Skip to main content
main content, press tab to continue

Do your patients know how their data is being used?

May 24, 2021

A brief overview of public preferences towards data sharing consent mechanisms.
Risque de pandémie

Public consent to data reuse, sharing and linking practices is a critical component of a transparent health-data ecosystem and requires that patients:

  1. be aware of and understand how their data is being used and
  2. choose which of their data is shared, with whom, for what purpose and how; especially when commercial aspects are a feature.

It is no coincidence that lack of public awareness (and the corresponding lack of appropriate consent) was at the core of many recent public data sharing controversies. See our Big Data in Healthcare Whitepaper for more information.

A primary goal should be to foster better public awareness and understanding of health data reuse and ensure that the consent mechanisms used can best facilitate that.”

David Kennedy | GB Health & Social Care Practice Leader
Willis Towers Watson

Therefore, a primary goal should be to foster better public awareness and understanding of health data reuse and ensure that the consent mechanisms used can best facilitate that.

The GDPR standards of consent provide a good framework to consider; Article 4 of GDPR defines consent as:

  • Freely given: the person must not be pressured into giving consent or suffer any detriment if they refuse.
  • Specific: the person must be asked to consent to individual types of data processing.
  • Informed: the person must be told what they're consenting to.
  • Unambiguous: language must be clear and simple.
  • Clear affirmative action: the person must expressly consent by doing or saying something.1

There are multiple different types of consent mechanisms that are used within the healthcare industry to facilitate consent to reuse people’s health data.

In their broadest forms, consent models are either opt-in or opt-out.

Opt-in approaches require people to take an affirmative action to grant their consent.

Conversely, with an opt-out approach people must take an affirmative action to withdraw their consent (without which, consent is deemed given).

Opt-out models are not compliant with GDPR requirements for express consent.

or opt-out consent must be actively withdrawn or is deemed given and for opt-in, it means affirmative order of consent.
Consent models are either opt-in or opt-out.

The spectrum of consent granularity

There is a spectrum of consent, that provides patients with increasingly granular opportunities to clarify and document how, when and why their data is to be used.

There is a spectrum of consent, that can offer to/seek from patients increasingly granular opportunities
to clarify and document how, when and why their data are to be used.
Consent models on a spectrum
Spectrum of consent granularity
Consent models Degree/nature of granularity
Blanket consent Consent to an unlimited range of options with no restrictions.
Broad consent People consent to an unspecified variety of future research projects subject to a few restrictions.
Tiered consent People can choose to give broad consent for specific types of purposes, users, institutions etc.
Meta consent People express how and when they want to be asked for consent in the future. A form of tiered consent whereby people can choose differing levels of consent for different categories: e.g. users, uses, institutions etc.
Specific informed consent Consent for each differing use (and user) of data at every point in time.

An increasingly lauded approach to consent is dynamic consent, which includes a personalized communication interface which allows for ongoing engagement with people about the reuse of their data in rapidly changing environments.

A dynamic consent approach puts the individual at the centre and allows for interactions over time so that people can alter their choices.

Public preference?

The evidence indicates that patients’ and the public views towards which consent models they prefer are highly varied and often influenced by other factors, such as: disease state, culture and individual attitudes towards privacy.

This is mirrored by the wide variety of public attitudes towards data sharing generally; which typically differ according to individual factors and various combinations of: the nature of the data user, the purpose of the data use and how the data will be used.

Whilst, there is no universal agreement on what consent model/mechanism best addresses public concerns about data reuse, in general, the involvement of commercial companies and any element of profit making amplify public desire for greater control of their data preferences.

This is supported by evidence that consent preferences differ by entity-type, with people desiring more control over their data when for-profit entities are involved (even with clear public benefit).2

Other governance considerations

In the absence of globally consistent approaches to consent and regulation (including fines and penalties), governance structures should consider the use of multiple mechanisms to ensure data reuse/selling and linking are appropriate:

  • Public awareness and engagement campaigns (to facilitate informed choices); including the publishing of data reuse practices and policies.
  • Consent mechanisms that facilitate patients’ determination of how all their different types of health data are used, by whom and for what purpose(s).
  • Benefit sharing agreements between all stakeholders.
  • Independent oversight structures.
  • Auditing mechanisms to ensure appropriate uses.
  • Purpose of use reviews to consider data reuse requests.


Consent choices related to commercial involvement in health data reuse are: 1) not binary, 2) complex, 3) reliant on individual and system factors and 4) have several dependencies – including greater transparency and awareness.2

Healthcare companies, policy makers and other stakeholders that want to reuse, share or link patient data must balance this diversity of opinion against the need for pragmatic, cost-effective and realistically implementable solutions to obtain consent.

Whatever consent model is chosen, entities should seek to enhance public awareness and understanding about how their health data are used and foster greater public engagement in their choices surrounding the use of their data.

Please note this article is focused on adult consent, as there are additional considerations for minors, individuals with mental health concerns and potentially caregivers.



2 Beasley, K. (September 2020) Patient and public attitudes towards secondary use of health-related data, with particular focus on themes of commercialism: a two-phased scoping review

Related content tags, list of links Article Healthcare Life Sciences Pandemic Risk and Response
Contact us