A guide to sharing open healthcare data under the General Data Protection Regulation

Abstract

Sharing healthcare data is increasingly essential for developing data-driven improvements in patient care at the Intensive Care Unit (ICU). However, it is also very challenging under the strict privacy legislation of the European Union (EU). Therefore, we explored four successful open ICU healthcare databases to determine how open healthcare data can be shared appropriately in the EU. A questionnaire was constructed based on the Delphi method. Then, follow-up questions were discussed with experts from the four databases. These experts encountered similar challenges and regarded ethical and legal aspects to be the most challenging. Based on the approaches of the databases, expert opinion, and literature research, we outline four distinct approaches to openly sharing healthcare data, each with varying implications regarding data security, ease of use, sustainability, and implementability. Ultimately, we formulate seven recommendations for sharing open healthcare data to guide future initiatives in sharing open healthcare data to improve patient care and advance healthcare.

Fig. 1

Legal bases for processing ‘special category’ personal data relevant to observational retrospective health research purposes from GDPR Article 9 (2). Implementation of the legal bases can differ between European countries. More elaborate descriptions of the legal bases and their implementations can be found in the Supplementary section on Pseudonymisation – GDPR applicable.

Fig. 2

Diagram illustrating the four approaches to publishing an open ICU database. Based on the four successful open ICU databases and rules ordained in the GDPR, we present four possible approaches for openly sharing sensitive healthcare data. These are not the only possible options for sharing healthcare data, but the approaches we believe to be most common or appropriate. The arrows indicate different choices to be made and what combinations of those are possible, each ending up in a different terminal node A, B, C, or D; the four approaches for publishing an open ICU database. The first node depicts whether the data can be processed locally or in the cloud, and the second node shows whether data was shared under the legal basis of explicit consent or if the data was shared on other GDPR grounds. The third node states which form of de-identification is used. The lower section shows four sets of bar charts: Security, Ease of use, Sustainability, and Implementability. For each set, all four options (A, B, C and D) are rated discretely for that topic from 1 to 5 by the authors. The ratings are relative, and the scale is explained in the legend at the bottom of the figure. Ratings are subjective; therefore, interpretations can differ. This figure shows that approach A allows the user to download pseudonymised data of patients who provided consent. Approach B also allows the user to download the data yet does not require consent, thus requiring another legal basis under the GDPR and pseudonymises the data. Approach C is identical to B, except it anonymises the data. Finally, approach D incorporates cloud computing, meaning that the users cannot download the data but must access it through an online portal containing pseudonymised patient data without the required consent. All four approaches are legally and practically valid but have different implications on data security, ease of use, sustainability, and implementability.

Fig. 3

Implications of the four different approaches presented in Fig. 2 for the different stakeholders: the patient, user, and data owner. The more a bar is filled, the better the approach is for the stakeholder. Ratings are subjective; therefore, interpretations can differ. The patient benefits most from approach D, as cloud computing is the most secure option, minimising the risk of a patient’s sensitive data being leaked. Also, it is the most transparent, as all activities related to the data can be monitored. Furthermore, its sustainability makes it ideal for users. However, not only the quality of the data is essential for the user, but also its usability. Therefore, users might prefer approaches A and B since these are easy to use and relatively sustainable, data quality of approach C can be worse since it is fully anonymous and cannot easily be enriched, making it less useful for the user. The data owners are responsible for building and maintaining the database. Consequently, approach A is the least preferred option, as consent can be challenging and time-consuming to implement. Approach C might also not be preferred because the anonymisation process can be difficult and database updates even harder. Approach B is already much better for the data owners due to its sustainability; however, it can be hard to implement legally. Although approach D is arguably the most challenging to implement for the data owner, we still expect this is the preferred option as it offers the most control over the database and its use. Furthermore, the cloud computing infrastructure can be used for many different data sets, meaning that it only has to be set up once and can be maintained for all shared data sets.

Fig. 4

Recommendations for sharing open healthcare data under the General Data Protection Regulation.