Project description:BackgroundAlong with the proliferation of health information technologies (HITs), there is a growing need to understand the potential privacy risks associated with using such tools. Although privacy policies are designed to inform consumers, such policies have consistently been found to be confusing and lack transparency.ObjectiveThis study aims to present consumer preferences for accessing privacy information; develop and apply a privacy policy risk assessment tool to assess whether existing HITs meet the recommended privacy policy standards; and propose guidelines to assist health professionals and service providers with understanding the privacy risks associated with HITs, so that they can confidently promote their safe use as a part of care.MethodsIn phase 1, participatory design workshops were conducted with young people who were attending a participating headspace center, their supportive others, and health professionals and service providers from the centers. The findings were knowledge translated to determine participant preferences for the presentation and availability of privacy information and the functionality required to support its delivery. Phase 2 included the development of the 23-item privacy policy risk assessment tool, which incorporated material from international privacy literature and standards. This tool was then used to assess the privacy policies of 34 apps and e-tools. In phase 3, privacy guidelines, which were derived from learnings from a collaborative consultation process with key stakeholders, were developed to assist health professionals and service providers with understanding the privacy risks associated with incorporating HITs as a part of clinical care.ResultsWhen considering the use of HITs, the participatory design workshop participants indicated that they wanted privacy information to be easily accessible, transparent, and user-friendly to enable them to clearly understand what personal and health information will be collected and how these data will be shared and stored. The privacy policy review revealed consistently poor readability and transparency, which limited the utility of these documents as a source of information. Therefore, to enable informed consent, the privacy guidelines provided ensure that health professionals and consumers are fully aware of the potential for privacy risks in using HITs to support health and well-being.ConclusionsA lack of transparency in privacy policies has the potential to undermine consumers' ability to trust that the necessary measures are in place to secure and protect the privacy of their personal and health information, thus precluding their willingness to engage with HITs. The application of the privacy guidelines will improve the confidence of health professionals and service providers in the privacy of consumer data, thus enabling them to recommend HITs to provide or support care.

Project description:BackgroundCOVID-19 digital contact-tracing apps were created to assist public health authorities in curbing the pandemic. These apps require users' permission to access specific functions on their mobile phones, such as geolocation, Bluetooth or Wi-Fi connections, or personal data, to work correctly. As these functions have privacy repercussions, it is essential to establish how contact-tracing apps respect users' privacy.ObjectiveThis study aimed to systematically map existing contact-tracing apps and evaluate the permissions required and their privacy policies. Specifically, we evaluated the type of permissions, the privacy policies' readability, and the information included in them.MethodsWe used custom Google searches and existing lists of contact-tracing apps to identify potentially eligible apps between May 2020 and November 2021. We included contact-tracing or exposure notification apps with a Google Play webpage from which we extracted app characteristics (eg, sponsor, number of installs, and ratings). We used Exodus Privacy to systematically extract the number of permissions and classify them as dangerous or normal. We computed a Permission Accumulated Risk Score representing the threat level to the user's privacy. We assessed the privacy policies' readability and evaluated their content using a 13-item checklist, which generated a Privacy Transparency Index. We explored the relationships between app characteristics, Permission Accumulated Risk Score, and Privacy Transparency Index using correlations, chi-square tests, or ANOVAs.ResultsWe identified 180 contact-tracing apps across 152 countries, states, or territories. We included 85.6% (154/180) of apps with a working Google Play page, most of which (132/154, 85.7%) had a privacy policy document. Most apps were developed by governments (116/154, 75.3%) and totaled 264.5 million installs. The average rating on Google Play was 3.5 (SD 0.7). Across the 154 apps, we identified 94 unique permissions, 18% (17/94) of which were dangerous, and 30 trackers. The average Permission Accumulated Risk Score was 22.7 (SD 17.7; range 4-74, median 16) and the average Privacy Transparency Index was 55.8 (SD 21.7; range 5-95, median 55). Overall, the privacy documents were difficult to read (median grade level 12, range 7-23); 67% (88/132) of these mentioned that the apps collected personal identifiers. The Permission Accumulated Risk Score was negatively associated with the average App Store ratings (r=-0.20; P=.03; 120/154, 77.9%) and Privacy Transparency Index (r=-0.25; P<.001; 132/154, 85.7%), suggesting that the higher the risk to one's data, the lower the apps' ratings and transparency index.ConclusionsMany contact-tracing apps were developed covering most of the planet but with a relatively low number of installs. Privacy-preserving apps scored high in transparency and App Store ratings, suggesting that some users appreciate these apps. Nevertheless, privacy policy documents were difficult to read for an average audience. Therefore, we recommend following privacy-preserving and transparency principles to improve contact-tracing uptake while making privacy documents more readable for a wider public.

Project description:BackgroundAs routinely collected patient data have become increasingly accessible over the years, more attention has been directed at the ethics of using such data for research. Patient data is often available to researchers through patient registries that typically collect data of patients with a specific condition. While ethical guidelines for using patient data are presented frequently in the literature, it is currently unknown how patient registries implement the recommendations from these guidelines in practice and how they communicate their practices. In this project, we assessed to what extent a sample of 51 patient registries provides information about a range of ethics practices.MethodsWe searched for patient registries in the resource database of the European Network of Centres for Pharmacoepidemiology and Pharmacovigilance (ENCePP). Our ethics reporting checklist was based on three sources: the Registry Evaluation and Quality Standards Tool (REQueST), the Agency for Healthcare Research and Quality (AHRQ) guide for good registry practices, and a systematic review of the principles and norms related to health data sharing by Kalkman and colleagues. The checklist includes 26 questions about five ethics components: governance, conflicts of interest, informed consent, privacy and data protection, and use-and-access.ResultsWe found substantial heterogeneity in the way patient registries provide information about ethics practices. Patient registries often mentioned their governance structure and any potential conflicts of interests but typically did not describe the responsibilities and rights allocated to their funders. Information about informed consent was often provided to patients, but the available documents often lacked relevant information like the benefits and risks of participation. Privacy and data protection and use-and-access policies were typically discussed but not very concretely.ConclusionsWe conclude that registries typically provide information about key ethics practices such as governance, conflicts of interest, informed consent, privacy and data protection, and use-and-access procedures, but this information is often not as detailed as recommended in existing guidelines. The ethics reporting checklist we designed could be helpful for the ethical assessments of patient registries and other types of registries in the future as well as for self-assessment of registries aiming to improve their ethics practices.

Project description:ImportanceDigital technology is part of everyday life. Digital interactions generate large amounts of data that can reveal information about the health of individual consumers (the digital health footprint).ObjectiveΤo describe health privacy challenges associated with digital technology.Design, setting, and participantsFor this qualitative study, In-depth, semistructured, qualitative interviews were conducted with 26 key experts from diverse fields in the US between January 1 and July 31, 2018. Open-ended questions and hypothetical scenarios were used to identify sources of digital information that contribute to consumers' health-relevant digital footprints and challenges for health privacy. Participants also completed a survey instrument on which they rated the health relatedness of digital data sources.Main outcomes and measuresHealth policy challenges associated with digital technology based on qualitative responses to expert interviews.ResultsAlthough experts' ratings of digital data sources suggested a possible distinction between health and nonhealth data, qualitative interviews uniformly indicated that all data can be health data, particularly when aggregated across sources and time. Five key characteristics of the digital health footprint were associated with health privacy policy challenges: invisibility (people are unaware of how their data are tracked), inaccuracy (data in the digital health footprint can be inaccurate), immortality (data have no expiration date and are aggregated over time), marketability (data have immense commercial value and are frequently bought and sold), and identifiability (individuals can be readily reidentified and anonymity is nearly impossible to achieve). There are virtually no regulatory structures in the US to protect health privacy in the context of the digital health footprint.Conclusions and relevanceThe findings suggest that a sector-specific approach to digital technology privacy in the US may be associated with inadequate health privacy protections.

Dataset Information

The commercialization of patient data in Canada: ethics, privacy and policy.

Publications

The commercialization of patient data in Canada: ethics, privacy and policy.

Similar Datasets

OmicsDI is part of the ELIXIR infrastructure

Tweets