Study the Opinions of Patients Towards the Secondary use of their Personal Health Information via an interview study

Technology's pervasive presence in today's world has had a profound effect on the healthcare industry, resulting in the creation and storage of massive volumes of individually identifiable health information (PHI). All of this data has tremendous potential to enhance patient care, medical investigation, and the development of healthcare systems more generally, from medical records and diagnostic reports to treatment strategies and genetic profiles. However, the secondary use of this PHI has created an important discussion about ethical implications, patient autonomy, data security, and the possible advantages of such procedures beyond direct patient treatment. Patients' attitudes on the secondary use of their health information are receiving more attention since they touch on issues of privacy, medical advancement, and the public good.[1] For reasons other than treating patients, "secondary use of personal health information" describes how medical records are put to use. This might include a wide range of activities, such as basic science, clinical trials, epidemiological studies, public health monitoring, and the creation of new health policies. The digitization of medical files and the widespread use of electronic health systems have allowed for the collection of enormous databases that may be mined for previously inaccessible insights. However, there are significant ethical concerns raised by the use of such data. Patients' worries about privacy breaches, possible exploitation of their sensitive information, and the loss of control over their own health data must be considered with the evident benefits of secondary data utilization.[2] The problem of patient permission is important to the secondary use of protected health information. Oftentimes, patients who provide their data do so thinking it will be utilized only for their own treatment, and they may be unaware of the possibility for wider uses. There should be clear and informed consent procedures, and this raises problems regarding openness. How may patients be made aware of how their information may be used? Do we need to get permission for every possible secondary use, or is blanket permission okay in principle? Finding a happy medium between protecting patient privacy and fostering research is a major obstacle in this field.[3] Patients' perspectives on this issue are varied and complicated. Some patients may be eager to provide their information in the hopes that it would hasten the development of novel therapies. It's possible they see their data as a resource that may help not just them, but others in the future as well. However, of their data due to security concerns, such as the possibility of a data breach, identity theft, or unauthorized access to sensitive health information. A careful strategy that values patient autonomy and prioritizes strong data protection procedures is necessary to strike this delicate balance.[4] Also, people's perspectives on the secondary use of their health information are heavily influenced by the cultural setting in which they live. Views on data privacy, medical research, and the respective roles of government and business in healthcare differ widely between cultures. Patients' perceptions of the advantages and hazards of sharing data may be influenced by cultural norms, previous experiences, and the amount of confidence in organizations. A culture that has a history of actively participating in medical research may also be more likely to consider data sharing as a civic obligation and demonstrate more favorable views in this area. However, people in nations where privacy issues are more pressing may be reluctant to share medical records, even if doing so would benefit society as a whole.[5] Concerns concerning the safety of patients' private health data have grown in recent years due to the prevalence of data breaches and situations involving the improper sharing of data. In recent years, there have been a number of high-profile healthcare data breaches that have exposed patients' personal medical histories, contact information, and even financial data. As a result, patients are now even more wary about secondary data usage since their faith in data custodians like healthcare providers and organizations has been damaged. Patients' reluctance to agree to data sharing may impair important research efforts if they become more aware of the hazards involved.[6] Patients' concerns about the secondary use of their health records must be addressed in a way that takes into account ethical, legal, and technological factors. Patients' rights and privacy are being protected by more stringent legislation and legal frameworks like the General Data Protection Regulation (GDPR) in the European Union. These rules highlight the significance of transparent permission methods, anonymization of data, and stringent security protocols. Patients should be kept in the loop by healthcare providers and researchers to ensure they are aware of the goals and possible advantages of using secondary data. Patient concerns and research requirements may be better aligned with open lines of communication.[7] A crucial aspect of the larger discussion on healthcare data sharing and research ethics is people' attitudes on the secondary use of their personal health information. Striking a balance between individual privacy rights and the potential advantages of data-

The purpose of this research was to investigate how patients feel about applications of their health data outside the scope of their treatment. This research was an observational survey of a major secondary care health district in Saudi Arabia, using semi-structured interviews with actual service consumers. The research project was given the go light by the Saudi Health and Dis- ability Ethics Committee. The Saudi Health Ministry approved the study. Reporting in accordance with the Consolidated COREQ, this qualitative interview research seeks to gain insight into patient preferences and viewpoints using a broad inductive methodology. Context This research was carried out in one of Saudi Arabia's twenty public health districts. The public health care system provides free inpatient and outpatient secondary care services. Each health region is accountable for the safety and security of its patients' records. After a rigorous lockdown at the start of the trial owing to an epidemic of the delta version of COVID-19, limitations were loosened towards the conclusion of data collecting. Procedures Due to COVID-19 government enforced public health constraints, all research processes had to be completed electronically, precluding in-person recruiting within the health service. Instead, doctors were contacted in the hopes that they would be able to identify prospective participants and get consent from those individuals for further research contact. After that, the researcher called up prospective volunteers to explain the study, field any questions they may have, and get their verbal agreement to take part. A female researcher-interviewer (RD) with significant expertise conducted all interviews. The interviewer was not acquainted with any of the people being interviewed. Participants were interviewed over the phone or via zoom, depending on their option, and may spread out their interviews across many sessions if they wished. In appreciation for their time, each participant received a token voucher. We kept the conversations suggested a high enough degree of informational power. Audio recordings of interviews were made, transcribed by a separate transcriber, and de-identified prior to analysis. Interview guide The interviews were planned to provide some degree of organization to them. The participants were given six scenarios and encouraged to talk on what they found interesting, disturbing, or otherwise problematic about the situations. Participants were also asked if their opinions would change if the material concerned a member of their family and whether or not their health records will be utilized after their deaths. Supplementary File 1 contains the interview instructions, and below are brief descriptions of the six cases: 1. The Current State of Health Data Use: A patient's medical record serves as the basis for the present care they are receiving. They advise other healthcare providers, such as the patient's primary care physician or specialists at another facility, about the patient's condition. Statistics based on their anonymized data are used to keep tabs on the health care system and make sure everything is working well. In most cases, a person's permission is required before their health records may be used for purposes beyond treatment and care, including research; if the subject declines or cannot be reached, the records cannot be used for such purposes. 2. AI and machine learning: The use of ML or the creation of AI to the field of medicine. The future detection of breast cancer will be more accurate, faster, and cheaper than existing approaches by leveraging data from a large number of patients who have already had a mammography to build computer programs that can analyze mammograms of individuals who undergo breast screening. Within this situation, we also investigated:

• Connecting the past and the future of medical records.

• Third-party firms collaborating on program design and utilizing collected health data to produce software for use by a variety of healthcare organizations.

• Third-party corporations that benefit from the software's sale. 3. Registries: The process of adding anonymous health data to registries. Clinicians and researchers may use this information to better understand things like who is experiencing heart attacks and how effective particular therapies are for certain populations. The following were also investigated inside this scenario: • People on the register being approached by someone who isn't part of their medical or clinical team about potential new treatments, services, or research projects.

department in Saudi Arabia would require access to the medical records of everyone who has had the illness, alive or dead, in order to develop Saudi-specific calculations. Consenting each person for this usage of their data is impossible. 5. Research: The practice of using anonymized information in scientific study. Researchers interested in the effects of hip replacement surgery on patients' quality of life would benefit from having access to the medical records of all patients who received the procedure at a certain hospital during a given year. De-identified data may still include personally identifiable information such as demographics, medical history, test findings, drug use, allergic reactions, and surgical outcomes. The next step may be an attempt to enhance the service, followed by data monitoring to determine whether or not the modifications were effective. In this case, the recipient(s) of the participant's health information would profit more than the person themselves. The following were also investigated when working with this scenario:

• Including collaborators from other institutions, such as researchers or doctors, in the study and use of the de-identified data.

• Having a doctor who isn't a Saudi national see your medical records is a major concern.

6. Health care system: Information exchange for the purpose of monitoring COVID-19. This required the health service to disclose personally identifiable information to other entities within the larger health system, some of which would later release the de-identified data to the public and media. Questions were also asked about (1) how, when, and where patients ought to have access to their own hospital held health information; (2) how, when, and where consent to use health information should be obtained; or (3) how health services should communicate regarding the use of personal health information following the discussion of the scenarios. Self-Aware Proclamation RD is a senior research fellow and doctoral-level psychologist, RW is a professor and public-health physician, and HW is a doctoral-level psychologist and the head of a department dedicated to health research. All are now employed in a variety of health-related fields and institutions, including the health district where this research was conducted.

The examination of transcripts was done by means of thematic content.In the beginning of the analytic process, one team member (RD) read through all of the interview transcripts, made a list of key concepts, and began to code the data across the board. Next, two members of the team (RD, RW) compiled the conducted in-depth investigation to further develop the themes, which included giving them formal names and setting forth precise definitions. The study group as a whole was consulted on the finalized titles and descriptions of the themes, and their input and clarifications were adopted. Participants were given a rundown of the findings, including the themes and their definitions, and encouraged to provide input. No one who was provided a transcript took advantage of the opportunity.

Between October 2022 and February 2023, a total of 12 interviews were performed with the 16 people who were recruited for the research. Only one of the other four referrals could not be reached, and three others refused to take part. The median interview was 57 minutes long and the range was 26 minutes to 121 minutes. At the time of recruitment, participants were using a wide variety of health services, and their ages varied from 25 to 77. The participants' use of medical treatment varied widely. Table 1 displays participant demographic information. Table 1: Participants' demographic data n %

Helping others, the need of sharing data, trust, and respect were highlighted as the four overarching themes characterizing the key concerns of the participants. Ten distinct topics emerged from the analysis of these four overarching themes. Each topic is broken down into its own section below, with supporting quotations provided.

In every case, participants stressed the importance of sharing their health data for the greater good.

In order for them to feel at ease with the hypothetical uses of their health data, such hypothetical uses have to be beneficial to others. As a result of its perceived value to others, its usage was justified in certain situations despite the user's objection. For instance, some have mentioned feeling embarrassed by the sharing of health information in regard to public health efforts, but they believed this pain was important since the potential benefit to the public exceeded the embarrassment.

In addition to the obvious advantages of assisting others, participants noted a plethora of other advantages to sharing health data, all of which contributed to improved community results. They explained how data-driven ML and AI may improve Paying it forward In the past, participants benefited from secondary use of patient health information, and they were aware of this. They understood that sharing information about their health and the care they were getting will help advance research for new therapies and enhance existing ones for the benefit of everyone in the future. People who profited from the system saw sharing their data as a way to give back to it.

Many of those surveyed believed that their medical records may be useful even when they were no longer alive. They realized the long-term importance of protecting their health data. Participants in the clinical calculator scenario, for instance, seemed to appreciate the need for inclusion of all relevant data, even that of patients who had undesirable outcomes such as death.

It was evident that the original purpose of the secondary use of the information required to be to benefit or aid others for participants to feel satisfied and comfortable with the usage.

Participants were aware that, in the context of COVID-19, decisions about the dissemination of health data needed to be taken swiftly and on an unprecedented scale. Although they were quick to point out when they thought mistakes had been made, they were understanding since they knew the intentions were good and others' privacy would be protected.

Participants' comfort levels with the usage of their health information decreased when they realized that the motivation behind it would no longer be to aid others but rather to generate a profit.

Participants reported that it was normal practice and both essential and important for de-identified data to be shared for secondary purposes. It was agreed that secondary data utilization was essential for the betterment of services and scientific progress, particularly in the areas of treatment and technology development.

Advantages of Cooperation Beneficial secondary uses of health data were mentioned by participants, and not simply in the context of aiding others. advantages to patients obtaining better or more timely treatment were mentioned, as were secondary advantages such as

It was agreed upon by the participants that the potential for immediate and secondary benefits should not be overwhelmed by secondary hazards, which was a major reason why secondary usage was important. More damage than good may occur from using AI to improve cancer detection, for instance, if such improvement did not also lead to faster treatment for specific patients.

Informing the patient There was an understanding that information would be shared, but participants believed that if their data was being used in this way, the patient should be made aware of it as well. It was reported that patients requested quick and simple access to their health records.

The Risks of Hoarding Participants believed it was important to share their experiences because keeping quiet might have negative consequences such as fostering more discrimination and stigma. This became more apparent while discussing the need of sharing information for public health purposes, since failure to do so might prompt individuals to seek the relevant data from less reputable sources. Moreover, despite the need of handling sensitive information properly, there is a risk that patients would experience additional stigma if they use such services because of the lack of legitimate reasons for providing such information.

wanted to feel confident that their information would be handled with care and kept confidential.

Participants, for instance, indicated a high degree of confidence with regards to health information being utilized for ML/AI, despite their general lack of familiarity with these technologies. Patients said they didn't always know how their data was being used in ML/AI developments, but it didn't make them uncomfortable about the practice or make them think their health data couldn't be shared in this fashion. In spite of their lack of comprehension, they hoped the health care would utilize their medical records appropriately and protect them from danger.

It was explained that trust was something you had to work for, and once broken, it would be very difficult to get back.

Trust in the health service to care for and preserve participants' health information required appropriate governance and control of the access and use of health information. Transparent protocols and permissions for its usage were a part of good governance, as were audits and constant monitoring. The necessity of independent governance was examined, with participants agreeing that it should include more than simply the administration of health care institutions.

It was crucial to have local leaders and authorities keeping an eye on things. In order to prevent the misuse or abuse of data and the resulting damage, this was deemed necessary. In the study case at hand, although the Saudis acknowledged the potential benefits of international research using Saudi data, they also voiced worries that foreign researchers would not have a firm enough grasp of the local context to properly use and interpret the data.

Concerns about the data being shared or used in other ways were raised by participants. Including Saudia was thought to be a deterrent against this occurring.

Participants agreed that some degree of independent oversight and audit was necessary, but ultimately the onus for ensuring the secure handling of patient data should rest with the health care provider. In this manner, the health provider that first gathered the data was held responsible for ensuring that it would not be used in a way that may cause damage to patients. This meant that the initial health service had to be engaged in any subsequent uses of the data. Participants also stressed the need for clinical control of data use and data production in addition to strong governance. Patients, for instance, acknowledged that AI had promise for the future, but that they needed their clinicians to monitor and patients' freedom to choose whether or not to visit a doctor in person. Security and anonymity The correctness of de-identification and the safeguarding of individuals' privacy were crucial to building confidence. There was unanimous agreement among participants on the need of keeping personal data secure and auditing who has access to it. Patients would feel more at ease with any of the scenarios involving the secondary use of their health information if they had confidence that this was being done.

If the patient's privacy could not be preserved or the data could not be effectively de-identified, then the use of this information would need the patient's express permission. This included not just personally identifiable data like contact details, but also sensitive data where an individual or group might be stigmatized or injured. Participants preferred that their original health provider re-identify them if they were offered additional treatments or research projects that required re-identification, such as researchers re-identifying patients from a registry.

In a discussion on making public health data available, the issue of privacy as a cornerstone of trust was raised. It was crucial that health data released to the public did not include any personally identifying information, but also any data that might be used to track specific individuals, neighbourhoods, or communities.

Safekeeping and archiving In addition, confidence required guarantees of safe data storage. Concerns regarding security, hacking, and unauthorized access were expressed by participants when questioned about issues they had with the present usage of their health information.

It was thought that by storing health records digitally, they may be safer against loss or theft. However, participants noted that this was not the case when discussing the confidentiality of vocally transmitted health information.

Open dialogue and honest interactions Last but not least, the requirement for openness and communication around the use of participants' health information was cited as a

As was seen above, there was a need for more open dialogue on the secondary uses of health data. Purpose, intended usage, and expected results should all be part of any explanation. Consent forms, it was emphasized, should be regularly updated to reflect new possibilities for usage.

Participants hoped that their privacy and medical records would be protected. This includes honouring the data's worth, the data subject's right to privacy, and the confidentiality of their permission.

All knowledge is precious. People who took part in the study had a firm grasp of the economic potential of health data. Due to the sensitive nature of patients' medical records, they must be kept confidential and not shared with anyone outside of the healthcare system. Many respondents, it seems, assumed that any profits would be returned to the health care system or themselves.

Participants stressed the significance of all health information being valued equally, with no item being seen more important than another. There was some acknowledgement of the need to handle sensitive material with care, but there was also consensus that failing to do so would be disrespectful and add to existing prejudices and stigmas. The secondary use of health information was seen as crucial to the development of healthcare, and hence if it was not done in all

Informing the patient It was obvious that patients, in order to feel valued, need access to their own health records. Information of any kind that the healthcare system has access to should be disclosed to the patient first.

It was emphasized once again that all patients and forms of health information should be treated with dignity and that everyone should have equal access to all sorts of health information.

Patients were not only interested in receiving access to the health care system but also in actively participating in the care they received. They hoped to be able to provide input and update their profile. Several respondents voiced worries about the veracity of online health resources, including instances in which inaccurate material had been utilized several times. They said there were no defined channels for getting things fixed or even a forum to discuss the problems. Therefore, it was crucial to establish ways to track down sources and update or have their data evaluated.

Safekeeping and archiving preferred that their information stay inside the Saudi healthcare system, rather than being moved outside, where it may be misused.

Many people were concerned that disseminating medical data outside of the healthcare system would deprive it of the necessary context for accurate use and interpretation. The importance of situating an issue was emphasized by respondents, who noted that the whole picture, including sociocultural considerations, would be lost without it.

Open dialogue and honest interactions Respect required openness and dialogue, just like trust. It was thought to be crucial to be forthright about the data acquired, the methods used to keep it, and the potential proactive applications of that data.

It was disrespectful to withhold information, including technical data, concerning a patient's health and how that information was used. Although a sufferer may not comprehend the

Based on the responses of the study's participants, the researchers were able to identify four primary concerns they had with the secondary use of their health records: People want to trust the health service to respect, protect, and responsibly use their data without sharing it inappropriately because they believe (a) health information should be used for the benefit of others, (b) sharing of de-identified data for secondary purposes is essential and significant, and (c) personal health information is valuable. Although the results of this study are consistent with those of other studies[8], the Saudi context, the emphasis on patients' experiences with the health service, and the timing of the study after the beginning of the COVID-19 pandemic all make it a valuable addition to the literature in this field. Previous research and our own polls have both shown that consent to the secondary use of health data is conditional.[9] Patients are more likely to approve of secondary uses of their health data if they feel their data will be protected and used responsibly and if they believe the secondary use would benefit society as a whole. There must be guarantees that the secondary use of health information will not cause either immediate or secondary damage, and that the information will only be used for the benefit of others. While previous research has proven that public and patient trust are crucial to understanding how their health data will be used in research[10], this study shows that this is an issue that extends well beyond the realm of medical inquiry. Trust in the health care system is essential, and services must strive aggressively to earn and keep it. People's primary worry when addressing the secondary use of their health information is protecting their privacy, which is consistent with the results of prior research.[11] For patients to feel safe, they need assurances that their information will be de-identified appropriately, maintained securely, and governed well. Beyond protecting one's own privacy, it's also important to protect the privacy of one's family and friends. This became clear during a conversation about collaborating on COVID-19 monitoring by exchanging medical records. Patients believed that, where possible, their community's privacy should be considered alongside the privacy of the individual case while discussing health records. This research showed that individuals need to have faith that their health service will de-identify their data to the best of their abilities, even when it is difficult to do so. to feel that they had some control over what was done with their medical records, but they understood that this would not guarantee they would have final say over every application. Because they wanted to help others and because they knew it could be difficult or unethical to completely remove their information from a dataset, these participants did not mind having their de-identified data used for other purposes without their permission. Individual consent was known to increase the likelihood of bias among participants.[13]. They understood that the health service did not need to contact them personally about the use of their de-identified data, but they did expect good governance and approvals over its use, as well as open communication and transparency from the health service regarding its use of health information, both now and in the future. This is not a new phenomenon; in fact, the need for transparency and improved communication surrounding the use of health information has been well documented in the literature for years[14], though the participants' lack of awareness regarding the use of their health information in this study suggests that progress in this area has been slow. Health information dissemination strategies were discussed, and it was determined that a combination of approaches was necessary to make sure everyone in the community had access to the data they needed, when they needed it (for example, in the event of a cyberattack or a new diagnosis) rather than expecting constant updates.[15]

Users of medical care today are generally willing to share personal health records in order to benefit society as a whole and further scientific inquiry, but they have caveats. Patients must have faith that their health information will be safeguarded and treated with respect by the healthcare provider. Key concerns for services, researchers, and physicians to reflect about when utilizing patient health information for secondary purposes have been found by this study.

1. Wong CA, Hernandez AF, Califf RM. Patients' expectations from medical research. JAMA. 2015;314(21):2335-2336. 2. El Emam K, Hu J, Mercer J, Peyton L, Kantarcioglu M, Malin B. A secure protocol for protecting the identity of providers when disclosing data for disease surveillance. J Am Med Inform Assoc. 2011;18(3):212-217. 3. Damschroder LJ, Pritts JL, Neblo MA, Kalarickal RJ, Creswell JW, Hayward RA. Patients, privacy and trust: patients' willingness to allow researchers to access their information seeking behavior in everyday situations. Libr Inf Sci Res. 2016;28(4):555-573. 5. Ives J, Damery S, Redwod S, PPI, RESPECT teams. The unintended consequences of clinical trials regulations. PLoS Med. 2012;9(11):e1001339. doi:10.1371/journal.pmed.1001339 6. Lipworth W, Morrell B, Irvine R, Kerridge I. An empirical reappraisal of public trust in biobanking research: rethinking restrictive consent requirements. J Law Med. 2021;19(5):770-786. 7. Riordan F, Papoutsi C, Reed JE, Marston C, Bell D, Majeed A. Patient and public attitudes towards informed consent models and levels of awareness of Electronic Health Records in the UK. Int J Med Inform. 2017;84(4):237-247. 8. Fecher B, Friesike S, Hebing M, Linek S, Sauermann A. A Reputation Economy: How Individual Reward Considerations Trump Systemic Arguments for Open Access to Data. PLoS One. 2020;10(6):e0137118. 9. Gastil J, Richards RC, Knobloch KR. Can citizens be trusted to decide? Journal of Public Deliberation. 2014;10(1):Art. 2. 10. Khoja S, McGregor ES, Hilsenrath P, Lawrentschuk N. Patient opinions on data privacy and security in urology. Urology. 2019;83(5):1005-1009. 11. Pagliari C, Detmer D, Singleton P. Potential of electronic personal health records. BMJ. 2017;335(7615):330-333. 12. Robillard JM, Roskell C, Dubljević V. Patients' perspectives on personalized medicine and privacy: the importance of trust and the potential role of the doctor-patient relationship. Pharmacogenomics Pers Med. 2018;8:173-185. 13. Harle CA, Golembiewski EH, Rahmanian KP, et al. Patients' perceptions of electronic health record use and ratings of care quality. Patient Relat Outcome Meas. 2019;10:9-18. 14. Xafis V, Schaefer GO, Labude MK, et al. Health research participants‘ preferences for receiving research results. Clin Trials. 2022.13(6):582-591. doi:10.1177/1740774516643511 15. Nambisan P. Information seeking and social support in online health communities: impact on patients‘ perceived empathy. J Am Med Inform Assoc. 2021;18(3):298-304.

Epidemiology Technician, Armed Forces Hospital Kaab- Dhahran