Huge quantities of complex and diverse data are generated everyday in healthcare institutions, including clinical documentation (diagnostics, lab data, imaging data, etc.), administrative data, activities and cost data, and R&D data from clinical trials.

1. METHODOLOGIES FOR ADDRESSING
PRIVACY AND SOCIAL ISSUES IN
HEALTH DATA
Trilateral Research Ltd.
Crown House
72 Hammersmith Road
W14 8TH, London
+ 44 (0)20 7559 3550
@Trilateral_UK
Rachel Finn,
Trilateral Research, UK

2. AGENDA
About Trilateral
Data protection context (brief)
Three EC project case studies
Take home messages

3. COMPANY PROFILE
Trilateral Research is a leading London-based multidisciplinary research,
consulting and technology development company
Our team collaborates across social sciences and technology, to bring insights
from each into supporting data driven innovation
Small enterprise (SME) ≈25 staff members
Running 20-25 projects at any given time
Almost all research and technical staff have postdoctoral experience
(≈90% have PhDs)
Extensive publication list and excellent international profile:
http://trilateralresearch.co.uk/full-list-of-publications/

4. DISCIPLINARY & DOMAIN EXPERTISE
PRIVACY AND DATA PROTECTION
SURVEILLANCE
SECURITY
RISK
ASSESSMENT AND EVALUATION
QUALITATIVE RESEARCH
POLICY AND REGULATORY ADVICE
QUANTITATIVE RESEARCH
ETHICS
FORESIGHT
TRUST
CYBER SECURITY
STANDARDISATION AND CERTIFICATION
INTERNET OF THINGS
SOCIAL MEDIA ANALYSIS
BIOMETRICS
DATA ANALYTICS AND VISUALISATION
BUSINESS MODELLING AND ANALYTICS
INNOVATION MANAGEMENT
DATA MANAGEMENT
COMPARATIVE RESEARCH
MIGRATION
HUMAN TRAFFICKING
RPAS
PRIVACY BY DESIGN HUMAN RIGHTS
MACHINE LEARNING
PROGRAMMING AND SOFTWARE DEVELOPMENT

5. ETHICS, PRIVACY & DATA PROTECTION
 A structured approach
 11+ years practitioner experience
 Deep understanding of ICO requirements and GDPR compliance
 Experts in PIA and EIA theory and practice
 Well-versed in research ethics: informed consent, ethics monitoring, regulatory
compliance.
 Contributing to standards in this area: ISO 29134/WD29134 - near final draft
on PIA guidance

6. BIG DATA, HEALTHCARE AND DATA PROTECTION
 Drivers
 Cost pressures
 Patient demand
 Technological availability
 New possibilities
 Challenges
 New legislation (GDPR)
 Technological uncertainty
 Conflicting patient demands
 Privacy and ethics contextutal

7. GENERAL DATA PROTECTION REGULATION (GDPR) 2016
 Principles & requirements
 lawfulness, fairness and transparency
 purpose limitation
 accuracy
 storage limitation
 integrity and confidentiality [data security]
 accountability
 rights of access, rectification and erasure (“right to be
forgotten”)
 data protection by design and default
 data breach notification (supervisory authority and
individuals affected)
 data protection impact assessment
Health data and
genetic data as
“special category” of
data requiring explicit
consent

8. THREE CASE STUDIES
Across different parts of the data value chain
Digitising data Processing data Sharing data

9. General
practice health
Local
government
services
Small
businesses &
self-employed
Disability
PUBLIC SECTOR AREAS
CLARITY PROJECT
 Open eGovernment services
 Four focus areas
 Needs, drivers and potential solutions
 CSA under Societies work programme
 Grant agreement no. 693881

10. DIGITISING E-HEALTH DATA
 In a 2013 study among GPs, the European Commission asked for the reasons
for not having an Electronic Health Records. One of the largest reasons was that
the doctors were unsure about the privacy and confidentiality of the data (27%).
 European Commission, Benchmarking Deployment of eHealth among General Practitioners (2013), Final Report p. 35.
 66% of individuals stated they would consider switching physicians if a doctor
offers them access to their medical records through a secure Internet connection.
 Deloitte, 2011 Survey of Health Care Consumers in the United States, Key Findings and Strategic Implications,
http://www.statecoverage.org/files/Deloitte_US_CHS_2011ConsumerSurveyinUS_062111.pdf, p. 12.
Data needs to be digital before it can be processed, but…

11. PATIENT / DATA OWNER ACCESS
 Access to electronic health records by the patient encouraged good record keeping
practices by staff and allows patients to improve the accuracy of their record, and
take increased responsibility for their health.
 Secure eHealth infrastructure could give people direct access to their electronic
health record
 Royal College of General Practicioners, Enabling Patients to Access Electronic Health Records: Guidance for Health Professionals. 1 September 2010.
 Grechenig, Thomas, Avana, Barbara, Baranyi, Rene, Schramm, Wolfgang, Wujciow, Anna, Design Criteria for Large eHealth Infrastructure Systems, in
Graschew, Georgi, (ed.), Telemedicine Techniques and Applications, 2011, InTech, pp. 99 – 118, p. 99.
Giving patients secure access to their own records is socially and legally
desirable and improves data quality

12. BYTE PROJECT
 Societal issues associated with big data collection,
processing and sharing
 Seven sectoral case studies in big data practice
 Legal, social and ethical issues
 CSA funded under the ICT work programme
 Grant agreement no. 619551
 Specific case study in genomic data to detect rare
diseases

13. DATA USE / DATA PROCESSING
 Incidental findings
 “It’s a strange scenario because what you find in all the research that tends to
happen is that the patients are very much of the thought process that it’s their data.
It’s their data so you give them back their data or you tell them about it. And if there
is something there, then they want to know […]” Geneticist, Research cluster
manager
 Push to data sharing
 Patients want to share their data, either to help themselves or to help others who
may also have similar illnesses. However, existing consent mechanisms make that
difficult.
Individuals need to agree (consent to) how their data is going to be used…

14. TRANSPARENCY AND CONSENT
 Broad consent, foreseen for research purposes only in the GDPR
 Partnerships and transparent communication between researchers,
clinicians, patients and advocacy groups
 Realistic assessment of issues like anonymisation, given specificity of
some genetic conditions
 Dynamic consent mechanisms

15. RECODE PROJECT
 Policy issues in open access to research
data
 Five disciplinary case studies
 Four grand challenges
 Barriers, challenges and good practice
solutions
 CSA under science and society work
programme
 Grant agreement no. 321463
 Healthcare and bioengineering case
studies

16. OPENING AND SHARING DATA
 Policy push from the EC and other national governments towards data sharing
 Complex regulatory space for international projects
 “[W]e were collaborating, it was actually funded by the NIH, so US funded, And
[…] that meant that we had to comply with the…I think it’s called Health Insurance
Portability and Accountability Act (HIPAA). So quite a lot of effort was done by
someone associated with that project to familiarise themselves and make sure
that all the technologies were set up to protect the data in compliance with those
regulations.” (Laboratory manager, Bioengineering)
How to achieve both open access to research data and privacy / ethical principles

17. USE OF EXISTING RESOURCES
 Stakeholder collaboration
 Disciplinary societies
 Codes of conduct (foreseen by the GDPR)
 Cross-disciplinary procedural and technology interventions
 Institutional review boards
 Virtual machines

18. KEY MESSAGES
 Technology and socio-legal space both complex
 Privacy-by-design partnerships to achieve
solutions for specific issues
 Broad generalisations / checklists not possible
 Use existing tools and resources to achieve
compliance
 Providing individuals with access to and control
over their own data
 Privacy as an opportunity for innovation, not a
hurdle
Healthcare
experts
Social and
legal
experts
Technologists

19. QUESTIONS?
THANK YOU FOR YOUR ATTENTION
E-mail: rachel.finn@trilateralresearch.com
Website: http://trilateralresearch.co.uk
Twitter: @Trilateral_UK
Phone: +44 (0)207 559 3550
Address: Crown House
72 Hammersmith Road
W14 8TH, London
United Kingdom