Blurred lines: when should private health information become public?

Where does our health data go? 

For decades, public health departments around the country have been compiling data sets about many interactions we have with the health system, including pharmaceutical needs, mental health support, hospital admissions and treatments. Most people are unaware of their role in building up the health picture of Australia that is used by researchers, policy makers and private companies.

For the past six years, the University of Wollongong (UOW) has been working closely with the NSW Department of Health, in analysing the data collected through various channels through the Centre for Health Research Illawarra Shoalhaven Population (CHRISP).  

Professor Kathy Eagar from UOW’s Faculty of Law has been involved with CHRISP since its foundation in 2016 in large part due to her position as Director of the Australian Health Services Research Institute.

CHRISP provides a sophisticated information platform, known as the Illawarra Health Information Platform (IHIP) to connect data for health and medical research in the Illawarra.  

These data sets are available for use in ethically approved research projects which aim to improve the health of the population of the Illawarra and beyond.  

“We have, in the database, health data on Illawarra residents for the past 30 years, so we can conduct longitudinal research,” Professor Eagar says.

“We can do things such as follow up for the next 20 years, people who have had COVID and track them for any health problems they may have into the future. There’s not much known about COVID, and with this information we can look at how people recover.”

CHRISP has published several papers based on the data collected in the Illawarra Shoalhaven Local Health District (ISLHD), including a study on the 10-year use of the Emergency Departments in the district.

“CHRISP allows us to do things like look at outcomes of [people’s health] 10 years after they have had a stroke. There is nowhere else in Australia that can do it at the level we do it here.”

Striking the balance of protection and privacy

While it’s important to understand our population’s health on a large scale, the collection and dissemination of this data has come under scrutiny in recent years.

Professor Annette Braunack-Mayer, Head of the UOW’s School of Health and Society, says everyday Australians are in regular engagement with the health system, and the data collected from these is primarily used to take care of us.

“The principal role [of this data] is as a record of the health services we receive. Its primary purpose is to ensure that the health care we receive is appropriate to us,” she says.

Professor Braunack-Mayer says the data sets are collated and can be combined from individual records about people, such when they were in contact with their GP, admitted to hospital or the pharmaceuticals they accessed through Pharmaceuticals Benefits Scheme.

“All of that information can be, (and is) collated and is available to researchers in a variety of ways, as well as to government planners and health system staff for research, to plan new services, or to look at the quality of services currently being delivered,” she says. 

“It’s a good thing to be able to do, because it can provide a whole of population record of what is going on. Most other ways of collating information through other systems don’t give a whole of population picture, and the minute you don’t have that, you are subject to biases.”

The issue of consent and privacy in relation to data collected is complex, says Professor Braunack-Mayer.

“People have an interest in their data: that includes knowing how it’s used, by whom and for what purposes. They also want their privacy protected, and to be sure that they will not be harmed by others having access to that information,” she says.

Commonwealth privacy laws put rigorous protections around this sort of information, says Professor Braunack-Mayer, and individual states also have privacy legislation – but not all states. 

“If you are trying to get consent from hundreds of thousands of people to use their health data for purposes other than their health care, that is practically difficult in some instances.  

“When you only use active consent models to use health administration data for these other purposes, the data sets do not represent whole populations.”

Research shows people are usually comfortable with the use of their health data when identifiers such as names, addresses and dates of birth have been removed. Professor Braunack-Mayer says people are generally okay if data is collected for public benefit purposes such as improving health services, solving health problems, or improving quality of care. 

However, there are still concerns that sharing data can lead to harm to individuals or whole groups due to a violation of privacy.

“These are legitimate and serious things that we ought to be concerned about,” she says.

Professor Braunack-Mayer says although privacy legislation is designed to get the balance right, even when information is de-identified, people may work out who someone is. 

She says some reporting may identify groups and portray them negatively. In addition to privacy laws, human research ethics committees have extra requirements.

“These committees are always watching for potential harms [that may happen] to groups and individuals when dealing with big data sets and we will continually ask questions around this. In any democratic society there has to be a balance and even in the best of systems it isn’t always perfect,” Professor Braunack-Mayer says.

“I think people have become more aware of this. Privacy and consent are really complex areas where we are always balancing benefits against risk, and they do play out differently in different parts of community.”

She says one of the key concerns is the use of public health data by private entities.

“In research we completed two years ago, we found that just over half of people were willing to share de-identified administration data for purposes of research, but they had real concerns and put conditions on sharing with the private sector,” Professor Braunack-Mayer says.

Professor Annette Braunack-Mayer, Associate Professor Chris Degeling, Professor Kathy Eagar and Dr Yves Saint James Aquino

How Covid changed the conversation 

Associate Professor Chris Degeling from the Australian Centre for Health Engagement, Evidence and Values (ACHEEV) at the UOW School of Health and Society is an expert in the ethics of infectious disease control. He says there has been a major shift in the collection of health data for infectious diseases in the past few years, accelerated by the pandemic. 

Previously, key public health data was collected through the surveillance and reporting of notifiable diseases like tuberculosis or measles. However, with the arrival of COVID, surveillance systems are now routinely using pathogenomics or whole genome sequencing.

“What is happening now is the sequencing of a virus to understand the nature of the virus itself and [authorities] can potentially tell who you caught it from,” Associate Professor Degeling says.

“With that comes lots of privacy implications. Having that knowledge available to people in a health context is fine but, with data security knowledge, it can be compromised. Without adequate protections there can be problems.”

 This was seen during the height of the pandemic when information surrounding the activities of a COVID-positive Uber driver was made public, leading to media and public furore. Associate Professor Degeling says the other big shift in public health surveillance is the availability of location tracking.

“This hasn’t been used extensively without permission,” he says.

“The COVID SAFE app at the beginning of the pandemic was a flop because of the insistency of privacy information, so it was using only proximity tracking, not location tracking. There was a lot of concern about the beginning of global government, about how once you let public health authorities track people, who else will start using this sort of technology. Policy makers were more concerned with the interconnectivity of cases, but the public didn’t want anyone knowing who caught what from whom.”

Using publicly available social media, Opal card and shopping data, public health authorities can already tell a lot more about people than they may be aware, Associate Professor Degeling says, including what people do, what they eat, or where they shop.

“The public is not so worried about that – they wanted to know that their data would be used for the public good,” he says.  

“There are ways in which the aggregation of that data can be of value to other corporations and people, and data breaches in Australia tend to come from areas that are not so sensitive. Within the communicable disease sector, the people that have access to information is small and limited and it is usually with big systems that you get issues. But if you don’t have surveillance, it is likely that resources don’t get allocated to respond to outbreaks, areas of high incidence, or to find solutions to unexplained things that are happening.”

The role of AI 

Dr Yves Saint James Aquino is a research fellow with ACHEEV, currently working on his project, The Algorithm Will See You Now: Ethical, Legal and Social Implications of Adopting Machine Learning Systems for Diagnosis and Screening.

The study is potentially relevant to ethical issues in public health data surveillance.

The project analyses implications of diagnosis by artificial intelligence and its consequences on public health data surveillance. In his preliminary findings, Dr Aquino has found there are gaps in the data collected. 

 Working with data contributed from countries like the US and UK, Dr Aquino has found that the algorithms used to collate data are often limited to specific groups, and do not reflect large populations.

“A lot of patient data sets that these algorithms use are based on local populations and what we are asking is if these can be applied across the board,” he says. 

 “Although we don’t have the findings yet, we are surmising that we have different kinds of populations [that do not fit into the algorithms]. For example, in Australia we have the Aboriginal and Torres Strait Islander population which may not be included in the data sets we are receiving because they may not have access to these types of health care services.

“The US data is skewed towards white Americans, so it is not completely accurate with other areas. It means the public surveillance of health data is not quite accurate in terms of different demographics – and that occurs in hospital settings as well.

For example, for outpatient resources the data should tell health officials who should be transferred or admitted, which hospitals should receive support, but a lot of communities in the lower socio-economic bracket don’t get funding because the outcomes were not there, mainly because a lot of these groups have been marginalised and miss out on health care and health promotions,” says Dr Aquino.

“If policy makers and public health officials were just looking at the data to see where there were good clinical outcomes, it would be very inequitable.”