I don’t mind my information going to the Moon, but I don’t want any letters from Mars: a qualitative exploration of the challenges with secondary use of health data in Ireland

Abstract

Background

Secondary use of health data is important for public and individual health due to its potential to drive research and healthcare improvement; however, there are challenges to be managed from a socio-ethical, legal and technological perspective. The aim of this qualitative study was to explore knowledge, experiences and perspectives of key stakeholders towards secondary use of health data in Ireland, with a specific focus on the challenges with secondary use.

Methods

The study employed a qualitative cross-sectional approach in accordance with the Consolidated Criteria for Reporting Qualitative Research (COREQ) guidelines. Thirty-five people participated in the study, with seven participants in each of the five focus groups: academics and researchers; healthcare professionals; data controllers, ethics and privacy experts; industry group; and patients and public. Two thirds of the sample were female, and over half of participants were between 35 and 54 years of age. Participants were recruited through purposive and snowballing method. Data was collected through focus group discussions, transcribed and analysed thematically.

Results

The participants across all study groups were supportive of secondary use of health data; however, significant challenges were identified. The four main categories of challenges were related to (1) health data use, (2) ethics, (3) health data ecosystem and (4) social inequalities. Specifically, insufficient collection and low quality of health data, alongside issues regarding access, linking and sharing are a significant barrier to effective secondary use. This is further complicated by complex ethical approval processes and requirements around data protection. The fragmented national Information Technology (IT) and data infrastructure and limited resources further hamper secondary use, and concerns about low health literacy among the public and negative experiences with the healthcare system influence patients’ willingness to share data for secondary use.

Conclusions

This study identified the multi-layered and intersecting challenges in the Irish health data ecosystem around secondary use, and highlighted the need for structural improvements, reform of ethical processes, integration of disadvantaged communities, and education and awareness-raising among the public. A careful consideration of these challenges on a national level is required to enable effective secondary use of health data.

Text box 1. Contributions to the literature
• Health data quality, access and linking, complex ethics processes and a fragmented national data ecosystem are significant barriers to secondary use of health data.
• Increased interoperability between different information systems and transparency around data sharing practices and industry involvement are required to facilitate effective secondary health data access and use.
• Digital health literacy among patients and the public requires education, meaningful Patient and Public Involvement (PPI) and prioritisation for individuals to control who can access and use their health data.
• Improvements in healthcare provision could strengthen patients’ willingness to share health data for secondary use, and trust-building practices may aid this process.

Background

Secondary use of health data can be defined as data reuse for research, innovation, regulatory and public policy purposes, and it can be distinguished from primary use of health data, which refers to individuals’ access to and control over their personal health data [1]. Secondary use of health data is essential in terms of both individual and public health because it can lead to better healthcare experiences and patient outcomes, expanded knowledge about diseases and treatments, and improved understanding of health care systems’ effectiveness and efficiency [2]. However, data-sharing initiatives for secondary use of health data require building public trust and confidence to ensure that valuable health data is used to the full potential in advancing medical research and public health strategies [3, 4].

International evidence on patients’ and the public’s perspectives on secondary use of health data is increasing, with a focus on both benefits and challenges of secondary use [5, 6]. In a qualitative synthesis of 116 studies on health data sharing attitudes, the authors concluded that sharing health data was influenced by many factors including the type of data and consent, and concerns related to data sharing included privacy, security and data access and control [7]. Other systematic reviews on public attitudes towards secondary use of health data found that widespread conditional support co-exists alongside concerns about confidentiality, privacy, control, transparency and trust, and discrimination and harm arising from disclosure [8,9,10]. In addition, these studies found low levels of awareness among the public about existing practices and secondary uses of health data. Other systematic reviews suggest that fears on the use and misuse of data, stigmatisation, and sharing data for commercial gain are common among individuals [11,12,13]. Notwithstanding these issues, a widespread support for secondary use of health data exists amongst the public, with altruism, greater or social good, and moral responsibility quoted as the main motivation to share health data for secondary use [9, 10, 12, 13].

Fostering trust and ensuring individuals recognise the significance of sharing their health data within a collaborative framework is also essential for the success of the European Health Data Space (EHDS). Proposed by the European Commission in 2022, the EHDS is part of a larger effort to develop a European Health Union as single market for digital health products and services that fosters free movement of health data across the European Union (EU). The aim of the EHDS is to empower individuals to take control of their health data and facilitate the exchange of data for the delivery of healthcare across the EU (primary use), and to enable researchers, innovators and policy makers to use individuals’ electronic health data in a trusted and secure way [1]. Meanwhile, in Ireland the Health Information Bill 2024 will provide the legal foundation for the rolling out and use of electronic health records in Ireland. Aligned with the requirement of the EHDS, it will aid the digital transformation of the national healthcare sector [14]. In the context of the legislative and policy changes in the health information landscape at the EU and national level, the aim of this qualitative study was to explore knowledge, experiences and perspectives of key stakeholders regarding secondary use of health data in Ireland and mechanisms for building public trust, and this paper focuses on the multifaceted challenges of secondary use of health data, as identified by the participants.

Methods

Study design

This was a cross-sectional qualitative study of key stakeholders’ perspectives about secondary use of health data in Ireland. A study protocol has previously been published where further details can be found [15]. A qualitative study design enabled an exploration and interpretation of a broad range of views and perspectives [16], and focus group methodology enabled acquiring rich and detailed information in a less-intense environment [17, 18]. The research methodology and the reporting guidelines used in the reporting of this study were in accordance with Consolidated criteria for Reporting Qualitative research (COREQ) reporting guidelines [19]. Ethical approval was obtained from the Royal College of Surgeons in Ireland (RCSI) Research Ethics Committee (REC202208013) and written informed consent was obtained from all participants.

Participants and recruitment

The sample consisted of five study groups: Study Group 1 (SG1): Academics and Researchers; Study Group 2 (SG2): Data Controllers, Data Protection Officers (DPOs) and Ethics Experts; Study Group 3 (SG3): Patients and Public; Study Group 4 (SG4): Healthcare Professionals; Study Group 5 (SG5): Industry. Cognisant of the discrepancies in knowledge between the experts (SG1, SG2, SG4, SG5) and the patients and public group (SG3) about the secondary use of health data, separate focus groups for each study group were facilitated to enable an in-depth and inclusive discussion. Five focus groups enabled a discussion among all relevant stakeholders about secondary use of health data, and evidence suggests that 4–8 focus group discussions are sufficient to reach saturation [20]. The study included people who have experience with secondary use of health data (applicable to SG1-4), or an interest in exploring this topic regardless of their previous knowledge (SG5). Minors and people who are unable to communicate fluently in English language were excluded. Participants were recruited through a combination of purposive, convenience and snowballing sampling methods. Professional networks and gatekeepers, including those in leadership positions and/or those with a wide social network, were utilised to recruit participants for all study groups, apart from the SG3: Patients and Public. The participants for the SG3 Patients and Public were recruited through a social media campaign and the FutureNeuro Centre PPI Panel. Participants in this group received a brochure about health data journey as optional reading (Additional file 1), and upon completion they received reimbursement for their involvement.

Participant characteristics

Thirty-five people participated in the study, with seven participants in each of the five focus groups: Academics and Researchers; Data Controllers, DPOs and Ethics Experts; Patients and Public, Healthcare Professionals and Industry Group. The sample included a diverse range of age groups, with over half of participants between 35 and 54 years of age. Two thirds of the sample were female and the majority of participants (94%) identified as Irish. There was a wide geographical spread of participants with representation across thirteen counties (out of 26) in Ireland. Further details about participant profiles can be found in Additional file 2.

Data collection

The five separate focus groups representing the five different study groups (SG1-SG5) took place online via the Zoom platform from April until December 2023, and each one lasted between one-two hours. The focus groups were organised and conducted by TB, and notes were taken by a research assistant. Focus groups were conducted using a topic guide (Additional file 3), which included questions within the following three themes: (1) participants’ knowledge, experiences and perspectives about secondary use of health data; (2) participants’ views on standards and regulation regarding ethical secondary use of health data; and (3) their views on actions that inspire public trust and confidence in secondary use of health data. This paper focuses on the first overarching theme (1) participants’ knowledge, experiences and perspectives about secondary use of health data, and within that theme it explores the challenges with secondary use of health data in Ireland.

The topic guide was informed by the literature, and subject to discussions with the PPI Panel in RCSI, Industry Partner IQVIA Ireland and relevant stakeholders. IQVIA reviewed the topic guide and no changes to the topic guide were made or requested. The stakeholders were the Health Information and Quality Authority (HIQA), the Health Service Executive (HSE), and the Irish Platform for Patient Organisations, Science and Industry (IPPOSI). The topic guide was piloted twice, in an online semi-structured interview with a female PPI Panel member in RCSI, and in an online semi-structured interview with a qualitative researcher in RCSI, and it was reorganised. Initially, the topic guide was divided into four areas: (1) knowledge and understanding, (2) opinions and attitudes, (3) risks, benefits and expectations, and (4) ethical challenges. It became apparent during the pilot interviews that the number of questions should be reduced, and additional questions about trust and confidence introduced. As a result, the first three categories of questions were reduced in number and combined under the following: (1) knowledge, experiences and attitudes, which was followed by (2) regulation, ethical challenges and power-sharing responsibilities, and a new set of questions related to (3) public trust and confidence. The focus groups were audio recorded and transcribed verbatim. It was indicated in Participant Information Leaflet (PIL, Additional file 4) that participants have the opportunity to review and make changes in the transcript, and no participant requested to receive the manuscript or make changes pertaining to their statements. All identifying markers were removed prior to analysis.

Data analysis

De-identified transcripts were imported into NVivo 12 software to organise the data and conduct analysis. Thematic analysis [21, 22] was chosen for its flexible, adaptable and non-linear approach. One transcript was coded independently by TB and CC, and results were compared and discussed. TB coded the data and developed the coding index, which was discussed and agreed on with KB and CC. Data analysis commenced deductively and all data was classified under one of the three overarching themes derived from the topic guide: (1) knowledge, experiences and perspectives; (2) standards and regulation; and (3) public trust and confidence. From there the analysis unfolded in an inductive manner, and main and sub-themes were created, reduced in number and organised within the three overarching themes. Challenges with secondary data use is the main theme under the overarching theme (1) knowledge, experiences and perspectives about secondary use, and the central focus of this paper. Additional file 5 provides an overview of the theme challenges with secondary data use and related sub-themes. Illustrative quotes have been provided to supplement narrative descriptions.

Results

Theme and sub-themes

Across all focus groups, when queried about their knowledge, experiences and perspectives on secondary use, the participants primarily focused on the multi-layered challenges with secondary health data use. The four related themes and sub-themes presented below are: (1) health data use, (2) ethics, (3) health data ecosystem and (4) social inequalities. These were selected due to the frequency with which they occurred, and the number of references associated with each theme. The themes and sub-themes often intersected, given that the challenges with secondary use are intertwined, and some overlaps across different sub-themes may occur. A visual representation of the overarching theme, and the main and sub-themes themes is provided below.

Fig. 1

Overview of the themes pertaining to challenges with secondary use of health data, and relationships (arrows) between the sub-themes

Health data use

The issues pertaining to collection, quality and sensitivity of health data were highlighted across all groups. One of the challenges, reported by academics and researchers, was the importance of collecting data in a structured way to enable high quality secondary analysis. Part of this process includes achieving a balance between collecting sufficient detail, without making the data collection process onerous. The general agreement was that health data should be as inclusive as possible, and that only recording clinical outcomes may not reflect what is meaningful or important to patients.

“You don’t see markers of improvement in the blood if they take a new drug, but maybe they can carry their grandkid up the stairs, and that might be the thing that’s important to them.” (P1; Academics and Researchers).

The data controllers, DPOs and ethics experts highlighted the challenges regarding incomplete datasets, and juxtaposed this with data collected through other platforms.

“I always say that my local supermarket probably knows more about me than my local hospital, because there’s so much collected. They collect so much information on what we’re doing, whereas our local hospital has relatively little.” (P14; Data Controllers, DPOs and Ethics Experts).

The patients and public group questioned the quality of health data that is collected. They referred to the “rubbish in, rubbish out” adage, suggesting that the quality of health data recorded will have an impact on the outputs or outcomes. They emphasised the need for collecting data in a way that will represent the whole population.

“We are getting data from a white female who has a good job, kids and a partner. So, their overall thinking when they are feeding into data can be so different to maybe a mum of one, single mum struggling with cost of living.” (P19; Patients and Public).

Participants also highlighted the need for collecting sensitive data, although there was no agreement as to what constitutes sensitive data. Some believed that all health data can be considered sensitive, others that there are tiers of sensitivity – and technological advancements are adding further complexity.

“If we consider that all data relating to a person’s environment, their health, routines and life, is now possibly being collected by our smart and mobile devices, then that shifts the whole paradigm. (…) I don’t mind, as somebody said, my information going to the Moon, but I don’t want any letters from Mars.” (P7; Academics and Researchers).

The healthcare professionals asserted that sensitive data includes data that may lead to shame and discrimination, if released. However, labelling data as sensitive may limit its use.

“Generally its stuff that people feel there’s some sort of stigma attached to it, a sexual health data or mental health, because society tends to stigmatise that. And that’s why people want to protect their data. But if you think about it then, a sexual health service can never link its data or do any work, because all of their data is clearly sensitive.” (P24; Healthcare Professionals).

In addition, participants across all groups described issues related to access, linking and sharing of health data. Academics and researchers spoke about difficulties in getting access to datasets and a lack of information on what datasets are available. They believed that accessing data in Ireland was often contingent upon relationships between researchers and data controllers.

“We are dealing with individuals as opposed to processes a lot of the time. And when there’s a change of the individual at the head of a data provider, for instance, that can have implications on accessing the data for the researchers as well. (…) Maybe it’s because research in Ireland is quite parochial. We do have our little pieces of land that we keep hold of.” (P2; Academics and Researchers).

The healthcare professionals believed that being dependent on other organisations and their capacity to process data is preventing real improvements in population health.

“We should be able to calculate how many people had polypharmacy since 2012 and we can’t get it, we’re not allowed. (…) And that means that we are left in the dark” (P23; Healthcare Professionals).

Participants in all groups expressed concerns about giving patient data access to private companies. The patients and public were concerned about where their data goes, whom it is shared with, and what are the potential risks for the individuals and their families.

“If I knew what they were going to do with my data and perhaps it was to create a new drug or some treatment for a rare disease, then I’d be more interested. But just blankly allowing my data to go into a pool that would be given to a private pharmaceutical company? No, no.” (P16; Patients and Public).

However, participants across all groups believed that cooperation with for-profit entities is important, and concerns about data access and sharing can be managed through information provision, relationship-building and appropriate legislation.

“If the data is not being shipped over to some firm in America, but actually is done in-house, a safe haven environment, there can be a relationship that works with private companies.” (P24; Healthcare Professionals).

Healthcare professionals focused on the issues with data linking. They stated that a wealth of data was available that would benefit national efforts, if linking was possible. The biggest concern in that respect for the patients and public was the impeded flow of information between practitioners due to insufficient linking and sharing of patient information, which in this instance indicates challenges with primary use of health data.

“My youngest daughter has an eating disorder and during her treatment getting records from different places, because of all the different disciplines that’s involved it was just like a non-stop circus trying to ring around to secretaries of this doctor or that doctor… And they are not all in the one loop, and not all seeing the same thing. You sometimes find you are seeing people that literally don’t know why you are there.” (P20; Patients and Public).

The patient and public suggested that health information needs to be utilised appropriately, otherwise the patients will be less likely to share their data.

“There’s a lot of data out there in Ireland that the Irish government have and they have done nothing about it. (…) That’s a cultural problem in Ireland. No wonder people are cynical about giving any more data because the data that is out there in black and white is not being actioned by the Irish government. So why would we give them more data? “(P17; Patients and Public).

Ethics

There was an agreement among the participants that complex ethical approval and consent processes and differing interpretation of data protection and general data protection regulation (GDPR) interfere with secondary health data use. These issues were highlighted by the academics and researchers.

“I think things have improved, but it’s been incredibly slow. So the first secondary data analysis project I was involved in was in relation to people on methadone. And it took years to get approvals and to get things signed off, to access data and data linking. And that was even before GDPR.” (P4; Academics and Researchers).

Similar concerns were expressed by the data controllers, DPOs and ethics experts, and the absence of a national ethics committee for secondary use was underscored which further impedes secondary use of health data.

“I was involved in setting up the national drug related deaths index. That involved getting ethics approval from every hospital. Things have improved now in relation to getting ethics, but that was a huge amount of time taken up with that exercise.” (P12; Data Controllers, DPOs and Ethics Experts).

The participants in this group highlighted the lack of consistency and transparency in obtaining ethical approval across different national institutions. In addition, a considerable overlap between the ethics and data protection was reported, and a lack of clarity and guidelines in relation to secondary use.

In addition, this group underscored that the interpretations of GDPR and the privacy rights of individual data subjects vary within Ireland and across Europe, which hampers international cooperation.

“The challenge of sharing outside of Ireland, we’ve come up against a massive. We’ve had full on rows between our legal team and their legal team, is it anonymous, is it not, quoting legislation, to the point some collaborators are saying ‘We don’t want to work with you, it’s too difficult and we’ll get out data elsewhere.” (P9; Data Controllers, DPOs and Ethics Experts).

Healthcare professionals stated that the application of GDPR is overly restrictive in Ireland, which limits their ability to make changes or innovate.

“I think we’ve probably nearly gone too far the other way with regards to GDPR and everything. We have a wealth of data that we could utilise with other national projects, but it’s very difficult to get access to data to link it for other projects that would have a huge benefit.” (P27; Healthcare Professionals).

In addition, the healthcare professionals expressed their frustration regarding the length it takes to obtain the ethical approval in order to run an audit, which drives them “absolutely crazy”.

“We do the internal audit and we can’t really do anything with it, so it just sits on our hospital machines and it’s like ‘Oh, that was nice’. We can’t really make any changes or innovations because we don’t have the necessary ethics or GDPR stuff.” (P26; Healthcare Professionals).

Furthermore, both academics and researchers, and healthcare professionals groups stated that the process of obtaining consent has become unnecessarily difficult and onerous.

“It seems to me like we have terrified the research population into feeling obliged to put together these very dense consent, patient information leaflets and forms. And they’re not serving anybody” (P1; Academics and Researchers).

Meanwhile, concerns were raised in the patients and public about the timing of obtaining consent, which can coincide with a surgery.

“Often, when we are consenting it’s at our most vulnerable, and we don’t know what we are consenting to. And you may be going in for a serious operation, but just presented with that. Would you fully understand it, if you are already at a heightened state of stress?” (P21; Patients and Public).

Health data ecosystem

Participants across all study groups expressed their concerns about the underdeveloped data and IT infrastructure that hampers secondary use. Academics and researchers stated that we are “nationally way behind” regarding information system functioning and efficiency. Participants stated that infrastructure through which sensitive data is accessed requires consideration at a design stage.

“I think with the what is also the how you access the data. In the past we weren’t really thinking about the different types of platforms which are now available, that people can access data from. I increasingly believe that if we’re talking about really sensitive, raw data at the level of the individual, the platform on which an individual accesses or researcher accesses the data is as important as the type of data.” (P2; Academics and Researchers).

The data controllers, DPOs and ethics experts focused on a lack of communication between the national and regional datasets, which is particularly problematic when patients reside in one area, and attend hospital appointments in another area. The lack of a centralised data infrastructure impacts on the information flow, as well as workload.

“Unfortunately in Ireland we don’t have a national coronial data base. So in order for us to collect coronial data we have to manually extract the relevant data we require from the files. There’s currently 37 coroners around Ireland, so we manually go through all their files on their 37 sites. That takes a lot of time.” (P12; Data Controllers, DPOs and Ethics Experts).

The healthcare professionals stated that the information systems in Ireland were not designed to enable a variety of functions, such as collecting information about patients, and for pharmacy claims. Consequently, practitioners have to create new portals or import all data in a new system, which is “very burdensome”. The industry group agreed that the national information systems are not “up to the same standard” as the other European countries, and suggested possible reasons for such disparity.

“There’s been a quote, I think that it would cost something like a billion euro to bring all Irish health care systems on board with electronic health records. (…) Without a policy in Ireland that basically says that we’re going to invest in this, we’re just not going to get to the point of becoming experts.” (P35, Industry Group).

Participants in all groups reflected on the limited resources that impede secondary use of health data, primarily time and costs associated with data collection and processing.

“If we’re collecting secondary data from two sites, you go to multiple different ethics committees. It seems a little backwards in my opinion and counterintuitive to what the person who gave the data wants as well in many cases. And the cost of it…It’s all coming from the one public purse.” (P9; Data Controllers, DPOs and Ethics Experts).

Participants in the industry group highlighted the benefits of incorporating PPI in research; however, that becomes “another project that you have to do” with an impact on already scarce resources.

The patient and public group focused on the effects of the fragmented infrastructure on the quality of healthcare provision and implications for both secondary and primary use of health data. The participants found that their records were “all over the place” and a lack of communication between different hospital systems meant that practitioners could not adequately prepare for consultations. The participants with caring responsibilities experienced barriers with gaining access to the health data.

“I’m an advocate for my parents. My dad has dementia and recently went into a nursing home. His last couple of visits between the hospital and the nursing home, they looked for care coordinators. But because you don’t have a clinical background they don’t speak to you, you don’t have access to information.” (P18; Patients and Public).

System inefficiencies adversely affect healthcare provision, and inefficient healthcare provision influences patients’ willingness to share data. In the absence of timely diagnosis and treatment, several patients disclosed personal health information on social media.

“I’ve been on the road many times where I have had to go and fight for extra hospital services in the area of staffing or equipment. So, we shouldn’t need to be doing this, but because the only way when you are going out to the public facing view is to share your story and your personal details. If you want something done, you have to give the hard-hitting vulnerable story.“ (P21; Patients and Public).

In addition, data breaches such as receiving referral letters, calls for appointments and prescriptions aimed for other people were common among the patients and public, which erodes public belief in the health service.

“I’m back and forth to appointments all the time, in the hospital waiting room in the main waiting room in one of the national centres there’s a complaints policy in relation to this. But there’s a six tier step of trying to put your complaint in. I thought to myself ‘Is this to help you do it, or to put you off’?” (P21; Patients and Public).

The participants across different groups agreed that legislation in Ireland poses a “real challenge” for secondary use of health data, as they believed that the national legislation was outdated and disharmonious with technology.

Some healthcare professionals thought that the legislation is too strict to support data sharing and use.

“We are kind of hamstrung legislatively in this country, but I think we need a really big discussion among all of the stakeholders. And I appreciate that doesn’t necessarily involve patients, but have we lost the plot a little bit on data security?” (P24; Healthcare Professionals).

The data controllers, DPOs and ethics experts thought that strict legislation regarding data holders’ privacy precludes organisations from accessing and sharing information that would also improve their performance. This was particularly evident in cancer registries across Europe.

“The legislation [that] was supposed to equalise everything has actually driven disparities. So, for example, the Norwegian and Swedish registries where everybody was terribly envious of, because they have everything linked, they have stopped linking anything outside of their countries now.” (P14; Data Controllers, DPOs and Ethics Experts).

Social inequalities

A concern was expressed across all study groups that health literacy is low among the general public, which influences people’s willingness to share data for secondary use. The industry group believed that the public had a low level of awareness of the value of health data, and the journey it undergoes to enable secondary use, which was juxtaposed with a higher level of knowledge regarding other data uses.

“Everybody interacts with Google. And I think even though they might not have an inherent concern about how Google uses their data, they’re certainly aware that a lot of it is used, and they’re aware of the purposes for which it’s used. I’m not sure that there’s quite that knowledge yet in relation to the use of patient data.” (P35; Industry Group).

The data controllers, DPOs and ethics experts and healthcare practitioners queried whether patients truly understand what the benefits of secondary use are. They underscored that a gap in knowledge leads to increased concern and anxiety about sharing data. This was confirmed in the patients and public group – one participant expressed surprise upon realising that their data is already used for secondary purposes.

“That’s why I asked what is secondary use, because people are using my data?! So my concern is that when I go to a GP [General Practitioner], is my data being given off to pharmaceutical companies or whatever?” (P16; Patients and Public).

Another dimension of social inequalities is the lack of participation of patients of a lower socioeconomic status (SES) in medical research. Both the healthcare professionals and patients and public groups centred on patients’ ability to understand consent forms. Complicated scientific language precludes meaningful involvement of patients, especially those of a lower SES.

“I spend a lot of time at work reading supplier agreements. We operate with providers who send data outside the EU, and I spend a lot of my time reading data privacy policies, transfer impact assessments. And I can do it, but the average person on the street won’t have the skills to analyse all these things.” (P17; Patients and Public).

Discussions in the patients and public group also revealed that participants with higher SES use social position to their advantage when interacting with the healthcare system.

“I tell healthcare professionals I’m a pharmacist when I go in because I find it changes how they speak to you…. I demand to be told in full facts in medical language and I get much further. I’ve had experience in the healthcare system with my mother last year and I really reflected – other people who wouldn’t have that power, you are left at the mercy of the healthcare system.” (P17; Patients and Public).

Only participants in the patients and public group reflected on gender differences and healthcare. It was stated that women’s health data is more personal and sensitive than that of men, in particular data related to women’s sexual and reproductive health.

“When that data breach happened a year or two ago everyone was, I was terrified that all my personal medical journeys that would only be shared with a very small amount of people would be made public with my name, with my PPS number [unique identifier of individuals]. (…) Men don’t really care as much about their medical history, but my files could be can of beans.” (P19; Patients and Public).

In addition, the participants suggested that the field of health advocacy is dominated by educated and articulate white women in Ireland. They highlighted a lack of male involvement in patient organisations.

“With the BRCA [breast cancer gene] community, to get even a man or a male to speak or to be tested is horrendously hard. So any statistics we have are based on a very small sample of men, but we have hundreds of thousands of women that are happy to get tested.” (P19; Patients and Public).

Discussion

Overview of the main findings

This paper explored the knowledge, experiences and perspectives of key stakeholders regarding the challenges of secondary use of health data in Ireland, through in-depth discussions with the research community, data and privacy experts, patients and public, healthcare professionals and the industry representatives. The results revealed multifaceted and intersecting challenges regarding collection, quality and sensitivity, as well as access, linking and sharing of health data, complex ethics and consent processes including differing interpretations of data protection requirements, fragmented national data and IT infrastructure impacted by scarce resources, and social inequalities among the patients that influence their willingness to share data. The academics and researchers found linking proving to be a significant barrier, along with time-consuming research ethics approval processes and local interpretations of the GDPR. Further, the lack of data on diversity and SES hampers the ability to explore how different groups use health services. Similarly, the data controllers, DPOs and ethics experts highlighted that the ethical constraints undermine a wealth of data otherwise available, and a lack of a centralised data infrastructure leads to manual data collection. This group was also concerned about how differing national interpretations of GDPR impact upon national and international collaboration, and they called for a national ethics committee for secondary health data use. The healthcare professionals were mainly concerned with access to health data and agreed that the organisational silos inhibit efficient data sharing. This group underscored that consent forms are becoming increasingly complex, and patients may not fully understand them. This may make patients less likely to share their data for secondary use, and bias participation towards more educated patients. The patients and public group expressed fear regarding data sharing, exacerbated by a lack of transparency, communication and knowledge shared with the patients. The participants wanted to see a prioritisation of patient choice, control and agency over the secondary use of health data. It was revealed that patients share their health information on social media in the absence of access to timely healthcare. Paradoxically, the vulnerability arising from requiring specific health services may lead patients to share their health information on public platforms; however, they retain power by deciding which health data to share. Participants across all groups, except the industry group, expressed scepticism about sharing data with the private sector, albeit to varying degrees. There was a general consensus that collaboration with industry is important to advance science, and transparency regarding is required to avoid conflict of interest. The industry group expressed the need for a national data authority and depository to streamline secondary use, alongside a revision of privacy and legal regulations and the explicit consent model.

Comparison with other studies

Our study supports previous findings on individuals’ views regarding secondary use of health data, and uncovers new challenges, as described by the participants. We found that the participants were supportive of using de-identified and anonymous health data to support research, discovery of pharmaceutical drugs, and improvements in healthcare provision, which is in line with previous research on secondary use conducted internationally [7,8,9,10,11,12] and in Ireland [23,24,25,26]. Although the extant research into public attitudes towards secondary use of health data conducted in Ireland is scant, our research supports previous findings that indicate general support among the Irish public for the sharing of anonymous health data for secondary purposes and research in particular [23, 24]. However, we found that support for secondary use of health data was conditional, as the multi-layered challenges in the national health data ecosystem influenced participants’ views on secondary use, and indeed mechanisms to enable effective secondary use. Specifically, previous qualitative research suggests that the issues regarding patients’ privacy, confidentiality, transparency, control and trust are the most pressing concerns with secondary use of health data [27–28]. These issues also featured in our research; however, we found that participants were primarily focused on the challenges regarding collection, categorisation, quality, access, and sharing of health data. This difference could be a result of our diverse sample that was not present in other studies. For instance, previous qualitative research of individuals’ views on secondary use of health data relied on samples that included only patients and public [11, 23, 26, 29, 31, 32], patients and practice staff [29] and experts in digital health [28]. However, our sample composition was much more diverse, which could explain the focus on the structural issues in the national data ecosystem.

These results confirm findings from the ‘Towards the European Health Data Space’ (TEHDS) mapping of the Irish Health Information System which highlighted the challenges around fragmented and siloed national system with implications for data quality, sources, infrastructure and interoperability [33], and PHIRI (The Population Health Information Research Infrastructure) that equally highlighted a lack of harmony between national data collection systems across primary healthcare [34]. Ireland is ranked lowest (out of 22 countries) for the ability to link different data in health and in data governance, but is third highest in Europe for digital skills in the population [35]. In addition, the Irish Data Protection Commissioner, the supervisory authority for the GDPR, also has functions and powers related to other important regulatory frameworks including EU Directives. Further, we found that the three central questions that influenced participants’ willingness to share data were who has access and why and to which data, with motivation for using data being of significant importance to the patients, in line with existing evidence [30,31,32]. In addition, we identified a range of social inequalities that may influence both patients’ ability to engage with the research community to facilitate secondary use, and the quality of health data for secondary use. Concerns that health literacy and knowledge about the existing practices for secondary use is low among patients and public were expressed These findings corroborate previous research, which suggests that public education and information provision regarding secondary use are lacking [8, 11].

Strengths and limitations of the study

This study had a wide perspective, from multiple stakeholders and diverse backgrounds, in exploring the challenges pertaining to secondary use of health data. The qualitative approach enabled an in-depth inquiry facilitated in a group setting, and the semi-structured format enabled an exploration of novel areas that participants found relevant. The study also included a national perspective, and inclusion of patients with chronic illnesses, disabilities or caring responsibilities. Another strength is the timing of the research, as both Ireland and the EU are undergoing a digital transformation of health services. However, there are limitations of this study including the absence of male participants in the patients and public study group, despite increased efforts to recruit male participants through multiple channels, and organising the focus group according to their availability. In addition, we relied on purposive and convenience sampling to recruit participants for the study, which may impact on the results. We employed both a social media campaign and the use of one PPI panel to recruit patients and members of the public, and these participants may not fully represent a broader public view. Further, the educational materials on secondary use of health data were shared with the patients and public group before data collection as an optional reading. The participants were not explicitly asked had they engaged with the materials, and it is unknown whether the resources may have had any influence on their responses. The ethical and technical experts were combined into one group which may have limited discussion on viewpoints that were not be completely aligned. We also did not involve government representatives in this study, and this is another area that requires exploration. The themes and sub-themes were selected according to their frequency and number of references, and there may be a possibility of overlaps across the sub-themes that may impact on the results. Occasionally it was difficult to separate primary and secondary use of health data, given that the participants mentioned these interchangeably. However, we distinguish between quotes referring to primary or secondary use. This overlap demonstrates that, although the European Commission separates primary and secondary use in the new EHDS regulation, there may be less of a distinction in practice. Also, our focus was on the challenges with secondary use within the national health data ecosystem in Ireland, and there may be lack of generalisability particularly outside Europe.

Implications and further research

Ireland is going through a digital transformation of health services, including the implementation of European regulations and initiatives such as the EHDS. The published Irish Health Information and Patient Safety Bill will enable the implementation of a national Shared Care Record and future Electronic Health Record system. In addition, the Digital Health Framework [36] provides a national roadmap to harness the power of health data. The findings are of interest to organisations responsible for health information and secondary use of health data in Ireland, particularly the Health information Quality Authority (HIQA) and in the establishment of Health Data Access Body (HDAB). These findings can inform national policy-makers about the most pressing challenges in the system regarding secondary use, and support the transition to a fully integrated and efficient digital health ecosystem. It also provides evidence to support public engagement in how to address the challenges in using health data for secondary use. Increased public involvement can lead to increased trust and confidence in organisations that are involved in secondary use of health data [37, 38]. The longer-term implications relating not addressing the challenges identified include sub-optimal health care for patients, lack of advancements in personalised healthcare and reduced research innovation for public and patient benefit. In relation to addressing the challenges reported we can learn from other countries that have extensive experience in adopting a patient-centred electronic health record. Successful models include the UK, Finland, Sweden and Denmark where integrated electronic health records (EHR) exist using unique identifiers that link data across different health systems. These are an important source of health data for secondary use [39]. Estonia is another example of a country where each person has an online EHR (an e-Health record) that can be accessed by clinicians and individuals. Many of the challenges will be addressed with the EHDS, health data access body, the health information bill and other digital health strategies in Ireland [14, 36]. In terms of further research, the study has relevance for the growing field of Artificial Intelligence (AI) in healthcare. AI has the potential to improve medical treatment and patient experiences, with applications across different medical areas including genomics, imaging, laboratory, clinical data and outcomes [40, 41]. The potential for incorporating AI in clinical decision-making is significant, but the importance of building trust and confidence among all stakeholders, and patients in particular, will be essential for this potential to be realised.

Conclusion

This study explored the knowledge, experiences and perspectives of key stakeholders regarding the challenges of using health data for secondary purposes in Ireland, through focus group discussions. These biggest barriers include quality of data, impeded access and difficulties with sharing and linking; complicated ethics processes and data protection requirements, fragmented national data ecosystem, and concerns about low health literacy among the patients and public. The findings suggested the need for structural improvements and increased interoperability between different information systems, reform of the ethics processes, and increased transparency around data sharing practices and industry involvement. The need for education of patients and the public, meaningful PPI and a prioritisation of patient control over their health data was highlighted. The results also indicated that improvements in healthcare provision could strengthen patients’ willingness to share health data for secondary use, and trust-building practices may aid this process. The study findings may inform national policy-makers and support the national transition to a fully integrated digital health system, and the implementation of the EDHS in Ireland.