Conditional Support: Focus Group Participants’ Views on Researchers’ Access and Use of Personal Health Information

Background: Researchers are increasingly collecting large amounts of de-identied data about individuals to address important health-related challenges and answer fundamental questions. Current US federal regulations permit researchers to use already collected and stored de-identied health-related data from a variety of sources without seeking consent from patients. While multiple studies have explored patients’ views on the sharing of their health-related data, few have investigated their views on the policies and processes institutions have in place or should have in place for accessing, using, and sharing of data. Methods: We conducted 5 with individuals who live within a 20-mile radius of the local academic medical center. In addition, in order to increase the number of participants younger than 45 years of age, we held a focus group with undergraduates at a local university. Transcripts were analyzed using content analysis. The codebook was revised and rened, codes claried, and disagreements resolved through discussion. Results: A total of 37 individuals participated, ages 18-76. Most participants were not surprised that researchers accessed and used de-identied personal information for research. For participants, transparency was key. They wanted to know when their data were accessed, for what purpose, and by whom. However, for some participants, just knowing their data had been accessed and used was not enough. Rather they wanted to have some control over the use of their data valuing the chance to opt-out. That said, wanting some control didn’t conict with participants’ support of the use of their data for research. Most participants trusted their local academic medical institution, but were less trusting of other academic medical institutions and commercial entities. Finally, participants supported establishment of an advisory council or group with responsibility for deciding what data were used, who was accessing those data, and whether data could be shared. Conclusions: The trust people have in their local institutions should be considered fragile, and institutions should not take that trust for granted. How institutions choose to govern patients’ data and what voices they include in decisions about use and access are critical to maintaining the trust of the public.

example, between healthy populations and populations with a speci c disease phenotype. Because they can access sample sizes larger than what they could collect on their own, researchers also can investigate variations among populations of different ethnicities, socioeconomic backgrounds, and geocodes. This volume of data also can enable deeper understanding of how different molecules within a biological system interact and in uence healthy and diseased states. [2] In fact, the National Institutes of Health All of Us program is based on the value that large volumes of data can provide. [3] Current US federal regulations permit researchers to use these collected and combined de-identi ed health-related data without seeking explicit consent from patients. [4][5][6] Investigations aimed at understanding patients' attitudes toward use of their data have often revealed a lack of awareness that their health information, which was collected for clinical use, might be repurposed for research. [7,8] Even so, studies have found that participants broadly support the use of their data in research. Indeed, a systematic review of 25 qualitative studies cited that support as one of seven themes. [9] Some study participants indicate that contributing to advancements in healthcare-the 'greater good'-is their reason for supporting data sharing. [10,11] Others see the potential to learn health information about themselves or to help others with the same health condition or disease. [10][11][12][13] Research has shown that in many cases, participants' support is conditional. Researchers have found, for instance, that participants want 'granular control'-that is, they are willing to share some of their health information but not necessarily information they consider 'sensitive.' [14] Furthermore, they express wanting to choose or control with whom information is shared. [14,15] Other studies have found that participants' willingness for their data to be shared is linked to being consulted or consented. [16,17] Across studies, participants have shown they are generally willing to share their health data with researchers in the healthcare systems in which they are patients and with nonpro ts. [12,[17][18][19] However, participants are less inclined to want their health data shared if the entities involved are private companies such as insurers or government agencies. [11,15,[17][18][19][20] Perhaps not surprisingly, study participants have fewer reservations when their data are anonymized although some people hesitate even then. [17,21,22] It should be noted that many of these studies speci cally ask participants about biobank samples and data in the electronic medical record.
A frequent concern cited by study participants involves the security of their health-related data shared. [23,24] That concern is heightened when the sharing of data is across healthcare organizations or with entities not directly delivering patient care. [16,17] Patients particularly fear security breaches that would allow for inadvertent sharing of their data. [7,15]and want to know more about the kinds of protections in place to protect their information. [16] Researchers also report that some patients are more concerned about security of nancial information or personal identity than they are about their health data. [12] In some studies, participants raise concerns that broad data sharing could lead to stigmatization of communities or negative treatment and discrimination of certain ethnicities. [7,11,20] Still for many participants, the bene ts of providing data that could help researchers advance understanding and treatment of disease outweighs the risks of sharing their health-related data.
While multiple studies have explored patients' views on the sharing of their health-related data, few have investigated their views on the policies institutions have in place or should have in place for sharing of data-that is, policies that consider who has oversight responsibility for the sharing of patient data; who is deciding about what entities can access data; and what mechanisms are in place to ensure that shared data are used appropriately. These are questions about data governance. A European study involving patients in 10 countries is one of the few to speci cally ask participants for their views on governance structures for managing the large amount of health and genetic data being collected. [25] Those researchers found that participants wanted experts within the organization that was home to the data to review requests for data access. Those same experts should monitor how those data were used. Participants de ne those experts as healthcare professionals, researchers, patient representatives, and lay persons among others. [25] Given the few studies that have explored who is making decisions about data access and use, we conducted an exploratory study using focus groups to investigate people's views how the access and use of their de-identi ed should be managed. Here we discuss our ndings: 1) concerns about whether the data would be shared and with whom; 2) participant explanations of why institutions are trustworthy; and 3) participant views about who should make decisions about the access and use of personal data by researchers.

Methods
This study was approved by the Institutional Review Board of Penn State Health which determined that it was exempt research. Informed consent of all participants was obtained by the research team.
We held ve focus groups with participants who live within a 20-mile radius of Hershey, Pa. Participants were recruited through a combination of yers, short news articles in local newspapers, StudyFinder, and referrals by participants. Inclusion criteria were English speaking, willingness to speak in a group setting, and 18 year of age and older.
Given the average age of participants from the ve focus groups was 58 years, we also recruited students (n = 10) at a nearby institution of higher education. The students were undergraduates in information technology majors and members of a campus club focused on IT.
Prior to the focus group, participants completed a demographic questionnaire that included questions on gender, marital status, occupation, and ethnicity. Since the study was focused on individuals' understanding and perspectives on the use of personal data in research, participants were asked if they and members of their families had previously taken part in a research study.
A qualitative approach was chosen to explore people's understanding of and perspectives on the use of personal data -health and non-health -in research. A discussion guide was developed to explore participants' understanding of what personal data are being accessed and used by researchers. More speci cally, questions focused on participants' perspectives on who should be involved in allowing access and use of personal data in research; whether personal data for research should be shared across academic institutions and with other entities including pharmaceutical companies; and whether and when participants want to be informed about research studies that access and use their personal data.
The guide included open-ended questions and follow-up probes and was reviewed and revised after each session.
The initial ve focus groups were held in Fall 2018 with the student focus group in Spring 2019.
Participants were consented and asked to complete the questionnaire. One research team member (JBM) facilitated each group. Each focus group lasted between 60-75 minutes with the exception of the student focus group as noted above which was 45 minutes in length. Discussions were audio recorded and transcribed by a member of the research team (MH). Data saturation was reached after the sixth focus group.
We used an iterative process to code and analyze the transcribed audio recordings. Two members of the research team (JBM, MH) together developed a preliminary thematic codebook for NVivo 12 (QSR International) using content analysis and identifying key concepts. The codebook was revised and re ned as transcripts were reviewed and codes clari ed. Disagreements about codes were resolved through discussion. [26]

Participant characteristics
The initial ve focus groups included 27 participants (20 women and 7 men; average age was 58 years with the youngest 23 years and the oldest 76 years). Twenty-ve participants self-identi ed as white while one self-identi ed as American Indian and the other as multiracial. Educational levels ranged from completion of a GED (n = 1), graduation from high school and junior college (n = 9), completion of a fouryear degree (n = 10) to completion of graduate and professional degrees (n = 7). One participant worked in health care as a registered nurse while 13 self-identi ed as retired. Because the study was focused on individuals' understanding and perspectives on the use of personal data in research, participants were asked if they and members of their families had previously taken part in a research study. Most had (n = 20). Fewer participants (n = 10) had family members who had participated in research studies.
Participants also were asked if they had concerns about who has access to their personal information. While most didn't (n = 17), a signi cant number did (n = 10).
Because our sample was weighted to individuals 45 and older, the research team held a sixth focus group with 10 undergraduate students at a nearby institution of higher education to obtain additional data from younger individuals. These participants were between 18 years and 22 years old with 1 returning adult who was 34 years. Only 9 students of the 10 completed the demographics questionnaire.

Themes
We asked focus group participants their views on how the access and use of their personal data by researchers should be governed and who should have responsibility for governing that access and use.
We started each focus group by asking whether participants were aware that researchers access and use their de-identi ed personal information. Most were not, though when told were not surprised by this. We also asked whether there was a type of personal information that they had the most concerns about being accessed and used. Participants shared that while they have concerns about who has access and uses their healthcare data, access and use of their social security number and nancial data are just as important. To some it was even more of a concern than protection of their healthcare data.
Three themes emerged from these discussions: 1) concerns about whether the data would be shared and with whom; 2) participant explanations of why institutions are trustworthy. and 3) participant views about who should make decisions about the access and use of personal data by researchers. Here we describe these in more detail.
Knowing where the data go While participants were willing to have their data used by researchers with their academic medical institution, they were less willing for their data to be shared with other institutions. "I might have an issue with…not knowing that it's [the data] is going somewhere else," said one participant (Female 1, Focus Group 3). "As long as the data are not shared with anyone outside of [this academic institution]," said another (Female 1, Group 6).
For some participants, the concern about sharing data with other institutions was whether the purpose of the research might change: "'Cause you don't know what the next institution's gonna do or who they're gonna give it [the data] to." (Male 3, Focus Group 4). Several in the student focus group wanted to know not just what researchers were going to do with their data, but "how you're going to do it, and when are you going to publicly announce what you did." (Female 4, Group 6). At least one participant questioned whether the data could stay de-identi ed or whether sharing could lead to identi cation of subjects: "I would be worried at some point that people would be identi ed. If it's going so many places, so many people are involved, so many people seeing that data, that would be a little worrisome to me." (Female 3, Focus Group 1) Concerns also were raised about what happens with data given how the healthcare landscape is changing with mergers and acquisitions.
What I think is curious is [this institution] starts merging with other groups, so now they're a part of [this institution], so they can say, we are still sharing it with what you agreed to, but you don't know in the future what [this institution] will evolve into. To some extent you're just letting it go. (Female 6, Focus Group 2) Few participants wanted their data shared with pharmaceutical companies or companies that stood to bene t nancially from it. "If my data is [sic] being used with private companies that are all about pro ts, that's when I think I would have more of an issue with it" (Male 4, Focus Group 4).
Because of these concerns, a number of participants wanted to retain some control over the use of their data. For instance, they wanted limits on how long their data could be used: "Because I certainly don't want it [data] to be there forever because then I lose control of what you do with it, what it is for." (Female 1, Focus Group 1) Or they felt some 'control' by knowing how their data were used: "…I want to know how the data was used to help other people or you know, maybe led to another study to get closer to what you're trying to nd." (Female 6, Focus Group 2). Others wanted researchers to ask participants for permission to share their data with one student even suggesting that research participants should sign consent forms whenever their data were going to be shared. One participant stated that control isn't possible: "Consenting, volunteering to participate in any kind of research that we've all done, you're relinquishing control." (Female 5, Focus group 2) A few, however, were comfortable with having their data shared as long as they knew about the sharing or were noti ed. But even some who used the term noti cation still seemed to want the ability to opt-out : "… if they're gonna turn around and give it to someone else, then maybe, could they notify us and say, listen, there's another study out there. Do you agree to give your-" (Female 4, Focus Group 5) They also were comfortable with sharing of data if the other institutions had protocols in place governing data access and use that were similar to what the donating institution had. Those participants wanted institutions who were receiving data to be held "to the same standards and responsibilities and ethical considerations…." (Female 6, Focus Group 2).
While generally participants had reservations about having their data shared with other institutions, at least one participant expressed value in having the data shared among institutions.
They may be one group doing, looking at point A. But now another group is going to get involved, and they are looking at it from a different perspective and they may be able to offer to kind of link things together. So their end goal's probably about the same as what the original is. So in that case, I wouldn't have any problem with it being shared. (Female 2, Focus Group 1)

Explaining institutional trust
For a number of participants across focus groups, trust in their healthcare organization was a given as they described themselves as being inherently trusting: "I try to trust everyone until you give me a reason not to trust you" (Female 2, Focus Group 4). Noted another, "I will distrust you if you give me a reason to distrust you" (Male 1, Focus Group 3). Participants extended this trust to their healthcare organization: "I trust [the academic medical center where this study occurred] because I haven't been burned by it" (Male 2, Focus Group 4).
Others based their trust in their local healthcare organization simply because of its location. That meant they and their family members have received treatment or known people employed by it. "I guess because it's local, it's here, my doctor's here," said one focus group participant (Female 3, Focus Group 1) of why she trusts the institution. Another cited her positive experience with her doctor as her reason for her trust in the organization while a third participant said she trusted the hospital because "it's been around for a long time." (Female 3, Focus Group 1) That familiarity also bred respect: I grew up in this area my whole life, and I'm kind of proud of the hospital here. I've used its services… There was this medical student I was talking with, and he was like, 'yeah, I'm from California.' And I'm like, 'you came from California all the way here? Why'd you come here?' And he's like, 'This is a nationally ranked teaching hospital.' He's like, 'This is amazing.' It kind of blew my mind…. (Male 4, Focus Group 4) While participants noted the organization's positive reputation, they also acknowledged they had had some negative experiences. Re ecting on those, one participant recognized she had not only learned more about the institution from those experiences but they had also solidi ed rather than weakened her trust in the institution: "I know them well enough to trust them" (Female 2, Focus Group 1).
Participants' trust in the institution included trust in researchers and in the research being conducted at the institution. "I think that's why a lot people kind of trust the researchers here…because you're doing no harm, you're doing good,. That bene ts you to be doing research in this setting," said a participant (Female 6, Focus Group 2).
Asked if they would trust other academic medical centers, a number of participants hedged -even when speci c institutions were named. "I'd want to know more. You can't just say, oh, it's Princeton. Who at Princeton, you know?" (Female 6, Focus Group 2) Said another, "Cleveland Institution or whatever you mentioned, I would probably not do anything with them at this point because I know nothing about them" (Female 2, Focus Group 1). One of the student participants also opposed sharing of personal data with other institutions. (Female 2, Focus Group 6) Participants had even less trust in institutions such as pharmaceutical companies and biotechnology corporations. Big Pharma, said one participant, "isn't really interested in a healthy population. They're interested in selling as many of their drugs as they can produce" (Male 1, Focus Group 5) Another participant cited pricing issues as a source of his distrust: "I read that some pharmaceutical companies when they nd a particular medication that's most popular, they tend to increase the prices on them…I don't like that" (Female 4, Focus Group 1) Student participants also expressed distrust of the pharmaceutical industry. Said one student, "The pharma industry should have the primary goal of improving people's lives, but their primary goal is improving pro ts at the expense of people's well-being" (Female 7, Focus Group 6) Participants also were distrustful of biotechnology companies, especially those entities analyzing genetic samples. One participant stated, "I just don't trust them" (Female 2, Focus Group 1) even as she admitted that she didn't know anything about them. Another thought the sharing of genetic data should not occur: "You know that's like giving out my name and address and everything. Who are you to give out my name and address?" (Male 5, Focus Group 5) Government agencies' use of genetic databases produced by biotech companies also was cited as a reason for not trusting those companies (Female 7, Focus Group 6). Most participants hesitated about the possibility of providing genetic samples to the National Institutes of Health with one participant noting that the possibility "freaks me out. You know, it's gonna come back, and it's gonna bite you in the butt" (Female 1, Focus Group 2). Said another, "I do question the government thing [and am] wary of what they're (sic) gonna do with it….Things like government, I feel they're always out to get you" (Female 5, Focus Group 2).
Sitting at the table Participants supported establishment of an advisory council or group to make decisions about what data were used, who was accessing those data, and whether data could be shared. This group would function as a "gatekeeper between the data and the use, so that a researcher who wants the data needs to make a very formal proposal to this council before you open up the doors to all the data" (Female 7, Focus Group 2). This group should be formalized through policy so that "you don't just have a group of people who get together Monday morning with a cup of coffee and say, ok, we're gonna let him have the data" (Male 1, Focus Group 3).
No consensus was reached about the size of this group although participants across focus groups advocated for a team of individuals rather than a sole individual. Their argument was that a team would keep the decisions from being hijacked by a single decision-maker with an agenda: "There needs to be a group table because everybody's looking out for their own agenda" (Female 2, Focus Group 5); "That's why I want 5 [at the table]. They're gonna have 5 different agenda, but they have to agree on how it's [the data] is used, so one agenda can't take priority over the others" (Female 2, Focus Group 1).
While no consensus was reached about the number of seats at the table, there was consensus that members of this advisory group were not just "Joe Blow from down the road" (Female 5, Focus Group 1) and didn't "have to be all doctors" (Female 2, Focus Group 1). More speci cally, participants argued for a number of stakeholders including lawyers, a cybersecurity expert or computer scientist, medical professionals, and researchers, the last of which included both those involved in the study and those with expertise about the speci c area of research such as department heads. "A team of folks that understands what the whole mission of the research is, whatever the research is," noted one participant (Female 2, Focus Group 3). Said another, "someone who can determine the need to know, who knows who needs to know" (Female 4, Focus Group 1). Inclusion of hospital administrators, members of hospital ethics committees, and privacy advocates also was mentioned.
Opinions differed about whether patients and volunteers should also be represented with one participant asking, "who would choose that person from the public and what makes that person from the public quali ed?" (Female 2, Focus Group 1). That sentiment was echoed when students were asked if a student should have a seat at the table: "I don't know that a student would be in the best position to understand the rami cations of things, but maybe someone who speaks on behalf of the students" (Female 3, Focus Group 6).
Other participants endorsed having volunteers whose data are being accessed and used on the advisory group, noting the need for "representatives that are like us, that are participants who can get their voice heard. That would at least give people the sense that it's not just researchers that are making the decisions" (Female 6, Focus Group 2). Another potential member of this advisory group was a communicator-"a secretary or information person that would make the decisions public…" (Male 1, Focus Group 5).
Transparency about who serves on the advisory council and what decisions are made was seen by participants as critical. Participants across focus groups also wanted to know how their data were to be used, how long their data could be accessed, whether their data bene tted others or led to new studies.
Participants also argued for an advisory group with membership that uctuated depending upon the purpose of the study or the population to be studied: "Maybe the group is multiple. It's not one set group because of the different types of research that you're dealing with" (Female 4, Focus Group 3).

Discussion
We conducted a total of six focus groups with 37 participants ranging in age from 18 to 76 years of age.
One focus group was held with students from a nearby University, while the other ve were comprised of individuals who were patients of the local academic medical center.
Overall, our participants were supportive of health-related research and trusting of biomedical and public health sciences researchers. While generally unaware that their personal data could be accessed and used by researchers, they had few reservations about this practice when pursued by researchers at their local institution. However, participants were less supportive of having their data shared with other organizations. Some participants wanted only researchers at their local institution to use their data while others wanted to be consented every time their data might be shared outside the local institution.
For our participants, transparency was key. They wanted to know when their data were accessed, for what purpose, and by whom. However, for some participants, just knowing their data had been accessed and used was not enough. Rather they wanted to have some control over the use of their data. These participants cited the determining factor as agreement with the purpose of the study. For others, the determining factor was whether their data were going to be shared outside of their local institution. Several participants just valued the opportunity to opt-out. Across the focus groups, however, wanting some control didn't con ict with participants' support of the use of their data for research.
Underlying participants' concern whether their data would leave the boundaries of their local institution were issues of trust. While participants trusted their local institution, they were less trusting of other institutions, both academic and commercial. Lack of familiarity with other academic institutions led to questioning whether their research practices had standards similar to their local institution's. This lack of trust extended even to well-known private institutions such as Princeton University. As has been concluded by other researchers people generally are more trusting of known or familiar organizations. [27][28][29][30][31][32] Hence, our participants trusted their local academic medical institution, but were less trusting of other academic medical institutions. Participants also didn't trust commercial entities such as insurance companies and pharmaceutical companies. Sharing of their data with pharmaceutical companies in particular was not supported if that sharing were to result in pro ts for a company or the industry as a whole.
The trust people have in their local institutions should be considered fragile, and institutions should not take that trust for granted. Patients expect that their healthcare institutions will be careful, conscientious, and responsible caretakers of the personal information with which they are entrusted. [33][34][35] To that end, our participants supported establishment of an advisory council or group with responsibility for deciding what data were used, who was accessing those data, and whether data could be shared. Our participants also expressed interest in knowing who serves on that advisory council or data governance board, their backgrounds, and their expertise.
How institutions choose to govern patients' data and what voices they include in decisions about use and access are critical to maintaining the trust of the public. As a concept and a practice, governance is said to provide a way for addressing the ethical, regulatory, and policy challenges of research with personal information. More speci cally, governance addresses how and why de-identi ed data are accessed and used by researchers, who makes those decisions, and how are these decisions made-all of which may not be known by patients who are providing the data.
Participants in our study were quite clear in wanting to know about their local institution's governance processes and policies. They advocated for a diverse group of stakeholders from researchers to patients to serve on an advisory or governance committee. The also advocated for more information either to be provided or to be available that spelled out the governance processes and policies.
While healthcare institutions typically provide patient materials outlining that their information may be used for research, education, and quality improvement purposes, these may not be su cient. Institutions might consider materials that are speci cally about notifying patients of when and how their personal information is being used for research, for example by sending periodic letters to patients or hanging posters hanging in waiting rooms. Others have suggested similar types of noti cation. [36] Ultimately transparency of this sort may have an important in uence on patient trust in both their healthcare institutions and the biomedical research enterprise. [23,[37][38][39] Conclusion This study has several limitations. The study is qualitative and has a small sample size, and as such the ndings are not generalizable. The majority of our participants are white and 35 years or older. Most of our participants are patients at the local academic medical center; this sense of familiarity provides them with a sense of trust and comfort with the physicians and researchers that work there. The overall positive view they have of the local institution likely in uenced responses. Finally, we conducted these focus groups prior to the COVID-19 epidemic. In this new era we are witnessing more surveillance and less trust in certain institutions, though con dence in medical scientists has grown since the coronavirus outbreak. [40,41,42,43] In spite of these limitations, our ndings provide initial insights into what patients think about questions about who should be making decisions about data access and use and how those decisions should be made, and provide the basis for larger more generalizable future work.

Declarations
Ethics approval and consent to participate This study was approved by the Pennsylvania State University Institutional Review Board (IRB). Approval was granted for obtaining oral consent. Everyone in the study consented to participate, including audio recording of the conversation, transcribing of the recording, and analyzing and publication of the data produced.

Consent for publication
Both authors have consented to the publication of this manuscript.

Availability of data and material
The datasets used and/or analyzed during the current study are available from the corresponding author on reasonable request.

Competing interests
Neither author has any competing interests to declare.

Funding
This study was funded by the Department of Humanities, College of Medicine, Pennsylvania State University.

Authors' contributions
Both authors contributed to the study design, data collection and analysis, and manuscript preparation.