Patient Engagement

  Patient engagement requires patient identifiable data

 The security and confidentiality of patient medical records has always been a major issue for hospitals and caregivers. Traditionally these records were paper based and held in secure hospitals files. Access required approval of the hospital ERBs.  However, this access has become more complex and challenging with the explosion of digital information, smart phones and social media.

Clinicians encourage “Patient Engagement” in managing diseases. To be engaged, patients need to be able to access their clinical history. Patients (particularly rare disease patients) expect online access to their records.

“I do my tax and banking online why can’t I access my health records online too”. 

Patients frequently request that we provide a report where they can access a summary of their condition. Rare disease patients/ caregivers regularly see different doctors and do not want to fill out the same forms over and over again.

 The following medical record fields are classified as Patient Identifiable Data (PID):

·       Name

·       Date of birth

·       Email address

·       Mailing address

·       Telephone

·       National identification number

Historically many ERBs do not want PID recorded in a registry. All these fields are replaced by a unique identifier and the data is said to be anonymized. This is to eliminate any potential data breach. However, this seriously limits the features and capabilities of the registry.

The good news is that many ERBs are now supporting collecting PID data in registries.  If the ERB takes a particularly conservative view, we recommend that the registry be setup to use anonymized data initially. Overtime the registry can start to support recording some identifiable data and follow the trend towards patient empowerment across Europe.

The GDPR regulations do not apply to data that is fully anonymized. However, anonymization is not actually defined withing the legalisation. It is in fact difficult to isolate a patient’s data from a patient; particularly if there are only a small number of patients as in rare diseases.   

We have seen numerous “anonymized” registries that include a patient’s date of birth. As date of birth can in nearly every case be used to uniquely identify a patient, we recommend it should be replaced by year of birth for anonymized reporting.

In an anonymized registry the patient identifier data should be kept in a secured spreadsheet outside of the system. it will be necessary to prove to the Data Protection Officer that there was Data Protection By Design (as defined in GDPR) in the registry.

It is much harder to defend a password protected spreadsheet as meeting the GDPR requirements of Data Protection By Design In event of a data breech,  since the password and spreadsheet can be easily emailed or copied onto a memory stick.

It is preferrable to have PID within REDCap, because it supports Data Protection By Design.  This includes being able to classify patient identifiable fields and restricting their access only to those who need to know. Reports are anonymized by default unless the user has specific rights to export identifiable fields. REDCap supports a full audit trail which provides a complete log of all user interactions including request to run reports.

Patient Identifiable Data is required to support:

1)    Patient self-enrolment.

2)    Dynamic consent to support the explicit consent requirement of GDPR.

3)    Patient surveys for patient engagement in PROMS.

4)    Duplicate detection.

Patient self enrolment:

 By clicking on a web link, patients can enrol in the registry. This allows them to enter initial demographic and disease history along with completing and electronically signing online consent. The signed consent form is automatically stored as a PDF in a secured folder in the registry.

The next time their doctor logs on she would see a list of new patient records to be reviewed and completed before being accepted onto the registry.

Explicit consent

GDPR requires explicit consent. This means that patients cannot consent for future unspecified event like “all studies”.

REDCap supports online “dynamic consent” where a record of patient enrol in specific studies can be easily tracked. Paper based consent by comparison is simply too cumbersome; particularly if the patient’s email is not known. Indeed COVID-19 has further increased the trend away from paper-based consent to online consent.

By way of example, the UK Vasculitis registry has approximately 6,000 patients whose original consent was held in multiple hospitals over many years. Re-enrolling them in new version of the registry is proving to be logistically challenging.

Patient engagement

Patients can enter their own data in REDCap through email-based surveys. This is like the popular Survey Monkey web application. There is no need to provide patients with an account or password and they have no direct access to the REDCap database.

This has a much lower security risk than providing patients with their own account in the registry. Patients can enter data such as a quality-of-life measure (QoL) or update their consent.

Duplicate detection

If you remove all personal identifiable data, it's easy for duplicates to enter database which makes reporting inherently wrong. It isn’t just duplicates within the hospital, it's also tracking patients who move either temporarily or permanently to other hospitals or other countries.

We have seen many examples such as in the Cystic Fibrosis registry where the same patient is recorded in multiple hospitals. This resulted in missing and incomplete historic clinical data. This could adversely impact the subsequent treatment and health of the patient.

“My banking and tax records are online why can’t I access my health record online”

The Federated Registry can publish annual population and outcome reports. This will show how patients are doing in comparison to their peers both within their country and across Europe. Click the button below to look at the annual outcome reports published by the European Cystic Fibrosis Registry: 

Make the Registry useful for Clinicians

A Smart Registry that understands the patient’s disease will become an active Rare Disease Patient Management system instead of a passive paper collection form

The “Smart” Registry as an active Rare Disease Patient Management system

Many clinicians assume the new registry will just be an online version of the paper form they had to fill out or that the registry staff will continue to collect paper-based forms from the hospital.

We view the registry as an Active Rare Disease Patient Management system that can track and record the treatment and care of rare disease patients. New Paragraph