Dissenting from care.data: an analysis of opt-out forms

Background Care.data was a programme of work led by NHS England for the extraction of patient-identifiable and coded information from general practitioner (GP) records for secondary uses. This study analyses the forms (on the websites of GP practices) which enabled patients to opt out. Methods Theoretical sampling and summative content analysis were used to collect and analyse dissent forms used by patients to opt out from care.data. Domains included basic information about the programme, types of objections and personal details required for identification purposes. Results One hundred opt-out forms were analysed. Fifty-four forms mentioned that this programme was run by NHS England. 81 forms provided two types of objections to data-sharing, and 15 provided only one objection. Only 26 forms mentioned that direct care would not be affected and 32 that patients maintain their right to opt back anytime. All but one of the opt-out forms we reviewed requested the name of the person wishing to opt out. 94 required a date of birth and 33 an NHS number. 82 required an address, 42 a telephone number and 7 an email address. Conclusions Numbers of patients (not) opting out should be treated with caution, because the variability of information provided and the varied options for dissent may have caused confusion among patients. To ensure that dissent is in accordance with individual preferences and moral values, we recommend that well-designed information material and standardised opt-out forms be developed for such data-sharing initiatives.


INTRODUCTION
Electronic health records (EHRs) are becoming valuable sources of data for public health research across large populations. Due to the volume, variety and velocity (long-term follow-up) of information, 1 researchers can discover and monitor disease and healthcare trends as well as the effectiveness of new interventions and treatments with minimum cost. As EHRs are increasingly linked to secondary care and mortality datasets, they could provide good information on morbidity and lifestyle, prescribing standards of care and interpractice variation. 2 They are increasingly used in biomedical research, where phenotype-genotype associations can be developed for specific diseases and help researchers focus on collecting samples from highrisk patients. 3 4 Particularly in England, more than 30 years of coded health data in GP information systems are now available that can be used in this kind of research. 5 The need for consent for the research use of EHRs has been the focus of ethical debate. 6 7 When it comes to the processing of identifiable personal health information, there are usually two options available. EHRs can be included in research by default unless patients opt out or patients can actively consent to participate (opt in). Both approaches are limited in their ability to support informed consent, particularly across large populations. For example, consent documents may not reach all patients or may not be understood. 8 9 This discourages good decision-making. 10 However, an opt-in approach to consent usually results in lower participation and less representative samples of the study population. 8 11-13 For low-risk population level studies, an opt-out or social contract approach may be a more valid alternative for expressing consent. 14 15 On the other hand, opting in is preferable for the potential participants, 16 and it is considered more ethical since it requires actual consent, without relying on inertia. This is also understood by patients as a token of consent. 17 Consent forms are tangible artefacts of awareness, cooperation and trust for participation in research 18 that can 'standardise, operationalise and verify the process of informed consent'. 19 Care.data was a programme of work led by NHS England and the Health and Social Care Information Centre (HSCIC) to extract patientidentifiable (NHS number, date of birth, postcode and gender) and coded (eg, medical history, vaccinations, diagnoses, referrals and NHS prescriptions) information from GP records to a central database. These records would have been linked to other NHS records from hospitals, community, mental health and social care services after they have been de-identified. 20 Care.data would then be able to help NHS England to ensure better and cost-effective services, such as e-prescribing, i while understanding diseases and trends in public health, developing and monitoring the safety of drugs and treatments and comparing quality care across the country. 21 The right to opt out was not available to patients from the outset. It was only after an Information Governance Review 22 that HSCIC and NHS England committed to respecting this decision. 23 GPs, as data controllers, had a legal responsibility to inform their patients about the programme and to register any dissents on their records. Two types of objections or opt-outs (these terms are used interchangeably in this paper) were possible: type 1 (data would not be extracted from the GP record to HSCIC) and type 2 (data would not be shared outside of the HSCIC in any identifiable form). 24 There was confusion about whether a patient who had registered a type 2 objection would continue to receive direct care services, such as e-referrals and screening. 25 Information about care.data provided to patients through leaflets posted to households was later deemed unfit for purpose. 26 It was biased towards the benefits of the programme and had little information on how to opt out. 27 The British Medical Association (BMA) 28 and GP committees 29 were in favour of an opt-in approach. There was no standardised opt-out form available for patients to submit to their GP practice, unlike the NHS Summary Care Records (SCR). ii Care.data was eventually put on hold iii due to old 30 and new concerns, including the lack of a code of practice, the technical capabilities of the information technology (IT) contractor, the pseudonymisation technique, consent (opt in vs opt out) and the cost of the programme. More widely, there were also concerns about data access for commercial purposes, public engagement, monitoring and auditing of data release contracts, penalties for data misuse and data security. A central issue which the programme never adequately addressed was the public reaction. As of April 2016, around 1 in 45 citizens in England who had registered with a GP practice had expressed a type 2 objection. 31 At the time of the writing of this paper, NHS England decided 32 to close the care.data programme (6 July 2016).
So far, no study has assessed and compared the content of dissent forms for the use of GP records for secondary purposes. The purpose of this paper was to explore the content (information provided and the identification details required) of informed consent documents designed by GP practices for patients to opt out from care.data.

METHODS
There are approximately 8000 GP practices in England. 33 We sourced opt-out forms for care.data by searching online and downloading them from the websites of individual GP practices. We used the 'advanced search' feature of the Google search engine to search for 'care.data opt out form', narrowing our results by language (English), region (UK) and file type (Adobe Acrobat PDF). iv We used theoretical sampling 34 to select a fairly random and also highly variant (in terms of content) sample, so as to explore the heterogeneity that existed across these forms, in the absence of a standardised approach. After retrieving 130 opt-out forms, we carefully read them and removed any duplicates (forms that were exactly the same in terms of design and content, the only difference being the GP practice details). Following that, we used summative content analysis 35 to identify, analyse and describe the content in the opt-out forms. This approach to qualitative content analysis was appropriate for a study that explores usage of specific content in textual material. 36 After reading these forms several times, we identified our unique units of analysis and grouped them under three, mutually exclusive and exhaustive, categories based on their contextual similarity: information about the care.data programme (eg, scope of data collection, organisations involved, patient rights, procedure), options available and types of objections to data-sharing included, personal details required from patients by GP practices for identification purposes (eg, name, address, telephone number) and opportunity to opt out family members. These categories and units were then entered into an Excel document for quantifying and sorting their presence across the forms.
While the websites of individual GP practices (where links to these forms can be found) usually provide additional information about care.data, we do not review them here. The analysis is focused only on the documents that patients could download, print out and take them to their GP practice in order to opt out.

RESULTS
We analysed 100 unique opt-out forms. The length of these forms ranged from 1 to 6 pages, with an average length of 1.48 pages. A typical opt-out form was usually 1 page long. Longer forms provided more details about the programme or information about other data-sharing schemes, such as SCR.

Programme information
All but one of the opt-out forms clearly noted that they were related to care.data, with the name appearing somewhere on the form. Eighty-four forms informed their patients that it was the HSCIC collecting data from their records, but only 54 mentioned that this programme was related to (or had the logo of ) NHS England on the form. Half of the reviewed forms provided more information related to this programme and/or pointed to the leaflet ('Better Information Means Better Care') released by NHS England or provided links to the relevant website, v so that patients could find more details about the programme. Typically, where additional information was provided about the programme, it included the start date, aims (planning and monitoring of patient services), possible approved releases of identifiable information, security guarantees, types of organisations with potential access to these data (NHS and private), the importance of data-sharing and the options available regarding objections. One form mentioned that care.data had the support of the BMA.
Finally, 31 forms clearly explained that this programme was not related to SCR and that patients would have to fill in another form if they wished to opt out. Only 32 forms expressly informed patients that they maintained their right to opt back anytime should they change their mind. Also, only 26 forms expressly mentioned the fact that their direct care would not be affected in any way due to their decision to opt out from care.data, while only one form gave patients the opportunity to opt back in by providing the relevant tick box.

Opt-out options
In general, the vast majority of forms (n=81) from GP practices reviewed in this paper provided patients with two options to declare their objection: type 1--data would not be extracted from the GP record to HSCIC; and type 2--data would not be released by HSCIC to other parties, outside the NHS, in any identifiable form. Four forms provided three options, with the third one acting as a confirmation that patients would have liked ii http://systems.hscic.gov.uk/scr/library/optout.pdf iii These problems that the programme ran into were also considered by a House of Commons Health Committee. See: http://www.parliament.uk/ business/committees/committees-a-z/commons-select/health-committee/ inquiries/parliament-2010/cdd-2014/ iv This file format preserves page layout and the exact look of a printed document better than other file formats across platforms. v www.nhs.uk/caredata to opt out from both types of data-sharing. In these cases, patients had to tick the relevant box next to the type of objection they would have liked to exercise. Fifteen forms provided only one option, which led patients to opt out from care.data altogether, without being able to decide which of the two types of GP record releases they would have liked to opt out from. We were able to identify 42-45 unique wordings for each of the two main types of objections. We group and list the five most commonly used (see tables 1 and 2) and also some common examples of only one (combined) type of objection to care.data (see box 1). For the type 1 objection, GP practices usually referred to data extracted as either 'personal confidential data', 'GP record' or 'identifiable information', while emphasising that data would not be released/leave the GP practice or shared with the HSCIC. Some GP practices also referred to care.data as either a system or a programme. With the exception of 'GP record', the same terms regarding patient information were used for the type 2 objection, while emphasising that data would not leave the HSCIC-for care.data or any other purpose. In fact, some of these forms specifically explained that opting out meant that any data about the patient from any NHS source would not have left the HSCIC for any purpose. A greater variation of wording was observed among the opt-out forms that only offered one opt-out possibility. There were forms with which patients could simply opt out from care.data, forms that focused on explaining that any data (linked to the patient's NHS number) would not be disclosed to HSCIC and forms that clarified that data would only be used for direct (medical) care purposes and shared only in exceptional circumstances, as required by law.
Moreover, 58 forms also provided the relevant opt-out codes to be added in the GP record, 19 provided the option to also opt out of the SCR programme or other local data-sharing schemes (eg, Hampshire Health Record) and 62 of the forms provided the opportunity for someone to opt out themselves and their family members. None of the forms had any information on whether or how patients would be notified that their decision had been recorded in their GP record.

Identification details
In examining the opt-out forms, we identified a variety of details that each practice requested in order to identify their patients and respect their wishes. All but one of the opt-out forms we reviewed requested the name of the person wishing to opt out. Ninety-one required a signature and seventy-eight the date it was signed. Ninety-four required a date of birth and thirty-three their NHS number (if known). Eighty-two required an address, forty-two a telephone number, which could be a mobile one, and seven an email address. One opt-out form asked for the name of the 'usual GP' to be included.

DISCUSSION
In this article, we analysed the opt-out forms for the care.data programme by NHS England. We have documented how GP practices developed their own informed consent material to record patients' objections to the release of their confidential information to HSCIC for secondary uses. The lack of a standardised approach to communication and informed consent has resulted in variable ways of recording patients' dissent from the programme.
In practical terms, the care.data roll-out and the presumed consent model adopted proved to be problematic in raising awareness of the programme and the right of patients to opt out. 37 This broad opt-out approach with two types of objections has been deemed precarious as it makes it hard for patients to distinguish between what they consider to be (un)acceptable secondary uses of their data. 38 Individual autonomy and rational decision-making in research require more than just a simple opt-out form. Potential participants adopt a relational behaviour based on which a researcher or institution is approaching them for recruitment and for what purposes. 39 They would like to be able to decide between their data being used for research purposes in, for example, the academic or commercial sectors. 40 Initially, patients could not opt out of care.data at all. 41 The programme has been criticised for its inadequate approach in explaining clearly the benefits of the programme, as well as the safeguards in place for the protection of individual patient data, such as techniques for the removal of personal identifiers, physical security measures and oversight mechanisms. 42 In contrast to the leaflet provided by NHS England, most of the opt-out forms examined in this study mentioned that data extraction is for care.data. However, in many of these forms, patients were not even informed that their data might continue to be extracted and used by HSCIC, for example, in civil emergencies. As these data extractions never actually materialised in this programme, GPs were also not in a position to notify patients that their opt-out had been respected and that they would have participated in this data-sharing scheme according to their declared type(s) of objection. Due to the limited resources available, HSCIC was unable to process the growing number of opt-outs.  At the same time, HSCIC was working out how a type 2 objection could be implemented without affecting patient care and screening programmes that rely on data sharing, such as eprescribing, bowel cancer screening and e-referrals. 43 There was a lack of adequate technical preparation, public awareness and consultation about the benefits and risks of care. data. Its dependence on GPs to inform their patients about the programme (without adequate support) might have been seen as a way to secure maximum public buy-in by relying on either individual patient inertia or by using confusing and cumbersome opt-out procedures. 41 It transferred responsibility to patients to seek out other sources of information in order to find out whether and how they would opt out. 44 This was partially evident in this study. When using the Google search engine, the first form that someone could download to opt out was created by 'medConfidential': an independent group campaigning for confidentiality and consent in health and social care. 45 Moreover, including all data-sharing schemes in the same opt-out form may also have been unsuitable for patients who would have liked to only opt out from one particular scheme. For example, patients who may have been frustrated with the data-sharing arrangements of one scheme might have easily been driven to opt out from other schemes, such as SCR. Such misinformed responses, facilitated by an all-inclusive form, may have inadvertently affected their direct care in unpredictable ways.
One limitation of our study is that we did not examine the websites of individual GP practices where patients might have found more information about the care.data programme of work, to help them make a decision based on their data-sharing preferences. Also, our study was limited in examining whether specific items appeared uniformly across the various opt-out forms. Finally, while there are thousands of GP practices across England, we only examined 100 opt-out forms. The sample, although small, is, we believe, of adequate size to highlight the variability of content included in these forms.
Our intention was not to 'name and shame' individual GP practices about their opt-out forms and how they approached issues of informed consent around the records they keep for patients and the data they share. We aimed at revealing the heterogeneity of opt-out forms that can be found online, particularly with regard to wordings, choices and information provided: the result of healthcare professionals and patients attempting to make sense of conflicting, misguided and often inadequate information about the programme and the opt-out procedure from the HSCIC and NHS England. As we were examining these opt-out forms, we could see how it would be difficult for patients to have sufficient information for rational decision-making with regard to their data being shared for secondary purposes. Some forms appeared to be worded in a more sympathetic tone towards care.data; others emphasised more the nature of the data to be shared ( personal confidential); and others were very simple or straightforward without providing much information on what an opt-out/opt-in actually meant for them and their family members.
We believe that this study demonstrates the various design problems of this programme and its lack of attention to the subtleties and sensitivities of healthcare professionals and patients who coproduce this data for direct healthcare, and not for other secondary purposes. It is important for national big data initiatives to develop well-designed information material and standardised approaches to opt out (or opt in for that matter) in order to overcome the issues of informed consent that are of paramount importance in the attempt to maintain patient privacy and confidentiality, while facilitating sophisticated research from electronic patient records. Hopefully, the National Data Guardian's latest review of health and social data use 46 and her recommendations on testing various consent and opt-out options with the public before a decision might give a successor programme to care.data a better chance of success. Until then, any actual or speculative numbers of patients (not) opting out should be treated with caution by policy-makers and lawmakers as they attempt to translate them into individual preferences and moral values.
Twitter Follow Paraskevas Vezyridis at @paravezy Box 1 Common examples of combined types of objections ▸ I confirm that I do not want my confidential information being shared or used for any purpose other than providing me with care, except in exceptional circumstances. ▸ I wish to opt out of the care.data data-sharing. ▸ I wish to implement my constitutional right to object to the disclosure of my personal confidential data from [name of GP practice] to the Health and Social Care Information Centre (HSCIC). ▸ I wish to exercise my right to prevent the extraction of personal care data about me linked to my NHS number both from the practice to the HSCIC and any data collected linked to my NHS number from other sources held by HSCIC to any other body or organisation. ▸ I am writing to give notice that I refuse consent for my identifiable information and the identifiable information of those for whom I am responsible to be transferred from your practice systems for any purpose other than our medical care. Please take whatever steps necessary to ensure my confidential personal information is not uploaded and record my dissent by whatever means possible.