Navigating Privacy in Health Data Sharing: A Patient-Centric Approach to Health Information Exchange

Abstract

Personal health information (PHI) sharing through Health Information Exchange (HIE) enhances patient safety in Canada, yet not all provinces and territories voluntarily disclose PHI on safety incidents to federal and pan-Canadian surveillance systems. A frequently cited barrier by healthcare organizations for HIE between different interoperable health databases is patients’ and families’ concerns for their privacy. This explorative qualitative study examined patients’ and families’ attitudes toward PHI sharing, including its secondary use in patient safety events. Rather than expressing reluctance, participants described support for HIE when privacy safeguards, such as defined sharing purposes and anonymous formats, were in place. These findings present a significant opportunity for health leaders and data custodians to use the research findings to create a patient-centric framework for the HIE of PHI.

Introduction

Patient safety is essential to quality healthcare, yet occurrences of harm continue to shape patient experiences and outcomes. In Canada, an alarming 1 in 17 hospital stays results in harm. ¹ Reducing patient safety incidents is fundamental to healthcare excellence, but meaningful progress depends on the effective reporting, investigation, and analysis of these events. Surveillance systems play a crucial role by aggregating anonymous patient safety data to track and forecast health risks, equipping health leaders with insights to improve patient care. ²

Canada’s Food and Drug Act ³ mandates the reporting of adverse drug reactions and medical device incidents to the Canada Vigilance Database, commonly known as Vanessa’s Law. ⁴ Despite the importance of surveillance, the legislation does not require broader HIE of patient safety incident data. For instance, only six provinces and territories participate in hospital surveillance of medication incidents through the Canadian Institute for Health Information’s (CIHI) National System for Incident Reporting (NSIR). ⁵ Without external reporting requirements, data custodians face challenges in navigating privacy legislation governing PHI. This lack of mandated reporting significantly limits the potential for comprehensive patient safety surveillance and performance monitoring. In provinces and territories with underdeveloped performance infrastructure, this gap reduces health leaders ability to identify jurisdictions that are making significant gains in patient safety and those that need more focused support. A systems thinking approach, requiring coordinated action across all levels, emphasizes the need for robust safety surveillance practices to improve care outcomes. ⁶

What remains unaddressed in policy and legislation are the perspectives of patients and families. This novel research identifies the absence of a person-centred perspective in patient safety surveillance. It explores how patients and families view the disclosure of Personal Health information (PHI), a key consideration in shaping policy and addressing concerns about its secondary use. By actively including these perspectives and moving beyond assumptions about privacy concerns, health leaders can better navigate Health Information Exchange (HIE) challenges and support informed, patient-centred approaches to data disclosure. This, in turn, strengthens reporting mandates and enhances patient safety outcomes.

Methods

A qualitative descriptive study, ⁷ approved by the University of New Brunswick’s Research Ethics Board, explored patient and family perspectives in New Brunswick, Canada, on how information is shared about patient safety incidents, defined as events causing unnecessary harm during healthcare delivery. Specifically, how PHI on these incidents may be used to improve safety outcomes. English or bilingual patients or family members with firsthand and second-hand experiences of such incidents were purposefully selected for this study. Participants were recruited through social media, advertisements, snowball sampling, and community message boards. Semi-structured one-on-one interviews were conducted via phone or video conferencing, recorded in Microsoft Teams, and transcribed verbatim. Transcriptions were reviewed for accuracy, with filler words removed and pseudonyms assigned to participants before organizing the data using MS Word. The texts were collated and organized by codes in an open-source qualitative analysis software, Qual Coder™, to show code frequencies. Data were analyzed using thematic analysis guided by Braun and Clarke’s 15-point criteria checklist, ⁸ leading to the identification of relationships across transcripts and the development of a thematic map illustrating key connections.

Results

Eight participants were purposefully selected from New Brunswick’s three different health regions to capture patient and family experiences of harm in two health authorities. Participants for this study predominantly identified as female, White, aged 45-50 years, and English-speaking (see Table 1). All the participants had a minimum of a high school education, and most reported having a post-secondary degree (75%). While many of the patients, and their family members, who participated in this study had experienced a patient safety incident within the past 5 years (63.5%), a significant number experienced an incident more than 5 years ago (37.5%). Three participants reported experiences of harm in both zones 1A and 1B.

Table 1.

Sociodemographic Characteristics (n = 8)

Characteristic	Attribute	N (8)	Full sample
Participant type	Patient	4	50%
	Family member	4	50%
Gender	Identified male	2	25%
	Identified female	6	75%
Age	30-35 years	1	12.5%
	40-45 years	1	12.5%
	45-50 years	3	37.5%
	55-60 years	1	12.5%
	60-70 years	2	25%
Race	White	8	100%
Timeframe incident occurred	<1 year ago	1	12.5%
	1-5 years ago	4	50%
	>5-10 years ago	1	12.5%
	>10+ years ago	2	25%
Highest education completed	High school degree	2	25%
	Undergraduate degree	4	50%
	Graduate degree	2	25%
First language	English	5	62.5%
	Bilingual	3	37.5%
Health zone	1A	3	37.5%
	1B	5	62.5%
	3	3	37.5%

Four main themes were identified to describe participants’ thoughts regarding PHI’s collection, use, disclosure, and retention of patient safety incidents and the HIE of that data for safety surveillance. These four themes include (1) criteria for privacy, (2) conditions for access, (3) types of data for HIE, and (4) the purpose of HIE to help others.

Criteria for Privacy

Participants emphasized two key criteria for privacy: (a) maintaining the security of personal health information (PHI) and (b) ensuring access is limited to those who need it to help a patient. While patients recognized protections such as password authentication, concerns remained about potential breaches and the role of institutions in safeguarding data. At the same time, there was strong support for authorized access among care teams to enhance patient outcomes. As one participant stressed, “More information makes it more powerful…more knowledge to help the patient” (P03).

Conditions for Access

Participants identified three conditions under which access to patient safety incident information is appropriate: (a) to help the patient, (b) to help others, and (c) with access limitations to prevent harm or misuse. Participants supported sharing identifiable health information within a care team to ensure continuity and quality of care, and they emphasized the societal value of data sharing to improve healthcare for others. These futuristic gains included “public safety, public health good” (P01), to “help people that are in a situation like I am” (P02), and to “make things better for someone else” (P04). While participants endorsed altruistic sharing when it served patients or the public, they opposed access that could cause financial harm to patients or benefit others financially. However, the use of such information to secure government funding for safety improvements was deemed acceptable.

Types of Data for HIE

Participants differentiated between two primary types of data for health information exchange: (a) identifiable data, which should be safeguarded and shared only with authorized care providers to directly help patients and (b) anonymous information or aggregated data, viewed as more appropriate for broader use to help others. While all participants agreed on the need to protect identifiable information, views varied on appropriate conditions for its access. Aggregated data were generally seen as less risky and more acceptable for wider sharing as they represent multiple individuals whose data are combined and are by default rendered nearly anonymous. As one participant remarked, “If they’re aggregating it, it is properly anonymized…they could honestly do anything they wanted with the data as far as I’m concerned” (P01).

Purpose of HIE to Help Others

Participants identified three key purposes of health information exchange (HIE) that serve to help others: (a) accountability, (b) system improvement, and (c) research. They viewed HIE as a means to ensure healthcare organizations are held accountable through oversight enabled by the sharing of anonymous or aggregated patient safety data. As one patient participant explained, “Everybody needs to have someone to look over what they’re doing… to make sure that what they’re doing is appropriate and/or legal...as long as they themselves have the knowledge, they have a right to look over what they are doing and [to do] something about it” (P03). Patients also felt that HIE could support meaningful changes in the health system by helping leaders (e.g., the Department of Health) identify recurring issues and take steps to prevent similar incidents. Additionally, they expressed strong support for the use of anonymized data in research that could lead to new treatments or a deeper understanding of healthcare challenges to help others benefit from their experiences.

Discussion

This study provides valuable insights into how patients and families perceive the use of personal health information (PHI) for patient safety surveillance. It highlights three interconnected concepts vital to public trust: strong information security, clear access conditions through a “social license,” and the influence of personal values and beliefs on privacy attitudes.

Participants emphasized the importance of robust data protection, especially those who had experienced harm in healthcare. For them, security was a baseline expectation. Their views align with studies by Majorana et al. and Paprica et al., which highlighted the link between trust in health systems and confidence in privacy safeguards.^9,10 Transparent communication about PHI protection could improve trust in HIE initiatives used for safety surveillance. ¹¹

The study also highlights the importance of social license, defined as the public’s expectations for data sharing. ¹² Consistent with national findings, participants supported PHI use when its purpose was clearly articulated and aligned with public interest. ¹³ Support, however, depended upon who accessed the data and under what conditions. These insights suggest the need for policy frameworks that involve the public in clarifying and communicating access parameters to maintain trust. ¹⁴

Finally, the study revealed how deeply held values and lived experiences influence privacy attitudes. Drawing upon the Theory of Reasoned Action, this research illustrates how individual beliefs and prior experiences among those harmed by safety incidents shape judgments about what is appropriate or acceptable in terms of PHI use. ¹⁵ This study shows that individuals affected by safety incidents were more likely to support data sharing if it promised meaningful change and accountability. Their views suggest a policy foundation rooted in real-world experience.

This study serves as a starting point for understanding patient-centred perspectives on the HIE of PHI for patient safety. A limitation of this study is that the sample remained relatively homogeneous, primarily of white, older adults who spoke English or French. Given Canada’s diverse health systems, findings may be most applicable to this demographic. Participant experiences are context-specific, and differing results in future studies should not undermine the trustworthiness of this research, but rather reflect the varied environments, cultures, and personal perspectives. The absence of Indigenous and racialized participants limits sociocultural representation, particularly regarding information sharing and patient safety. Upholding Indigenous data sovereignty requires future research to be led by or conducted with Indigenous communities, ensuring meaningful inclusion of their perspectives, governance structures, and knowledge systems, critical for equity in patient safety research.^16,17

As a novel area of inquiry, this study lays the groundwork for broader, more inclusive research across Canada’s diverse populations. Ultimately, this study emphasizes the importance of grounding health data policy in the lived experiences of patients and families. Security, transparency, inclusivity, and alignment with public values are essential to building trust and enabling ethical, effective safety surveillance.

Conclusion

When provinces and territories do not mandate HIE for patient safety surveillance, third-party data sharing remains voluntary. As a result, custodians may withhold critical information due to privacy assumptions, limiting health leaders’ ability to monitor and improve system-wide safety and quality. This study explored the perspectives of patients and family members affected by harm regarding the privacy of PHI and its exchange with provincial, federal, and pan-Canadian organizations. Thematic analysis suggests a potential social license for the secondary use of PHI in HIE related to patient safety incidents. While broader research is needed to incorporate diverse Canadian ethnocultural perspectives and refine boundaries of social license, establishing a policy or standard aligned with legislation, privacy principles, and public trust could support a patient-centred framework for PHI exchange. Provincial and territorial frameworks would be further strengthened by a national approach to security, access, and HIE, improving data timeliness and enabling health leaders to derive meaningful insights to improve patient outcomes.