The digitalisation of health services around the world has made patient health information more accessible for secondary uses. There is significant potential for the use of this information to improve services and health outcomes, and therefore the demand for access to this information is growing. Internationally, studies have shown widespread public support for secondary uses of health information as long as it is for “the greater good” or public benefit.[[1–3]] Trustworthiness, privacy and data security are key themes in public surveys, and individual consent is acknowledged as not always being necessary.[[1,4]] Concerns have centred on misuse of data and the potential for harm as a result, alongside potential commercial gain.[[4,5]] In general, there is a call for more transparency,[[6–9]] accountability to protect against data misuse[[6–7]] and public engagement and communication with consumers.[[1,4,10]]

In Aotearoa New Zealand, many of these issues are considered in the National Ethical Standards for Health and Disability Research and Quality Improvement,[[11]] including Māori data sovereignty.[[12]] Moving towards more insights from accessible health and social data to support not just health service delivery, but also policy development, research and service planning, is included in the Ministry of Health’s Digital Health Strategic Framework[[13]] and Hira, the national health information platform.[[14]]

Over the past six years Waitematā District Health Board (DHB) has been incrementally introducing new electronic health information systems across its two hospitals (Waitakere and North Shore). The Leapfrog Programme has intentionally been moving towards a more digital and mobile system that supports good clinical workflow and ensures that necessary information is available at the point of care to support good patient outcomes and experience.[[15]] One of the outcomes of these developments has been the large increase in the amount of electronic health information available for uses such as service review and quality improvement, future service planning and potentially for research. These initiatives are more easily conducted, and much more granular and useful, when the information can be electronically linked (across different IT solutions) and presented to services and clinicians in usable formats (eg, interrogatable dashboards and graphs).

What is not clear is how New Zealanders feel about the use of their health information beyond their immediate healthcare, or whether people are aware that service and population-level activities may be using their health information to inform improvements in health services and future service planning. Although one early study in the New Zealand primary care setting highlighted hesitancy in the secondary use of personal health information beyond individual care,[[16]] that study was conducted prior to the widespread digitalisation of health services. More recent work exploring perspectives on the use of individual data in New Zealand has mainly focused on the general public’s views outside the health service setting.[[17–19]]

Globally, machine-learning techniques and artificial-intelligence-derived algorithms are being developed based on large electronic health datasets that can predict health outcomes after treatment or procedures,[[20–21]] support clinical decision-making (eg, identify early signs of sepsis)[[22–24]] and identify abnormalities in images (eg, retinal screening).[[25–28]] There is growing interest to use patient health information for these purposes in New Zealand.[[29–31]] To determine whether such methods could be useful in New Zealand clinical practice, they must be tested on large electronic databases of New Zealanders’ health information. Such uses need to be weighed against the potential risks and the concerns of our population, such as those around the security and confidentiality of the information and the risk of perpetuating biases in historical practices due to the quality and incompleteness of existing data.

Understanding how patients want their own health information accessed and used is vital to ensure health services use health information in an appropriate and patient-informed manner. This project aims to investigate perspectives on the use of, and access to, individual healthcare information in people currently engaged with the Waitematā DHB hospital services collecting this information. Specific objectives include to investigate:

• perceptions on how health information is currently used by health services
• preferences on the use of health information, including level of comfort with health information being used in different ways
• concerns around use of health information for different purposes.

Method

A descriptive cross-sectional survey was conducted with current patients of Waitematā DHB health services. The description of the survey is described according to the CHERRIES checklist (Supplementary Material 1).[[32]]

Survey design

A study advisory group was established to help decide on the study procedures and survey questions. This group included representation from health service consumers as well as experts from a range of settings, including Waitematā DHB (clinicians, funding and planning, Māori Health, innovation), primary care and the University of Auckland. Following the drafting of the questions by the advisory group, the questions were pre-tested in an interview format with a small number of members of the target population. The English-language survey was then refined based on the pre-testing and finalised. The survey was designed in paper format and uploaded into an electronic format on the DHB platform before being loaded onto tablets for administration.

The survey covered the following:

• introduction and definitions
• perceptions on how health information is currently used by health services
• level of comfort with health information being used in different ways
• situations where permission is needed before individual health information is combined with others
• concerns about how health information used
• demographics.

The survey incorporated both closed and open-ended questions to gain more in-depth information and allow participants to elaborate further. The survey was then further pre-tested by researchers, members of the study advisory group and young people. The final survey was further translated into nine other common languages in the DHB population: te reo Māori, Samoan, Tongan, Simplified Chinese, Traditional Chinese, Tagalog, Hindi, Japanese and Korean.

The survey was identical for all participants (no randomised items), and participants were able to go back and change their responses before submission. Adaptive questioning was used where appropriate to minimise response burden and reduce the complexity of questions. There was a total of 12 questions over four pages in the final online survey. Individual questions were not mandatory.

Ethics approval

Ethical approval for this study was obtained from the New Zealand Health and Disability Ethics Committee (20/NTA/2). Research approval from Waitematā DHB was obtained.

Inclusion criteria

The intention of the survey was to be broadly representative of adult patients of the DHB (both admitted to hospital and those attending clinics). By recruiting participants at the time of an encounter with the DHB, we considered that patients would have some understanding of the nature of the health information collected and the uses of such information in their current context. Inclusion criteria were: (1) current user of Waitematā DHB inpatient and outpatient services, (2) 16 years old or over and (3) able to provide consent to participate. Exclusion criteria included being too unwell (as deemed by the patients’ healthcare professional), patients in the acute mental health unit and paediatric patients and their families.

Procedures

All patients who fit the inclusion criteria were eligible to participate. Potential participants were recruited from hospital wards, outpatient clinics and DHB health clinics in the community. Patients were invited to participate by DHB staff (eg, ward nurses, clinic reception staff) or DHB interns or volunteers and provided with a tablet to complete the survey on. Paper copies of the survey were also available upon request. Those attending outpatient appointments, including telehealth, were emailed the link to the survey after their appointment, through the standard DHB processes, to complete at their own convenience. If a patient wanted assistance to complete the survey, a trained team member was made available to assist them with completing it either in person in the clinic/ward or over the phone. Surveys completed by phone or on paper were entered into the online version of the survey by a member of the research team. Participants could choose to complete the survey in any of the ten languages, and a sign-language interpreter was available to assist patients with hearing difficulties if needed. Trained team members were available to support visually impaired patients to complete the survey.

Before commencing the survey, participants were provided with information about the study and details of who to contact if they had questions. They were also asked to provide consent before being given access to complete the survey. Participation was entirely voluntary and there was no incentive provided for participation.

Statistical analysis

Survey data were analysed and summarised using descriptive quantitative analyses. Chi-square tests were used to assess differences between groups. All statistical tests were two sided at a 5% significance level. Qualitative comments were analysed using a simple general inductive thematic approach to identify common themes and meanings from the data.[[33]] Only completed surveys, with correct unique IDs, were included in the analysis and no time limit was imposed. Cookies were not used to assign identifiers to each computer, and IP address information was not available. Therefore, checks for multiple entries from the same individual were performed manually by looking for identical survey responses in the qualitative data. Ethnically congruent researchers translated qualitative data from surveys completed in non-English languages before analysis. Ethnicity was coded as per New Zealand Ministry of Health’s protocol for the reporting of ethnicity data, with the “total response (overlapping)” output method used for reporting in this paper.[[34]]

Results

A total of 1,379 people completed the survey between 18 November and 23 December 2020. Two surveys were identified as duplicates and excluded. Therefore, the final sample size was 1,377. Due to the survey being available in different formats across multiple settings, the view and completion rates are unknown. Only 150 (10.9%) participants chose to complete the survey in paper form, with the remainder completing it online. A total of 52 participants (3.7%) completed the survey in languages other than English (Chinese=14, Korean=11, Hindi=10, Samoan=7, Tagalog=5, Japanese=3, Tongan=2)

Demographic information

The demographic breakdown of respondents can be seen in Table 1.

Table 1: Demographics of respondents (n=1,377). View Table 1.

The proportion of participants identifying as Māori and Pacific in the current study (12% and 8% respectively) was higher than in the estimated total Waitematā DHB population (9% and 7% respectively). In contrast, the proportion identifying as Asian (14%) was lower than in the estimated total Waitematā DHB population (26%). Although the survey sample included adults from ages 16 to 95 years, comparatively fewer participants were aged 45 years or younger than might be expected given the estimated proportion of the total Waitematā DHB population (51.4%).

Current use of health information

Participants were asked what they thought the health service was currently using their health information for in relation to their current (or most recent) visit. Many participants reported that they thought the DHB was using their health information in the ways presented (range: 67–92%) (Table 2). A total of 53% (n=728) participants responded “Yes” to all items. When referring to scenarios relating to combining health information with others (Scenarios E and F), over 20% of participants reported that they were unsure whether the health service was already doing this.

Table 2: Current use of health information (n=1,377).

Comfort with use of health information

Next, participants were asked to rate their level of comfort with the DHB using their health information across the different scenarios on a Likert scale from 1 (very uncomfortable) to 5 (very comfortable). Results can be seen in Table 3.

Table 3: Rating of comfort for use of health information (n=1,377).

Over two-thirds (69%; n=953) of participants were comfortable across all items presented, and only 3% (n=43) were uncomfortable across all items.

The proportion of Māori participants who were uncomfortable with their information being used to make decisions about their healthcare in the future was significantly lower than the proportion of non-Māori who were uncomfortable with this: χ² (2, N=1,377) = 7.73, p=0.021. Similarly, the proportion of Māori participants who were comfortable with Scenario F (their information being used to investigate how better to understand our population and their needs) was significantly higher than the proportion of non-Māori who were comfortable with this: χ² (2,N=1,377) = 10.33, p=0.006.

Five percent of participants (n=68) were uncomfortable (ratings = 1 or 2) across both items relating to the combining of their health information with the information of others. The proportion of Māori participants who were uncomfortable with the combining of their health information (1.8%) was significantly lower than the proportion of non-Māori who were uncomfortable (5.4%): X[[2]] (1, N=1,377) = 3.83, p=0.050. Furthermore, 3% of participants (n=45) were very uncomfortable (ratings = 1) with the combining of their health information. The proportion of Māori participants who were very uncomfortable with the combining of their health information (0.6%) was significantly lower than the proportion of non-Māori who were very uncomfortable (3.6%): X[[2]] (1, N=1,377) = 4.16, p=0.041.

A total of 285 participants provided comments on their level of comfort, with 129 (45%) of these responses primarily reiterating that they were comfortable and happy with data being shared in the ways outlined.

Seven key themes in the responses were identified. The most common theme was that participants were happy with their data being used in ways that would help other people.

“Totally comfortable with the ways health information is used if it is used to benefit myself or someone in a similar situation as myself.” – Female, 55–64 years, Pacific

The second theme was that participants’ level of comfort was linked to assurances that their privacy was maintained, that data were shared confidentially and that data shared beyond individual care were de-identified.

“As long as personal information is kept private and not shared in any form so identity is given then sharing info is fine. It needs to be stored in a manner where it can’t be hacked or accessed by external sources when shared.” – Female, 35–44 years, Māori

The next theme was that participants wanted their health information to be used for the purpose it was intended for and that it remained in the health system (eg, was not shared with commercial companies (including insurance companies) or sold for advertising).

“As long as personal info is used only by legitimate parties—no buying my data for advertising.” – Female, 25–34 years, NZ European

“I wouldn't like my information to go out to other corporate bodies. I wouldn’t like my information getting out and being used in the wrong way.” – Male, 65–74 years, NZ European

Another theme was that health information needs to be up to date and correct and that patients should have access to it and the ability to correct it.

“As long as my confidentiality is protected and not shared to insurance or other marginal stakeholders without my permission I am fine. However, I should be able to access all my information and correct any misinformation.” – Female, 45–54 years, NZ European

“It would be nice to have access to the same information being shared with others.” – Male, 55–64 years, NZ European

The next theme was that there was a lack of knowledge of how health information was used and that there needed to be improved communication about how it is being used and shared.

“I have never been advised by any health professionals of how my information is being used or why!!” – Female, 65–74 years, Māori

“It is not possible to ‘feel comfortable’ when I do not know now how my health information is used, nor where I can find out” – Female, 65–74 years, NZ European

A small group of participants commented that, for them to be comfortable, they needed to be asked permission before their data were shared or used outside their immediate care.

“I’d like to know before my information is shared so that I can give consent. I’m happy for my information to be used once I’ve moved out of the district or died if the data didn't include identifiable details (name, DOB, address).” – Female, 35–44 years, NZ European

Finally, a small group of participants reported feeling uncomfortable with the sharing of their health information due to negative experiences and/or a lack of trust in the DHB.

“Due to serious inaccuracies in all of my recent clinic letters this year after accessing the [service name] at [hospital name] I am not comfortable with this information to be used to make decisions on my care and/or being shared with say my GP due to these inaccuracies.” – Female, 35–44 years, NZ European

Permission for the combining of health information

Participants were asked whether there were any situations where they would want the DHB to get their permission before combining their data with other people’s to understand the health of the wider population better. A total of 978 (71%) answered this question. The majority (758; 78%) responded that permission was not needed before health information is combined with others if:

1. their privacy is maintained (data are anonymous and no personal/identifying information is shared)
2. it is done so with the correct approvals
3. privacy/security of the data is maintained
4. it is done for the right reason (eg, to benefit others)

A total of 130 (13%) participants stated that permission must be sought in some situations. The specific situations described included:

1. when health information was being sent outside the medical profession or made public (eg, police, insurance, commercial companies, big tech/pharma)
2. when the health information was of a sensitive nature (eg, drug use, sexual history, domestic violence, gynaecology and women’s health, rape/sexual assault, hereditary conditions, terminal illness, mental health, genetic/DNA information).

There were only 31 responses that indicated that participants wanted to be asked permission every time their health information was combined with others. A remaining 26 responses indicated that they were unsure, and 33 were unidentifiable or non-specific.

Twenty-three responses highlighted the importance of people being informed about when their data will be (has been) used irrespective of whether permission was required/wanted. Responses also stated that results/findings from sharing health information should be communicated to patients or made public.

Concerns with the use of health information

Finally, participants were asked whether they had any further concerns about how the DHB looks after or uses their health information. Of the 956 that answered this question, 699 (73%) reported they had no concerns. From the 257 remaining comments, there were five main areas of concern identified:

1. concerns about cybersecurity and how data is stored
2. concerns about privacy and confidentiality of health information and that this needs to be assured to patients if health information is to be shared
3. concerns about incorrect information and that health information needs to be up to date and that patients have a way to correct their information if there are inaccuracies
4. that they should have access to all of their health information, including the health information that is being shared
5. that there is a lack of information being provided to patients on how health information is used and that the DHB needs to inform people how their data are used and stored.

Discussion

This study found that most participants (current users of hospital and clinic services in Waitematā DHB) are comfortable with their health information being used by the health service (without additional consent) if:

• correct approvals are obtained
• privacy and security of the individual data and dataset is maintained
• the intention of the use of the health information is to benefit others.

Participants specified that there would be a need to seek individual permission for combining individual health information with others when data are of a sensitive nature or to be used outside the health sector (eg, shared with commercial organisations). Otherwise, the majority of patients in this study did not think that they needed to provide consent before their health information was combined with others. This is significant for, say, the development of artificial intelligence algorithms, where the completeness of datasets is essential to minimise bias.[[35]]

However, it is also clear from the responses that there is a need for more communication on how information is used, when it is used and the outcomes of its use. This includes communication about existing pathways for the use of health data without consent (ie, secondary use under the specific exemptions in the Privacy Act 2020, the Health Information Privacy Code, Section 22 of the Health Act 1956 for offer of service and the Health and Disability Ethics Committees’ waiver approvals for research). Many participants were unsure about what their health information is being used for, and if it were to be used for other purposes, they would want this to be transparent and fed back if possible.

The findings from this survey highlight that assurances around the security and privacy of health information are paramount for patients comfort in the use of their health information, which mirrors international research in this area.[[1,3,36]] Patients articulated concerns about cybersecurity, data storage, privacy and confidentiality of health information. It is important to note that this study was undertaken before the data breach at Waikato DHB,[[37]] which has resulted in a greater commitment to cybersecurity by the New Zealand health sector. It has also potentially resulted in the public having a greater awareness of the personal implications of cybersecurity threats. The health system will need to ensure ongoing communication to the public around the protective mechanisms for ensuring individuals’ data are safe and that risks are minimised.

Another important message is that people want access to their own health information and the ability to correct any inaccuracies in the information. The Privacy Act 2020 and Health Information Privacy Code stipulate the right for individuals to access and request corrections to their health information stored by a health service.[[38]] Similar to our sample, research in a primary care setting discovered a strong interest in having access to personal health information.[[39]] Unlike primary care, where patient-portal use is now widespread, in secondary care, where there is not one single electronic health record, personal access to health information is difficult. With information currently held in multiple systems, the ability to correct patients’ data in all systems is also more challenging. Several countries have a longer history of providing patient-accessible electronic health records than New Zealand.[[40]] The benefits of patient access include the opportunity to empower patients, inform patients about their health and involve patients in their own care.[[41,42]] However, some concerns remain around access barriers, including digital health literacy and use by those most in need, and clinician concerns around negative impacts on the patient–clinician relationship. Although much has been made of the ability for patients to correct information in their records, there is little published on the actual use and impact of patient requested amendments.[[43]]

This is the first study of its kind in a New Zealand hospital setting. The findings align with previous research, most of which has focused on the general public’s views and the use of health information for research purposes. International literature has documented widespread public support for using health data for research under similar conditions to those we found, including the importance of its use being for the greater good and that privacy must be prioritised.[[2,3]] In contrast to previous work that has shown greater concern by Māori over the use of their data,[[17]] this study showed Māori were more comfortable with their data being combined with the health information of others. This is a potentially important finding that could inform national developments around Māori data sovereignty and health-data governance but will need to be further explored in more in-depth investigations. The concern in our sample for health information being shared with commercial companies is also consistent with previous work,[[5]] and the complexities associated with this warrant further investigation.

The generalisability of the findings from this cohort to the entire country’s population is a potential limitation of this study. Although there was diversity in the demographics of the sample, it is possible that those who have a strong viewpoint (either positive or negative) were more likely to participate, or that, despite our efforts with translations and approaches to particular groups (including Māori, Pacific and Asian facilitators), people with greater distrust of the system, English as a second language or low health or digital literacy may have chosen not to participate. Despite this, the advisory group’s perspective is that this was a relatively large and diverse sample from which to start informing further discussion and research.

A further limitation of the current study is the lack of information about the health services patients received at the time of participation. Therefore, we cannot assess whether there was a correlation between services and views on health information use. There is the potential that recruiting patients when they were receiving health services may have resulted in more favourable results—that is, them answering the questions in the way that they perceived their health providers would prefer. To encourage patients to be honest and open in their responses to the survey, the survey was anonymous and participants could complete it after their encounter with the health service.

This initial survey has led to several further planned initiatives for the DHB and research. Findings are being presented around the DHB to continue conversations about improving communication with patients on what is currently happening with their health information, and to provide assurances around security measures, confidentiality of health information, processes for auditing access and processes for correcting health information. The Northern Region (Waitematā, Auckland, Counties Manukau and Northland DHBs) is enhancing regional data governance, to include consumers and Māori data sovereignty principles, and exploring consumers’ access to their hospital-held health information.

The next phase of this research is to further explore the issues raised through in-depth interviews. We will talk with patients about potential modalities and messages for communication. We will work through possible future scenarios for the use of health information to determine how and when further communication or consent may be required. This will include the development of machine learning and artificial intelligence algorithms for New Zealand, based on our population data, and some of the intrinsic issues, such as the use of health information after death.

Importantly, major structural changes are planned for the New Zealand health system over the coming months. This will provide an opportunity to raise the public discussion around ownership of our health information within one national health system, and what we all want this to look like in the future.

Supplementary Material

Supplementary Material 1: Checklist for Reporting Results of Internet E-Surveys (CHERRIES). View Supplementary Material 1.