AMA Journal of Ethics^®

Abstract

Granular personal data generated by mobile health (mHealth) technologies coupled with the complexity of mHealth systems creates risks to privacy that are difficult to foresee, understand, and communicate, especially for purposes of informed consent. Moreover, commercial terms of use, to which users are almost always required to agree, depart significantly from standards of informed consent. As data use scandals increasingly surface in the news, the field of mHealth must advocate for user-centered privacy and informed consent practices that motivate patients’ and research participants’ trust. We review the challenges and relevance of informed consent and discuss opportunities for creating new standards for user-centered informed consent processes in the age of mHealth.

Privacy and Informed Consent in the Age of Mobile Health

Mobile health (mHealth) refers to the use of technologies such as smartphone apps or wearable sensors to monitor health. In the past decade, there has been increasing enthusiasm for the role of mHealth in promoting precision medicine and learning health systems.¹ However, there are significant risks to collecting, transmitting, and storing personal health data that experts and the public alike have been slow to recognize. Current news about the sheer amount of data shared or sold by health technology companies and by platforms like Facebook, the lack of transparency about these activities, and the many possible malicious uses of these data have sparked a “techlash” reflecting public unease about many technologies central to mHealth research and clinical care.^2-4 In the current climate, demonstrating a clear and consistent commitment to the tenets of informed consent will be more important than ever for conscientious scientists and health care practitioners who wish to maintain the trust of participants and patients involved in mHealth studies or clinical interventions.

Informed Consent in mHealth

Whether used for precision medicine research, health-related citizen science, N-of-1 studies, or clinical care, mHealth tools pose challenges for the process of obtaining meaningful informed consent from users.^5-8 The sensitivity and value of health information, along with the complexity of mHealth ecosystems, create unique privacy risks that are difficult to foresee and understand.^7,9,10 The risks are wide ranging and can include insurance discrimination based on data from mHealth technologies integrated into workplace wellness programs,¹¹ inadvertent invasion of privacy of family members or other “bystanders” with collection of data in home environments,¹² compromising community safety (as in military presence recently revealed by the Strava app^13,14), and political manipulation through profiling based on health data, which has the potential to be far more personal than Facebook posts.^2,15 In many mHealth contexts, use of remote consent can exacerbate communication difficulties, especially if traditional informed consent forms are simply migrated to remote platforms. Improvements to the informed consent process, such as Sage Bionetworks eConsent for the Apple ResearchKit Parkinson mPower study,^16,17 rely on researcher initiative and commitment to implement such innovations.^18,19

Among the many challenges to informed consent in mHealth, the problem of reconciling commercial terms of use with informed consent is perhaps most pressing for the field. Compared to most commercial contexts, the Common Rule²⁰ and the Health Insurance Portability and Accountability Act (HIPAA) set high standards for the protection of patient and research participant data in medical settings. However, cost effective applications of mHealth technologies in medical care and research depend on bringing apps and devices developed in commercial contexts into medical settings. Maintaining a high standard of privacy protection in research and health care utilizing mHealth technologies will require attention to important differences between informed consent and commercial terms of use documents—specifically, differences in readability, content, and the protections afforded. We argue that the principles that underlie informed consent should guide professionals who adopt mHealth technology as they seek to maintain transparency and protect the interests of mHealth participants and patients. If legitimate health research and care are to incorporate these tools, health professionals and their institutions must work to promote transparency and public trust by addressing the challenges to informed consent. We point to opportunities for institution-based researchers to lead the way in this effort.

Ubiquity of Commercial Terms of Use and Privacy Policies

The unique obstacle for mHealth with respect to informed consent is that users—whether research participants, patients, or “lifeloggers” (people who digitally record all aspects of their lives)—are nearly always required to agree to terms of use of the underregulated commercial entities supplying mHealth devices and services. Typical terms of use for commercially developed apps and devices, including those used in research, include lengthy legalese and may stipulate the release or selling of personal identifiable data,^9,10,21-24 thus representing a significant departure from the principles of informed consent. Moreover, in medical settings, institutional review boards (IRBs) often require clear and explicit language stating risks—including risks to privacy—as well as statements of how confidentiality will be protected, but there is a challenge in reconciling IRB-approved informed consent documents with the terms of use set forth by commercial entities.²⁵

While some researchers might have the resources and expertise to develop their own devices or apps, in most cases mHealth researchers will make use of commercially available tools for their studies. In these cases, researchers broker a relationship between study participants and the company supplying the technologies or acting as the first point of collection for the data. Thus, they are put in the position of requiring that participants accept commercial terms of use as a condition of study participation, thereby subjecting participants to any risks related to those terms. Furthermore, the number of required documents proliferates for each sensor, smartphone, app, or data service used. For example, a study led by the senior author (CSB) required participants to agree to up to 5 different terms of use documents in addition to an IRB-approved informed consent.²⁶ Requiring participants to review such a large number of agreements makes it less likely that they will be able to devote the necessary energy to understand the content before consenting, rendering such consent “uninformed” rather than informed. In theory, this situation could be an opportunity for researchers to protect participants from questionable consumer contracts or commercial use of their data, either by subjecting commercial terms of use to IRB review or by negotiating with companies to create more user-centered terms of use. In practice, however, IRBs may or may not have adequate resources or expertise to thoroughly evaluate these terms. In addition, companies may resist changes to these terms as they are designed to limit their legal exposure and protect their commercial interests. The burden of convincing companies to incur the potential liability and expense of altering terms of use cannot be borne by individual researchers or clinicians,²⁷ and hence this task requires collective action.

Continued Importance of Informed Consent in the Age of mHealth

The tradition of informed consent will serve as an invaluable resource for the field of mHealth as it faces the challenge of protecting user interests in privacy and transparency. Maintaining public trust and willingness to engage with new technologies is, after all, essential to realizing the power of mHealth to improve both individual and population health.

Studies of attitudes toward data sharing indicate that people prefer to be asked for permission to use their data in research, especially when health information is involved.^6,28-31 A recent survey showed that 68% of users of digital self-tracking technologies said they would share personal health information “if privacy were assured” and 67% felt anonymity was “very” or “extremely” important.⁶ Another survey found that respondents across generations were concerned about health privacy,³² contrary to popular assumptions about millennial disinterest in privacy. While it might be assumed that early adoption of health technologies is coupled with a disinterest in privacy, a qualitative study of privacy attitudes among early adopters of personal wearable sensors and health apps demonstrated that members of this group placed a value on personal data privacy and expressed the desire to control their personal data.³¹ Such findings underscore the importance of notification about data uses and consent in maintaining relations of trust when asking for personal health information.

The European Union’s (EU’s) new General Data Protection Regulation (GDPR) is another indication of current interest in protecting privacy and in transparent consent. The GDPR requires that, in most commercial situations, contracts present explicit opportunities for signers to consent to the collection and use of any personal information.³³ Furthermore, the GDPR demands that requests for consent be legible and accessible, that the purpose of collecting data be stated, and that consent be obtained at the point of data collection and be easy to withdraw.^34,35 While not law outside of the EU, the GDPR reflects some common expectations about privacy and has the potential to become an international gold standard for individuals concerned about their personal privacy.

Opportunities to Promote Informed Consent and the Protection of Privacy

In our view, the challenges we have raised are best approached as opportunities for health care and research institutions seeking to leverage mHealth technologies to lead the important work of creating user-centered informed consent procedures.

The first step for those who wish to incorporate mHealth into medical research or clinical practice is to be aware that commercial data collection, transmission, storage, access, and use are underregulated and not standardized. For this reason, researchers and physicians should take the opportunity to be savvy consumer advocates when selecting the products they recommend and keep in mind that commercial partners typically use collected data for their own purposes. As an example, Fitabase, a company that serves as a bridge between academic researchers and Fitbit, a company that makes devices and apps to monitor fitness-related metrics, suggests that researcher-initiated strategies for protecting privacy such as creating anonymous Fitbit accounts with limited demographic data, not collecting GPS data, and maintaining a schedule for deleting data could be worthwhile.³⁶

Ultimately, though, what is needed are strategies to ensure that data-sharing practices are safe and transparent without limiting the potential of mHealth tools to improve health. The GDPR is one attempt to reign in current unregulated activities through a comprehensive law, but the strategies the GDPR uses are similar to, and perhaps more stringent than, HIPAA and the Common Rule, which some argue strangle 21st century US medical research.³⁷ In an attempt to facilitate research, recent changes to the Common Rule have expanded exemptions for informed consent,^6,7 but expanding exemptions may become an increasingly unpopular option for mHealth research as the public becomes more concerned about privacy in relation to consumer devices and apps. Other ideas include individualized or granular consent³⁸ or adopting “opt out” policies in certain contexts such as learning health care systems where the potential benefits of mHealth research for collective health may outweigh the importance of individual autonomy. Finally, Evans³⁹ has suggested a model of health data commons—new systems of governance that would allow individuals to lend their health data to research as part of a collective that would democratically set the terms for data use. All these approaches are ways to reinvent informed consent. Even the innovation of a data commons would not be the lack of consent—individuals would make the choice to join or leave the collective—but rather the opportunity to collectively negotiate the terms of that consent.

The national Precision Medicine Initiative project, All of Us, may be well situated to lead in creating user-centered terms of use for mHealth users. All of Us aims to enroll “one million or more people living in the United States” in the largest precision medicine cohort study to date.⁴⁰ Participants will be asked to contribute information via mHealth platforms in addition to genetic material and survey responses. The wide reach, resources, and scale of All of Us affords a unique opportunity for the cooperating institutions to negotiate with commercial partners for terms of use that meet stricter standards for both the presentation of informed consent documents and the data handling practices they use. This goal might be accomplished, for example, by creating a consortium of mHealth researchers working under the umbrella of All of Us to purchase products and services together under conscientious privacy policies designed to minimize data sharing among commercial partners. At present, we are not aware of any such coordinated efforts. Whatever policies and practices are developed by All of Us could serve as a model for smaller precision medicine projects as well as set a standard for handling mHealth data in any context.

Conclusion

Leaders in health care and research who seek to leverage mHealth technologies should draw upon the strength of informed consent as they face the challenge of managing unique privacy risks to users. For research participants and patients, informed consent expresses an exercise of autonomy and choice and is a symbol of professionals’ good faith to handle personal data with integrity and transparency. Informed consent can strengthen trust in relationships across research and clinical practice, and therefore research and health care institutions should seek opportunities to promote and develop better systems of consent and oversight in the age of mHealth.