The privacy paradox: laying Orwell's ghost to rest

The creation of health information systems poses ethical and legal questions regarding the collection, analysis and ownership of data. Recent media stories indicate a public unease with the extent of the sensitive individual data available in computer databases¹ and conjure up images of an Orwellian world void of privacy, with remote and faceless overseers tracking one's every move.

Surveys indicate that Canadians are concerned about the security of their health information and would resist the use of their data without their consent.² Although they wish to be informed and to give consent, they do not agree about how this should be done. In a survey in Saskatchewan, 62.9% of respondents agreed that “to receive informed consent, health professionals would need to provide details of every anticipated use of health information.”³ However, 71.4% of respondents also agreed that “to receive informed consent, health professionals should not have to provide details of every anticipated use of personal health information on every occasion, but should be expected to make this information available on request and through pamphlets, brochures and other convenient means.” This ambivalent attitude poses difficulties for setting policies for the use of health information.

For a complex health care system to operate effectively, a balance must be struck between protecting privacy and the need to use individuals' information. A paradox looms: Canadians demand high-quality, accessible and efficient health care and privacy for their personal health information. Both aims are laudable and serve each other, but only if properly understood.

Recent legislative initiatives in Canada such as the Personal Information Protection and Electronic Documents Act, enacted in April 2000, will set the framework for the manner in which consent is required for the use of health information and will establish the context for exemptions from consent. The status of health information within this legislative framework is currently undecided. Legislation passed in the United States and Europe has strengthened the need for explicit consent for the use of health records in research and audit. Such initiatives are commendable in that the privacy of individual information is of paramount importance, but they may have adverse consequences. Depending on the stringency of such initiatives, many research and audit functions such as health services research and cancer registries may be at risk, as was demonstrated recently in the United Kingdom.⁴ Strict consent laws can introduce an important authorization bias^5,6,7,8 when patients who release personal health information for health research differ significantly from those who do not. Such a bias may result in an inaccurate estimate of the health status of the population.

The benefits of using health records for both research and program evaluation are well known. These include monitoring the health of the population, identifying populations at risk, determining the effectiveness of treatment, assessing prognosis and the usefulness of diagnostic and screening tests, administrative support, cost-effectiveness analysis, and assessing the appropriateness and adequacy of care.⁹ Gordis and Gold¹⁰ emphasized the medical discoveries derived from medical records research, particularly in the fields of cancer, cardiovascular disease, communicable disease and children's health. In Canada, cancer registries and health services research institutes have provided essential information about the health status of Canadians. Studies demonstrating variations in health care use,¹¹ socioeconomic gradients in health status after myocardial infarction,¹² the impact of influenza vaccination on admissions to hospital of elderly people,¹³ and trends in cancer morbidity and mortality,¹⁴ to name but a few, are possible only through the maintenance of population-based databases.

On the other hand, there are few Canadian examples of harms associated with the use of personal health data for administrative and research purposes by publicly funded institutions. In general, health data are well protected by the health care system and provide an admirable example of public trust. Garfinkle,¹⁵ in an American context, documented examples of abuse of personal health information. It must be stated in categorical terms that unwarranted disclosure of health information, regardless of its format, is to be condemned. Health systems managers, researchers and publicly funded institutions must assure individuals that their health information is not only secure but also indispensable to the operation of the health care system and the provision of high-quality care.

The call for explicit consent for the use of health information is intended to respect the autonomy of individuals and recognize their right to self-determination. However, it is unclear whether explicit consent would achieve that intended goal, given that the number of uses of individual data are currently unknown and future uses are unknowable. It is debatable whether individuals wish to give explicit consent every time their health information is accessed or processed. In honouring autonomy, one could unintentionally overburden individuals.

What form should consent take in these circumstances? Models range from full explicit consent for each use of health information to models in which no patient consent is required (Table 1). The issue of the appropriate model of patient consent for the use of electronic information should be regarded as a research priority.

Table 1

Looking for solutions: the concept of social trust

The privacy paradox poses a potential threat to the realization of a health care system that meets the highest standards of care and accountability. How then can we overcome the privacy paradox? In general, we see 4 particular avenues of approach, involving transparency and regulation of access and use of information. Together, they may answer public concerns.

Technical considerations

There is reasonable, but not perfect, assurance that security from inappropriate disclosure can be maintained. This derives from both technical and procedural safeguards, as classified by Stallings.¹⁶ In addition to technical safeguards, the codes of ethics for health care professionals recognize the importance of protecting confidentiality. Violations of this code can result in consequences that range from professional reprimand to suspension and revocation of licence. Legislation should provide sanctions against unwarranted disclosure of confidential health information.

Process and safeguards

There are sets of procedural changes that organizations entrusted with health care information can explicitly endorse. These include, but are not limited to, the following:

· The adherence to agreed standards of fair information practices.

· The appointment by organizations of a “data guardian” who would be responsible for the security of data and approval of its uses. The office of the data guardian would also consult with the ethics review board and the office of the privacy commissioner when necessary.

· The assurance that personal health information will not be used for profit or marketing purposes without explicit consent.

· The mapping of the flow of personal information within the health care system. A process similar to the Caldicott Committee's identification of data flows¹⁷ should be undertaken.

Information directives

There is also a need to enhance the understanding of privacy rights, that is, autonomous individual control over personal information, and to educate health care consumers and providers about the range of uses of health information. The idea of advanced directives has gained currency for facilitating end-of-life care and articulating patient preferences. Two of us have developed an analogous health information directive that describes the range of health care information uses and permits the patient to authorize the use of various elements of health care information.¹⁸ Schoenberg and Safran¹⁹ recently described a patient-controlled medical record accessible on the World Wide Web that permits the patient, in consultation with the health care provider, to agree about which elements of clinical content should be included in an accessible patient record and what level of security is required.

Social trust

The argument for the social utility of health records usage is stated clearly by Gostin and Hadley.²⁰

Despite the importance of explicit informed consent in protecting patient autonomy, requiring such consent before allowing any personal health data to be obtained would discourage and even halt much socially valuable research. The cost and effort of obtaining previous approval for large scale statistical analyses that use data from tens of thousands of patients would be burdensome.

We all derive benefit from a health information system that has extensive coverage and linkages. Our privacy rights are, however, maximized by restricting access to health information. The more access is restricted, the more privacy is protected. However, if everyone followed this course, the system would fail and no one would derive benefit from a health information system. Hence, we may be worse off if everyone exercises the right to privacy to its fullest extent. Trust, cooperation and recognition of the common good are required.

Health care is a publicly funded enterprise. As such, we are all responsible for its governance. The potential risk of invasion of privacy or unwarranted disclosure of confidential health information can be kept low. Because confidentiality concerns can be addressed by both technical and procedural methods, they should not serve as a card to trump social needs. We would argue that social utility supersedes these concerns.

Conclusion

The security of health information and personal privacy is a priority for all Canadians. Thus far, researchers, administrators and health care providers in Canada have an excellent record of protecting the confidentiality of health data. Health care consumers can reciprocate by allowing the collection and use of health information for program administration, quality control and research. When viewed as a joint trust and common good, the promises of the information age can be achieved.