self-identified race and ethnicity in primary research protocols. Enabling the support and hiring of trainees, employees, and leadership from communities traditionally underrepresented in technology or health sciences is also a critical step.⁶⁶ The AHA has focused several recent efforts such as investing more than $100 million in new focused research funding to help address these issues.

Principle 2

Entities that collect health information and researchers who use it should be held to the highest standards of behavior, including being respectful of the people from whom the data are derived and being responsible stewards of this valuable common resource.

Entities and researchers using health information should be held to high standards of privacy and confidentiality (also discussed in Principle 6). When applicable, health information policies should be reflective of the fact that diverse entities are increasingly collecting, processing, using, transferring, and selling data, sometimes without the awareness of the contributor. Non–HIPAA-covered third parties, including wearable device manufacturers, NGOs, social media sites, direct-to-consumer genetic testing companies, and smart devices, frequently accrue health or health-proxy information (eg, geolocation data from a reproductive health clinic). Although such use might be critical for improving support for stakeholders or important scientific or medical research, use guidance and potential restrictions should be clear, for example, not only requiring the deidentification of data but also restricting access to authenticated users and sharing with third parties only in a way that either contractually limits their abilities to misuse data (eg, a data use agreement) or technologically disallows external misuse (eg, data enclaves that provide access to restricted-use data on an external server), in addition to the enforcement of penalties associated with noncompliance.

Principle 3

Entities that collect health information and researchers who use it should be transparent about potential and actual future uses with patients and other data contributors.

Potential use (for purposes other than originally collected) of health information, whether identified or deidentified, should be disclosed at the time of collection to patients or other data contributors (eg, research participants or commercial consumers). This transparency may include disclosures about potential research or operational or commercial use of such information.

In addition to those mandated by law, disclosures may include the following: (1) that health information may be used and shared for research both within and externally (including internationally) from the entity that collected it; (2) what kinds of health information might be shared with what kinds of external entities; (3) what kinds of research the health information might support; (4) under what circumstances (if any) individualized research results will be returned to contributors; (5) whether health information may be commercialized and examples of how any proceeds might be used; (6) any protections against the reidentification of health information (eg, data use agreements); and (7) whether there is an opt-out process. Such disclosures may be included in general institutional consent forms for treatment; explanatory disclosure could also be included in office signage or informational pamphlets routinely distributed to patients. Ideally, methods sections of articles using such collected data should also disclose whether the health information used for the research was identified or deidentified and what kind of disclosure or consent the contributor received.⁶⁷ Furthermore, all privacy policies should be easily accessible and clear, available in multiple languages reflective of the population, and at an appropriate reading level for the target community. However, considering unpredictable future developments, the failure of best efforts to disclose unanticipated future research should not unreasonably prevent it. Future legislation should encourage the reasonable and consistent establishment, implementation, and maintenance of organizational policies and procedures on the collection, processing, storage, and transfer of data, as well as internal compliance and enforcement mechanisms.

Principle 4

Awareness, education, and involvement of patients in minimal-risk research are encouraged to enable important future discoveries.

Medical and scientific research that benefits diverse communities can and should be supported and encouraged. The concept of the common good calls on patients to support fellow and future patients like them by contributing to medical and scientific research when the cost to themselves is minimal but the benefits for society are high.^68,69 The goal of a learning health system is one in which “evidence is both applied and developed as a natural product of the care process”⁷⁰ and relies on the contributions of both patients and clinicians. In addition, reciprocity encourages those who have benefited from health care advances to contribute to such minimal-risk learning activities themselves. This said, notification and transparency (Principle 3) are critical components of this expectation.

Principle 5

Medical and scientific researchers, research institutions, and publishers should commit to making health information–derived research findings and innovations widely accessible, providing access to supporting data of sufficient quality to validate and replicate research findings, and data documentation that permits reuse and interoperability of the data.

When an individual contributes identified health information that is used for future secondary research purposes, they should have access to research findings and publications as broadly as possible. For example, the Office of Science and Technology Policy of the Biden White House recently directed federal agencies to ensure that federally funded peer-reviewed scholarly publications are “freely available and publicly accessible” without embargo soon.⁷¹

Broad access to funded research could also include researchers sharing final publications with their participant cohorts. In addition, recognizing that the public varies in scientific background and the ability to understand scientific literature, researchers, funders, or institutions should consider sharing annotated major research findings in the form of press releases and blog posts, with links to publicly available scientific publications once posted.⁷² Once shared, annotations should be designed to engage the public using plain language, graphics, and clear explanations.

In addition, health information is a valuable common resource. Unlike self-depleting resources, knowledge generally only increases in value the more it is shared and used.^7,9,73 As part of a commitment to acting as responsible stewards of health information (Principle 2), researchers should share the supporting data and data documentation of their research findings with other authorized researchers to the extent permissible and possible. This will likely require additional institutional and funder support because the resources and computational infrastructure necessary are likely beyond the scope of an individual investigator. These data should be of sufficient quality to validate and replicate research findings, as called for by the recent National Institute of Health Policy for Data Management and Sharing,⁷⁴ and should include necessary clinical information, data dictionaries, code, and methods. The demographics of contributors should be explained in detail, particularly if there is impact on data interpretation or analytic generalizability.

The AHA Research Division has an Open Science Policy that includes requirements for both public access to publications resulting from AHA-funded research and free and public sharing of data needed for verification of research results; the policy also provides guidance on acceptable repositories. An opt-out provision for data sharing is available for some situations.

Such data sharing enables the validation of research results, supports derivative work and discoveries, and should be strongly encouraged and supported by funders, journals, institutions, and researchers alike. Institutions receiving government research funding should commit to enabling and facilitating their researchers to meet these goals. Funding for data cleaning and sharing is also necessary, as well as, potentially, expert support for accomplishing these tasks. Although investigations of compliance rates of health information–sharing requirements by funders have found that investigator-initiated compliance is often low,^75,76 the responsibility for this scientific integrity lies with both investigators and custodians of the data.

Principle 6

Federal law should provide a consistent baseline of protection and enforcement for individuals whose health information is collected and used.

Although several states have implemented or begun to craft additional data privacy legislation for their citizens, federal privacy legislation can ensure that citizens have a robust baseline of protections across state lines. These protections could include additional standards for disclosure and transparency (including potential use, duration of use, and other types of data being combined, as well as third parties with whom data may be shared), in addition to options for limiting the amount or kind of data that are shared. A lack of a consistent federal baseline of protection can create challenges for entities, including NGOs, managing health data across their operations, companies working across state lines or globally, and patients accessing and using health services in states other than their primary residence. A federal standard would provide such entities with a consistent and clear understanding of their responsibilities and data contributors with consistent protections.

CONCLUSIONS

The AHA is the nation’s oldest and largest voluntary health care organization dedicated to reducing cardiovascular disease and supports innovative and cutting-edge research applicable across diverse communities. Given the promise of big data research and potential artificial intelligence applications, supporting the broad use of health information for research can make great strides in achieving these goals. However, there are also potential concerns for this expanding use, including for individual privacy and equity considerations across diverse communities. Data sharing and use must be done with a recognition of the obligations of contributors, journals, researchers, and funders within the context of the larger policy ecosystem. These principles will guide the AHA’s work across the changing landscape of policy and systems in terms of health information collection, sharing, and use to ensure respect for contributors, equity in impact of risk, and benefit across broad and demographically diverse communities in the United States.