IntroductionDigitalization in health care holds great potential for data-driven research and scientific progress for the benefit of patients and the general public. This includes, for example, automated systems for disease prediction [1-3], as well as innovative approaches that enhance data exchange between practitioners and enable better patient monitoring [4]. However, the use of data for purposes outside the specific treatment context (ie, secondary use) is hindered by several aspects. While an increasing amount of data is being digitally recorded during treatment, the common notion of data silos, where data is in principle readily accessible for research purposes, is too simplistic. This is because many processes in routine clinical care are not yet sufficiently digitized, and many analog, paper-based processes remain [5,6]. Furthermore, even digitized data is often not sufficiently preprocessed to be directly accessible for research purposes. They are documented using different software systems that lack interoperability and are stored in a variety of file formats [5-7]. In clinical practice, for example, questionnaires are still frequently handed out in paper form. Digitizing these questionnaires can simply mean that they are scanned and saved in PDF format. A major challenge in this context is the fact that electronic health records, while principally useful for research, are primarily intended to document treatment and reimbursement. Separate measures are necessary to render health record data fit for purpose regarding research and to check data quality [8,9].
Legal restrictions are another major obstacle. In the European Union, the introduction of the General Data Protection Regulation (GDPR) has been celebrated as a milestone for the protection of data subjects’ rights but has also been criticized for creating obstacles to research [10-13]. For example, it has been criticized that the GDPR sets higher standards for anonymization than was previously the case in many European Union member states [12,14]. Recital 26 of the GDPR states that pseudonymized data “should be considered to be information on an identifiable natural person.” This has been interpreted to mean that, in principle, all key-coded data must be considered and treated as identifiable personal data, even if the researcher holding the data is not in possession of the key to re-identify it [14]. Therefore, a legal basis is required for the processing of this data, which generally requires greater efforts from researchers and their infrastructure in terms of data protection.
Article 9 of the GDPR outright prohibits the processing of sensitive personal data, which includes health-related data. An exception is made in Article 9 (2) (a) if the patient (data subject) has given explicit consent to the processing of the personal data. Another exception refers directly to scientific research. Under Article 9 (2) (j), processing of sensitive data is allowed for research purposes if appropriate safeguards are in place and a lawful basis for the processing of data is given in the Union or the relevant member state in accordance with Article 6 [11,15].
With regard to consent, there are different consent models to choose from, ranging from broad consent (ie, consent for future studies whose exact research questions and specifications are unknown) to specific consent for a particular study. Hybrid models between broad and specific consent have been developed that allow participants to specify the terms of use without having to give consent for each individual study (tiered consent; for a general overview on different consent models, see [16]). However, in the area of secondary use of medical data, it may be impractical to obtain explicit consent (eg, due to the need to reconsent for data already generated), and it has been suggested that it would often be useful to consider other possible legal bases (eg, [11,14]).
The secondary use of health data must, however, also comply with other legal and ethical principles that are not fully taken into account in the GDPR [14]. While from the perspective of the GDPR, obtaining active consent might be replaced by referring to the special purpose of scientific research (if the required legal basis in the relevant member state exists, as mentioned above), consent is still a central ethical standard in medical research. Of particular interest in the field of medical research are the ethical principles formulated in the Declaration of Helsinki (DOH) [17] and Taipei (DOT) [18] of the World Medical Association. The DOH formulates general ethical principles for medical research involving human subjects, while the DOT focuses specifically on principles for databases containing health data. Both statements emphasize the importance of explicit consent for the secondary use of health data. The DOH states that “physicians or other qualified individuals must obtain free and informed consent from research participants for the collection, processing, storage, and foreseeable secondary use of biological material and identifiable or re-identifiable data” [17]. The DOT sets out further rules, such as the right to receive information about the use of the data and the right to change or withdraw consent at any time [18]. Indeed, these principles are in line with the spirit of the GDPR, which formulates and generally strengthens key data subject rights centered on purpose limitation, sovereignty, and transparency, including the right to be informed about processing and the rights to erasure and restriction of processing (see Articles 5 and 6) [10,15,19].
In addition to these basic requirements for the secondary use of research data, it should not be neglected that the secondary use of medical and research data affects many different interests, which must be carefully balanced in order to achieve the acceptance of all stakeholders. Besides the data subject and data users, these stakeholders crucially include the data-generating side, which is typically a clinic or practitioner who cannot waive their care obligations regarding the patient, including the use of sensitive data. With respect to the data subjects, it has been shown that patients are generally very willing to allow access to their health data for public research purposes [20-24]. Nevertheless, many patients are concerned about a lack of privacy, transparency, and data security [25,26]. To address these concerns, a sufficient level of trust is required [27,28]. In this regard, appropriate patient involvement and communication appears to be crucial [25,26]. Adequate information about the secondary use of health data should be provided in an understandable and, at best, personalized form [26], including information about specific projects and findings related to data use [28]. Although there are large interindividual differences in the level of involvement favored by patients, many studies show that a large number of patients prefer a high level of control over their health data [28-32].
As noted above, data users are another important stakeholder group. There is a widespread view that considers health data to be the private property of patients. However, this approach falls short. Concepts of ownership cannot easily be applied to data, and health data can be considered as coconstructed, involving both the data subject and the clinicians and researchers with the generating institution, who contribute their efforts in collecting, classifying, interpreting, processing, and storing the data [33-35]. Because of this crucial contribution and the care obligations of the generating institutions noted above, the needs and constraints of institutions and researchers involved in the generation of health data must be equally considered. Correspondingly, the willingness of institutions and researchers to share health data without appropriate incentives, as well as trust and legal security, is often low [36,37]. At the same time, data users formulate their own requirements for the composition of data sets, utilization options, and acceptable expenditures.
The secondary use of health data, therefore, takes place in a complex environment: legal norms (relating to, but not limited to, data protection regulation), ethical standards, and the interests and needs of different stakeholder groups must be taken into account and balanced. At the same time, a progressive increase in the amount of data available can be expected, which necessitates time- and cost-efficient processes to make use of this data. While initiatives such as the envisaged European Health Data Space (EHDS), the centralized Finnish health data registries, and the German Medizininformatikinitiative (medical informatics initiative), among others, prove that the secondary use of health data is on the political and societal agenda, overall, the development is still in its infancy and the great potential that lies in the secondary use of data is currently not being realized. As a possible solution to the problems outlined above, the possibility of data trust models is being discussed (eg, [38-41]). In a report for the United Kingdom government by Hall and Pesenti [41] on the future use of artificial intelligence, data trusts are defined in an overarching manner as “a set of relationships underpinned by a repeatable framework, compliant with parties’ obligations, to share data in a fair, safe and equitable way” (p. 46). Nevertheless, as comprehensively summarized by Lauf et al [42], there is currently no universally accepted definition of a data trust. Instead, based on an analysis of applications across various domains, four archetypes of data trusts have been proposed, each with distinct characteristics: data brokerage trustees, data processing trustees, data aggregation trustees, and data custody trustees [42]. In view of the strict data protection requirements associated with the use of health data, existing studies in the medical domain have examined technical features designed to mitigate potential risks. For example, based on a security-by-design approach, the modular separation of demographic and medical data has been proposed to improve data protection within a data trust [43]. In the context of the German medical informatics initiative, the secondary use of medical data is being facilitated by the so-called data integration centers at several university hospitals. Access to the data is controlled by use and access committees, which manually review and evaluate data requests before granting access [44,45]. However, beyond these technical and organizational considerations, the successful implementation of a data trust model also depends on stakeholder acceptance and its effective integration into existing clinical workflows.
The aim of the present study was to design a comprehensive legally and ethically sound data trust model from the early conceptualization, through the technical implementation of a prototype system, to its evaluation from the perspectives of various stakeholders. In this study, a data trust model was conceptualized as a neutral entity that facilitates data use while accounting for the interests of all involved stakeholders. Importantly, the data trust—by our definition—does not make decisions on behalf of others. At its core, the system includes a matching service that automatically compares the rules and requirements specified by each stakeholder. When these align, access is granted, without the system itself exercising intentionality. Development prioritized preserving data subjects’ sovereignty while ensuring that system processes remain scalable.
The evaluation was preregistered in a clinical trials registry (German Clinical Trials Registry DRKS00031093). A particular focus was on the use case of sleep research. Sleep research seemed particularly suitable as it is a highly relevant field that warrants further intensified research efforts due to the high prevalence and disease burden of sleep disorders. For example, up to 10% of the general population experiences an insomnia disorder [46] and between 9% and 38% (dependent on age group and methodological approach used) from obstructive sleep apnea [47]. In addition, the field of sleep research is particularly suitable for data-based approaches, as investigating sleep generates a large amount of data, such as sensor data (from the conventionally used polysomnography to modern lifestyle devices such as smartwatches) and subjective data [48]. Besides that, this field is especially sensitive because of its links to psychiatry and is underrepresented in current data-sharing initiatives.
DiscussionPrincipal FindingsMaking health data accessible for secondary research use is a major challenge in the upcoming decades for both health care institutions and research organizations. In addition to the increasing opportunities created by digitalization and the high willingness of data subjects to make health data available, as the present study and other works show [20-23], the potential is not being realized for a number of reasons. These include changing legal norms, inadequate preprocessing of data, and the existence of a large number of different, sometimes conflicting interests of the various stakeholders.
The SouveMed ConceptData trust models are a promising solution to address this complexity. However, apart from a few small, heterogeneous initiatives, there are hardly any fully developed approaches in this regard in the field of medical research. We have therefore developed an ethically sound framework for the secondary use of medical data that is applied to the use case of sleep research. The model includes secure onboarding of data subjects and digital use of information, consent, and feedback channels; a digital interface for data users for onboarding, defining research aims and categorization, querying available data set numbers, and, finally, either downloading data or having algorithms run on it; and, crucially, a digital data trust that matches the descriptions and preconditions of all stakeholders (data subject, data user, and institution) using digital contract representations. Data access is granted in our model only when all requirements and conditions set forth by the various stakeholders are satisfied. The explicit focus of our data trust model is on data subject sovereignty and participation, as data subject involvement and appropriate communication are critical to build trust [25,26] and were central to many data subjects in our needs analysis. Accordingly, a majority of data subjects emphasized the importance of a personal contact person in the consent process to be able to ask individual questions. In addition, transparency about data use was mentioned as an important prerequisite for the willingness to provide data, and there was a clear preference for a consent model that allows for further refinement of the conditions under which data sharing is permitted. Based on these results, the SouveMed model provides the opportunity for data subjects to give real informed consent by presenting them with comprehensible information material and encouraging them to ask individualized questions in the information process. By separating information and consent in terms of time and space, the ethically questionable linking of health care and the provision of informed consent is avoided. Participants also have the opportunity to receive information about study projects that use their data. The combination of information in face-to-face contact and via a digital platform enables both personalized information for data subjects and patient sovereignty over the amount of involvement, both key requirements demanded of a system for secondary use of health data (eg, [23,26,31]).
SouveMed uses an opt-in solution where data subjects explicitly decide whether or not they wish to share data. This is in line with generally recognized ethical standards for medical research [18,56]. In addition, the present finding regarding the usefulness of tiered consent provided in an electronic format is in line with previous studies investigating different consent models and modes of patient involvement (eg, [30,57-59]). In our approach, the use of a digital interface for consent management also allows data subjects to easily withdraw their consent, which fulfills the requirement in Article 7 of the GDPR that withdrawal of consent must be as easy as giving consent [15].
Evaluation of the SouveMed ConceptThe present evaluation study showed a high degree of trust in our concept in both the first and second evaluations, as measured by the HCTS. It also showed a high level of satisfaction with our communication process, also in the first and second evaluations. Thus, the SouveMed system has proven to be effective in meeting data subjects’ main concerns related to the secondary use of health data. The results of the usability assessment using the uMARS showed very good usability for both evaluations, with a slight increase in usability in the second evaluation. Good usability is key to increasing and maintaining data subjects’ motivation to actively participate in SouveMed and is probably also related to trust [60].
From the perspective of data users and institutions, they may benefit from easy access to raw data and the ability to run algorithms on data in a secure environment. Both our requirements analysis and our evaluation study have shown that there is an urgent need for systems that enable secondary use of research data. The data on uMARS from our evaluation study showed excellent usability in all three subscales (functionality, aesthetics, and subjective quality) from the perspective of data users and institutions, which improved even further in the second evaluation. In this evaluation, all data users surveyed stated that the SouveMed system offers all the functionalities they desire from such a system. Except for a significant increase in the perceived functionality of the data user system, no statistically significant differences were observed between the first and second evaluations. This result is likely due to the limited sample size and the already high ratings in the first evaluation, which constrained the potential for further measurable improvements.
Overall, these results indicate that the SouveMed data trust effectively realizes the needs and requirements identified during the needs analysis and literature review.
Future PerspectivesVarious legislative initiatives in the European Union (eg, EHDS [61]) and in Germany (eg, Forschungsdatengesetz [62] and Gesundheitsdatennutzungsgesetz [63]) are currently aimed at simplifying the secondary use of health data. This is to be welcomed in principle, as it contributes to the development of a viable research landscape and addresses a major challenge in medical research. Nevertheless, the solutions must be preceded by an analysis of the underlying problems and address them precisely. The results of this and numerous other studies indicate that the secondary use of health data is not hindered by a lack of willingness on the part of data subjects to provide data. It therefore does not seem necessary to pass over data subjects by allowing the use of health data without consent. There is also no lack of infrastructure for centralized data storage, which entails far more risks but only minimal benefits [64]. What is notably absent is a clear workflow for the secondary use of health data that can be easily integrated into routine clinical care, that takes data subjects’ needs into account and thereby gains their long-term acceptance, and that relieves researchers of complex legal considerations and negotiations.
In the European Union, a standardized legal framework has been established through the EHDS, which permits an opt-out mechanism for the secondary use of health data [61]. According to Article 54, this should be implemented via “…an easily understandable and accessible user-friendly mechanism to exercise that right to opt out…” Article 54 further emphasizes that it is “…imperative to provide natural persons with sufficient and complete information regarding their right to opt out…” Nevertheless, how this will be implemented in practice in the individual member states is still largely unclear. Although an opt-in solution is preferred in our project, the SouveMed concept could serve as a blueprint for a system that enables data subjects to receive information about the secondary use of their health data and to express their preferences, including a possible opt-out.
Sleep research was selected as a use case because large volumes of data are typically generated in this field (eg, through polysomnography). In this context, it is important to consider that the likelihood of reidentifying individuals grows with the amount of data collected, making true anonymization increasingly difficult. Similar challenges are expected in other areas of research due to expanding data volumes. Therefore, we argue that the active involvement of data subjects and other stakeholders is becoming ever more critical.
A key advantage of SouveMed is also the algorithmic trust component. Future data exchange will increasingly have to rely on algorithmic decisions to manage large amounts of requests in a time- and cost-efficient manner. Data use and access committees would oversee the rules of data use rather than each single application.
LimitationsThere are some limitations to this study. First, the sample size was small and therefore probably not sufficiently representative. Therefore, surveys of larger patient and other stakeholder groups that include other diagnostic entities are needed. In addition, no real implementation of the SouveMed system was carried out as there were insufficient resources to achieve this in the current project. Although we tried to keep the framework of the evaluation as natural as possible, everyone involved was aware that it was not about real data sharing, which could have influenced the results.
Many aspects of our model were developed not only conceptually but also technically (see [54,55]). Nevertheless, further studies focusing on the technical implementation of digital contract representations are needed, as this is a key element of an effectively functioning matching algorithm that was not fully elaborated technically in the SouveMed project.