We asked focus group participants their views on how the access and use of their personal data by researchers should be governed and who should have responsibility for governing that access and use. We started each focus group by asking whether participants were aware that researchers access and use their de-identified personal information. Most were not, though when told were not surprised by this. We also asked whether there was a type of personal information that they had the most concerns about being accessed and used. Participants shared that while they have concerns about who has access and uses their healthcare data, access and use of their social security number and financial data are just as important. To some it was even more of a concern than protection of their healthcare data.
Three themes emerged from these discussions: 1) concerns about whether the data would be shared and with whom; 2) participant explanations of why institutions are trustworthy.
and 3) participant views about who should make decisions about the access and use of personal data by researchers. Here we describe these in more detail.
Knowing where the data go
While participants were willing to have their data used by researchers with their academic medical institution, they were less willing for their data to be shared with other institutions. “I might have an issue with…not knowing that it’s [the data] is going somewhere else,” said one participant (Female 1, Focus Group 3). “As long as the data are not shared with anyone outside of [this academic institution],” said another (Female 1, Group 6).
For some participants, the concern about sharing data with other institutions was whether the purpose of the research might change: “’Cause you don’t know what the next institution’s gonna do or who they’re gonna give it [the data] to.” (Male 3, Focus Group 4). Several in the student focus group wanted to know not just what researchers were going to do with their data, but “how you’re going to do it, and when are you going to publicly announce what you did.” (Female 4, Group 6). At least one participant questioned whether the data could stay de-identified or whether sharing could lead to identification of subjects: “I would be worried at some point that people would be identified. If it’s going so many places, so many people are involved, so many people seeing that data, that would be a little worrisome to me.” (Female 3, Focus Group 1)
Concerns also were raised about what happens with data given how the healthcare landscape is changing with mergers and acquisitions.
What I think is curious is [this institution] starts merging with other groups, so now they’re a part of [this institution], so they can say, we are still sharing it with what you agreed to, but you don’t know in the future what [this institution] will evolve into. To some extent you’re just letting it go. (Female 6, Focus Group 2)
Few participants wanted their data shared with pharmaceutical companies or companies that stood to benefit financially from it. “If my data is [sic] being used with private companies that are all about profits, that’s when I think I would have more of an issue with it” (Male 4, Focus Group 4).
Because of these concerns, a number of participants wanted to retain some control over the use of their data. For instance, they wanted limits on how long their data could be used: “Because I certainly don’t want it [data] to be there forever because then I lose control of what you do with it, what it is for.” (Female 1, Focus Group 1) Or they felt some ‘control’ by knowing how their data were used: “…I want to know how the data was used to help other people or you know, maybe led to another study to get closer to what you’re trying to find.” (Female 6, Focus Group 2). Others wanted researchers to ask participants for permission to share their data with one student even suggesting that research participants should sign consent forms whenever their data were going to be shared. One participant stated that control isn’t possible: “Consenting, volunteering to participate in any kind of research that we’ve all done, you’re relinquishing control.” (Female 5, Focus group 2)
A few, however, were comfortable with having their data shared as long as they knew about the sharing or were notified. But even some who used the term notification still seemed to want the ability to opt-out : “…if they’re gonna turn around and give it to someone else, then maybe, could they notify us and say, listen, there’s another study out there. Do you agree to give your—” (Female 4, Focus Group 5) They also were comfortable with sharing of data if the other institutions had protocols in place governing data access and use that were similar to what the donating institution had. Those participants wanted institutions who were receiving data to be held “to the same standards and responsibilities and ethical considerations….” (Female 6, Focus Group 2).
While generally participants had reservations about having their data shared with other institutions, at least one participant expressed value in having the data shared among institutions.
They may be one group doing, looking at point A. But now another group is going to get involved, and they are looking at it from a different perspective and they may be able to offer to kind of link things together. So their end goal’s probably about the same as what the original is. So in that case, I wouldn’t have any problem with it being shared. (Female 2, Focus Group 1)
Explaining institutional trust
For a number of participants across focus groups, trust in their healthcare organization was a given as they described themselves as being inherently trusting: “I try to trust everyone until you give me a reason not to trust you” (Female 2, Focus Group 4). Noted another, “I will distrust you if you give me a reason to distrust you” (Male 1, Focus Group 3). Participants extended this trust to their healthcare organization: “I trust [the academic medical center where this study occurred] because I haven’t been burned by it” (Male 2, Focus Group 4).
Others based their trust in their local healthcare organization simply because of its location. That meant they and their family members have received treatment or known people employed by it. “I guess because it’s local, it’s here, my doctor’s here,” said one focus group participant (Female 3, Focus Group 1) of why she trusts the institution. Another cited her positive experience with her doctor as her reason for her trust in the organization while a third participant said she trusted the hospital because “it’s been around for a long time.” (Female 3, Focus Group 1) That familiarity also bred respect:
I grew up in this area my whole life, and I’m kind of proud of the hospital here. I’ve used its services…There was this medical student I was talking with, and he was like, ‘yeah, I’m from California.’ And I’m like, ‘you came from California all the way here? Why’d you come here?’ And he’s like, ‘This is a nationally ranked teaching hospital.’ He’s like, ‘This is amazing.’ It kind of blew my mind…. (Male 4, Focus Group 4)
While participants noted the organization’s positive reputation, they also acknowledged they had had some negative experiences. Reflecting on those, one participant recognized she had not only learned more about the institution from those experiences but they had also solidified rather than weakened her trust in the institution: “I know them well enough to trust them” (Female 2, Focus Group 1).
Participants’ trust in the institution included trust in researchers and in the research being conducted at the institution. “I think that’s why a lot people kind of trust the researchers here…because you’re doing no harm, you’re doing good,. That benefits you to be doing research in this setting,” said a participant (Female 6, Focus Group 2).
Asked if they would trust other academic medical centers, a number of participants hedged – even when specific institutions were named. “I’d want to know more. You can’t just say, oh, it’s Princeton. Who at Princeton, you know?” (Female 6, Focus Group 2) Said another, “Cleveland Institution or whatever you mentioned, I would probably not do anything with them at this point because I know nothing about them” (Female 2, Focus Group 1). One of the student participants also opposed sharing of personal data with other institutions. (Female 2, Focus Group 6)
Participants had even less trust in institutions such as pharmaceutical companies and biotechnology corporations. Big Pharma, said one participant, “isn’t really interested in a healthy population. They’re interested in selling as many of their drugs as they can produce” (Male 1, Focus Group 5) Another participant cited pricing issues as a source of his distrust: “I read that some pharmaceutical companies when they find a particular medication that’s most popular, they tend to increase the prices on them…I don’t like that” (Female 4, Focus Group 1) Student participants also expressed distrust of the pharmaceutical industry. Said one student, “The pharma industry should have the primary goal of improving people’s lives, but their primary goal is improving profits at the expense of people’s well-being” (Female 7, Focus Group 6)
Participants also were distrustful of biotechnology companies, especially those entities analyzing genetic samples. One participant stated, “I just don’t trust them” (Female 2, Focus Group 1) even as she admitted that she didn’t know anything about them. Another thought the sharing of genetic data should not occur: “You know that’s like giving out my name and address and everything. Who are you to give out my name and address?” (Male 5, Focus Group 5) Government agencies’ use of genetic databases produced by biotech companies also was cited as a reason for not trusting those companies (Female 7, Focus Group 6). Most participants hesitated about the possibility of providing genetic samples to the National Institutes of Health with one participant noting that the possibility “freaks me out. You know, it’s gonna come back, and it’s gonna bite you in the butt” (Female 1, Focus Group 2). Said another, “I do question the government thing [and am] wary of what they’re (sic) gonna do with it….Things like government, I feel they’re always out to get you” (Female 5, Focus Group 2).
Sitting at the table
Participants supported establishment of an advisory council or group to make decisions about what data were used, who was accessing those data, and whether data could be shared. This group would function as a “gatekeeper between the data and the use, so that a researcher who wants the data needs to make a very formal proposal to this council before you open up the doors to all the data” (Female 7, Focus Group 2). This group should be formalized through policy so that “you don’t just have a group of people who get together Monday morning with a cup of coffee and say, ok, we’re gonna let him have the data” (Male 1, Focus Group 3).
No consensus was reached about the size of this group although participants across focus groups advocated for a team of individuals rather than a sole individual. Their argument was that a team would keep the decisions from being hijacked by a single decision-maker with an agenda: “There needs to be a group table because everybody’s looking out for their own agenda” (Female 2, Focus Group 5); “That’s why I want 5 [at the table]. They’re gonna have 5 different agenda, but they have to agree on how it’s [the data] is used, so one agenda can’t take priority over the others” (Female 2, Focus Group 1).
While no consensus was reached about the number of seats at the table, there was consensus that members of this advisory group were not just “Joe Blow from down the road” (Female 5, Focus Group 1) and didn’t “have to be all doctors” (Female 2, Focus Group 1). More specifically, participants argued for a number of stakeholders including lawyers, a cybersecurity expert or computer scientist, medical professionals, and researchers, the last of which included both those involved in the study and those with expertise about the specific area of research such as department heads. “A team of folks that understands what the whole mission of the research is, whatever the research is,” noted one participant (Female 2, Focus Group 3). Said another, “someone who can determine the need to know, who knows who needs to know” (Female 4, Focus Group 1). Inclusion of hospital administrators, members of hospital ethics committees, and privacy advocates also was mentioned.
Opinions differed about whether patients and volunteers should also be represented with one participant asking, “who would choose that person from the public and what makes that person from the public qualified?” (Female 2, Focus Group 1). That sentiment was echoed when students were asked if a student should have a seat at the table: “I don’t know that a student would be in the best position to understand the ramifications of things, but maybe someone who speaks on behalf of the students” (Female 3, Focus Group 6).
Other participants endorsed having volunteers whose data are being accessed and used on the advisory group, noting the need for “representatives that are like us, that are participants who can get their voice heard. That would at least give people the sense that it’s not just researchers that are making the decisions” (Female 6, Focus Group 2). Another potential member of this advisory group was a communicator—“a secretary or information person that would make the decisions public…” (Male 1, Focus Group 5).
Transparency about who serves on the advisory council and what decisions are made was seen by participants as critical. Participants across focus groups also wanted to know how their data were to be used, how long their data could be accessed, whether their data benefitted others or led to new studies.
Participants also argued for an advisory group with membership that fluctuated depending upon the purpose of the study or the population to be studied: “Maybe the group is multiple. It’s not one set group because of the different types of research that you’re dealing with” (Female 4, Focus Group 3).