Physician privacy concerns when disclosing patient data for public health purposes during a pandemic influenza outbreak

A number of theories and instruments have been used to measure and explain the relationship between information privacy concerns and individual behaviours [30, 31, 50, 51]. Although none have been used in the context of disclosing patient information for public health purposes, we utilized them as a starting point to articulate a set of constructs, and a high level set of relationships among them. These guided our data collection and analysis.

A key one is Social Contract (SC) theory, which requires an equitable exchange and shared understanding about contractual terms and self-control over the course of a relationship [30, 52, 53]. In the context of information privacy, this theory suggests that an organization's collection of personal information is perceived to be fair only when the individual providing personal information is granted control over, and is informed about the organization's intended use of the personal information, and the disclosure of the information is perceived as equitable with some benefit back to the individual [30, 52‐57]. This leads to three important constructs which have been linked to the intention to disclose personal information: collection, control and awareness.

Collection, control and awareness affect the intention to release personal information through two intervening constructs: trusting and risk beliefs [30]. The reasoned action paradigm states that behaviour intention is a reliable predictor of actual behaviour [58, 59].

The trust/risk/intention model states that in situations in which potential risks are present or perceived, trust plays an important role in predicting an individual's behaviour [60, 61]. Trusting beliefs refer to the degree to which individuals believe that an organization is dependable to protect their personal information [62]. Risk beliefs refer to the high possibility for loss associated with the release of personal information to an organization [63].

Collection, control and awareness affect trusting beliefs [30]. Enhancing trusting beliefs will have a negative effect on risk beliefs (reduce risk perceptions), and will consequently facilitate intention to release personal information [30]. It has also been shown that trusting beliefs have a direct positive effect on the intention to release personal information [30]. Therefore, trust and risk beliefs are intervening factors that play an important role in facilitating or inhibiting the disclosure of personal information.

In our study we focused on exploring how the collection, control and awareness constructs affect intention to disclose information to public health for Influenza-Like-Illness (ILI)/H1N1 surveillance and reporting by affecting trusting and risk beliefs.

Influenza is a disease under national surveillance [64] through many mechanisms, some of which vary from province-to-province.

The FluWatch program collects summary data from volunteer sentinel physicians across Canada [65]. The data reported weekly by participating physicians include: patient age in intervals, practice postal code, total patients seen, and the sentinel number, which identifies the reporting physician.

In addition, in some provinces, influenza is a reportable disease, with legislation requiring nominal reporting of patients with influenza, although nearly all reports are of confirmed cases from laboratories. Jurisdictions such as Manitoba [66], Nova Scotia [67], the Northwest Territories [68], and Ontario [69] collect: the patient's first name, surname, sex, full date of birth, full postal code, practice postal code, and the physician's name.

At the outset of the H1N1 pandemic, many provinces deemed cases of H1N1 influenza to be reportable, however, most reports continued to be of confirmed cases from laboratories, and follow-up was not possible for all cases as the number of reports increased. Subsequently, many jurisdictions required reporting for only hospitalized cases of H1N1 influenza. As examples, the case report forms contained the following fields across Alberta [70] and Newfoundland and Labrador [71]: patient's first name, surname, sex, date of birth, full postal code, pregnancy status, asthma history, COPD history, chronic heart disease history, and diabetes history.

Another H1N1-specific national surveillance program coordinated by the Public Health Agency of Canada [72] collects data directly from practice electronic medical records (EMRs) after their customization with new templates: age, gender, pregnancy status, presence of a chronic medical condition, such as cardiac, pulmonary, or diabetes.

In our study, we examined the willingness to disclose the specific fields noted above, since they were collected at some point during the 2009-2010 H1N1 pandemic.

This mixed methods study used a triangulation design [73, 74] to explore what Canadian family physicians were willing to disclose to public health agencies, as well as the specific privacy issues that impacted the disclosure of information. With the assistance of a trained moderator, we conducted a series of five focus groups with family physicians in Canada, and asked each focus group participant to complete a questionnaire. The focus groups occurred during week 41 of 2009 (October 29-31), just as widespread influenza activity was starting to peak in Canada [75]. The study was approved by the Children's Hospital of Eastern Ontario Research Ethics Board prior to commencement.

In terms of deciding on an adequate number of participants and/or focus group sessions, there is no standard that is generally accepted. However, there are a few considerations that one should take into account when deciding on the number of participants required [76, 77]. Firstly, there is the consideration that there are a limited number of viewpoints on a topic. Having a greater number of participants does not therefore necessarily entail a greater understanding of the topic [77]. The researcher can get a sense of how the group may be divided on an issue before commencing the focus groups by way of the published literature on the topic and/or by speaking with individuals in the group of interest [77]. Although opinions can vary, this would give the researcher an idea of when he/she has reached saturation; the point at which there is nothing new to be uncovered on the topic [76, 78]. Krueger and Casey suggest starting with 3-4 focus groups to uncover the range of opinions on the topic [78]. If new ideas continue to appear, more focus groups should be undertaken, until the point of saturation is reached [78]. Once saturation has been reached, further interviews or focus groups will no longer be necessary nor particularly useful [76‐78].

Secondly, the researcher's own ability to recall, process and understand the interviews needs to be considered [77]. As Gaskell points out, "the interviewer must be able to bring to mind the emotional tone of the respondent and to recall why they asked a particular question" [77]. Therefore, there is a limit to the number of encounters that the researcher will be able to recall in detail. For group interviews, Gaskell suggests that this limit would be 6-8 sessions [77].

A recent literature review has noted that the median number of focus groups conducted in health sciences research was 5, with a median of 32 participants [79].

Consistent with the recommendations in the literature and with precedents, we planned for five focus groups with a maximum of eight participants in each. We expected to reach a point of saturation in terms of new concepts identified within that. This expectation was partially driven by discussion with family physicians in preparation for the focus groups whereby we observed consistency in their views on data sharing for public health purposes.

For the purposes of this study, purposive sampling was used [80]. Participants in the focus groups were recruited in advance of the Family Medicine Forum (FMF) in Calgary, Alberta via email invitation. The FMF is an annual conference of family physicians organized by the College of Family Physicians of Canada. The sampling strata used were years of practice (< = 5 years, between 6 and 10 years, and > 10 years), gender, location (rural vs. urban) and region of Canada (East, Central, West). The recruitment target was 8 participants for each of the five focus groups. Assuming a 33% no show rate, we aimed for 60 registrations. Invitations were sent to registered FMF delegates by email in advance of the conference, ensuring that all the strata were covered among those invited. Invited delegates self-selected to participate in the study.

The invitation email was sent by the College of Family Physicians of Canada. The email had basic information about the study and a link to a web page with an electronic consent form. The electronic consent form included a description of the study and its procedures, a description of withdrawal rights, data confidentiality, and information on how to contact the first author and the REB chair. Respondents could then enter their name and email address, and select the most suitable time for them for a focus group. By completing the form the respondents indicated their consent to participate.

A total of 37 Canadian family physicians participated in the study.

The focus group sessions were conducted in a private meeting room at the FMF. At most two focus group sessions were held per day during the three day conference.

At the outset of each focus group, the participants were asked to complete a short questionnaire on paper to gather their views on data sharing. The questions included in both the questionnaire and focus group guide were constructed based upon the literature, our anecdotal experiences with the data sharing practices of physicians, and a pilot study with four physicians, who provided us with additional feedback and information.

The questionnaire and focus group guide consisted of two components. The first asked about willingness to disclose certain data elements to public health, and contained 15 items. These were the data elements that we found in current ILI/H1N1 case report forms used across the country. A set of 14 factors that we hypothesized would increase the willingness to disclose the above information were included in the second component of the data collection tools. We used a semantic differential scale [81] where a score of 1 meant "less willing to share data" and a score of 7 meant "more willing to share data" with public health.

For both the questionnaire and focus group guide, we formulated a scenario to ground the participants in a realistic example. In the scenario, the participants assumed that they had been requested to provide patient-level data to a municipal public health unit for the purpose of surveillance of ILI, specifically, H1N1 surveillance. As part of the scenario, we told participants that only individual level data on the patients who meet a particular case definition would be disclosed to the public health unit, as well as denominator totals. They were also informed that, in some jurisdictions, this reporting was mandatory.

The questionnaire responses were transcribed into SAS. Ten percent of the questionnaires were randomly selected and cross-checked against the data entered in SAS by a different person than that who transcribed the data to check for systematic errors.

We first computed descriptive statistics on the questionnaire responses to understand the central tendency of the responses and variation to gauge consensus. The objective of that analysis was to document the fields that the participants were willing to disclose to public health, the factors that would change their willingness to disclose, and to understand if variation in participant responses can be explained by years of practice experience and gender.

Since some of the items in each section of the questionnaire are expected to be strongly related, we also grouped them into a smaller set to help with interpretation. To do so, we computed the mean absolute difference between each pair of items (105 pairs for the first part of the questionnaire, and 91 pairs for the second part). We used the difference instead of a product moment correlation for two reasons. First, the responses on two items could be strongly correlated but very different. It would not be appropriate to combine two items if they were different. Second, if the absolute difference were small, then it meant that the scores of the two items were close to the 45 degree positive diagonal, which implied a high positive correlation. The three criteria used for grouping elements were: (a) a mean absolute difference less than 1, (b) the grouping of items was meaningful, and (c) the group was consistent in its scoring (for example, if the difference between items between B and C was larger than the difference between items A and B, and A and C, then that three item grouping would not be consistent). Regarding criterion (b) the judgement was subjective, but it was almost always obvious. For example, grouping a high willingness to share the patient's first name with a high willingness to share a patient's COPD history would not be meaningful, but grouping the first name with the last name is more meaningful. Regarding criterion (c) we used the consistency ratio from the Analytic Hierarchy Process (AHP) to quantitatively evaluate the consistency among pairwise comparisons [82, 83]. AHP is a widely used multi-attribute decision making methodology which utilizes comparisons by experts. Within AHP an analyst computes an index based on a matrix of pairwise comparisons and compares it to the value from a random matrix. The greater the consistency the closer the index is to zero. A ratio greater than 0.1 is considered representative of excessive inconsistency.

After grouping the items, we had a profile of responses for each participant on each of the two questionnaire sections. To understand whether the differences among participants were related to their years of practice and gender, we needed to define profile similarity measures. There are three ways to evaluate profile similarity: shape, elevation, and scatter, as illustrated in Figure 1[84]. Shape pertained to the pattern of responses to the items. Two profiles had the same shape if their responses were correlated. Elevation pertained to the proclivity of a participant to be willing to share information in the first part of the questionnaire, and their proclivity to change their willingness to share information in the second part. It was measured by using the mean score across all of the items. Scatter pertained to their variability in responses, and was measured as the range of item responses.

To assess differences in shape, we first grouped response profiles using a hierarchical clustering algorithm. The linkage method was Ward's [85]. The similarity measure among participants was the correlation coefficient. The emergent groups were compared on their mean years of experience, using a one-way ANOVA, and on gender using a chi-square test. This told us if the respondents differed by years of practice or gender in their response shape. The analysis was repeated using a Kruskal-Wallis one-way ANOVA, which provided a more robust test of medians across groups.

To assess if years of practice or gender were associated with elevation, we computed the correlation coefficient between the mean scores of each participant and years of practice, and compared males vs. females on mean scores using a t-test. Similarly, to assess if years of practice or gender were associated with scatter, we computed the correlation coefficient between the score range of each participant and years of practice, and compared males vs. females on score range using a t-test. All statistical significance tests were performed at a two-tailed alpha level of 0.05.

The focus groups were audio-taped and transcribed verbatim. We used an approach informed by grounded theory [86, 87] to analyze them. The objective of the analysis was to understand the reasons why the participating physicians were unwilling to share selected data elements. Data analysis began immediately after the first focus group session, and continued until a set of stable themes developed. Following each focus group session, the trained facilitator, assistant facilitator, and note taker engaged in a debriefing meeting, and conducted a cursory analysis of the audio recordings and field notes from the session. In this meeting, they revised, added, or removed selected open-ended questions in preparation for the next focus group session. As such, the questions used in each focus group were slightly different and became increasingly specific as the concepts needed to develop an understanding of physicians' perceptions about providing patient-level data to public health in the context of a pandemic disease outbreak became evident.

Using the constant comparison method [87], as well as the above-mentioned constructs from the literature, we also developed, modified, and agreed upon a coding scheme that embraced the themes presented in the data. Two research team members trained in qualitative research methods independently coded the transcripts using NVivo software and an inductive process. Once the members completed their independent coding, they shared and compared their coding, as well as discussed the accuracy of it. At this point, they modified, merged, or eliminated codes and revised their analyses.

Forty three physicians registered to participate in the focus groups, and 37 showed up. This amounts to an 86% participation rate, which is slightly higher than the participation rate we had assumed in the design (40/60 at 66%).

The 37 participants had a mean of 16.3 years of practice experience, with a maximum of 43. The overall family physician population summary data from the 2007 National Physician Survey (NPS) [88] reported that the mean years of practice experience was 19.6, with a maximum of 55 years.

There were 24 female (65%) and 13 male (35%) participants. The 2007 NPS reported 60% of family physicians are male and 40% female.

The distribution by province was: 18 from Western Canada (49%), 14 from Central Canada (Ontario and Quebec - 39%), and 5 from Eastern Canada (13.5%). The 2007 NPS reported that approximately 35% of family physicians practice in Western Canada, 59% in Central Canada, and 9.3% in Eastern Canada.

Compared to the physician population, our participants had slightly less practice experience, and were more likely to be female. Furthermore, physicians from Central Canada were under-represented whereas physicians from other regions of the country were over-represented.

The results for the questions on which types of fields the physicians would be willing to disclose are provided in Table 1. There was strong reluctance to provide patient names, a weak willingness to provide dates of birth, postal codes, and initials, a moderate willingness to reveal their own names, the number of patients in their practice, and clinical information about the patients, and a stronger willingness to share patient sex, the total number of patients seen during the reporting period, and the practice postal code. The least consensus was in their willingness to share the patients' postal codes, date of birth, initials, and the most consensus was on their willingness to disclose the patients' sex.

If we assume that the willingness to disclose is positively associated with perceived sensitivity of the information, then there was the most consensus on the least sensitive fields, and less consensus on the most sensitive fields. This would be the expected pattern.

We grouped the following items: (a) items A1 and A2, (b) items A7 to A11, and (c) items A14 and A15. Those in group (a) pertain to the patient's name, and the participants didn't see much difference between disclosing the first and second name. The items in group (b) pertain to underlying conditions. The participants treated all of the underlying conditions equally in terms of willingness to disclose and did not provide an indication that they differ in their sensitivity. The items in group (c) pertain to summary information about the practice. Group (b) had a consistency ratio below 0.1 (consistency does not apply to the other groups with only two items).

Table 2 shows the willingness to share less/more information under certain conditions. The factors that had little impact on their willingness to disclose information to public health were: linking the data to other data sets, whether the public health unit was provincial, federal or municipal, and the type of condition or disease that was under surveillance. The factors that had the largest influence on their willingness to share information were: their commitment not to share the data with other parties, and whether the reporting was mandatory. Other factors that would have an important effect on their willingness to disclose information included if the data was de-identified, if their Colleges endorsed the disclosure, if feedback was provided, if the disclosure was only for a limited period and afterwards the data would be destroyed, and if a research ethics board approved the data collection. None of the factors would actively dissuade them from sharing data, but that was largely a function of the wording of the questions.

The following items had a mean absolute difference smaller than one point and were grouped: (a) B1 and B2, (b) B5 and B6, and (c) B10 and B11. The items in group (a) pertain to the jurisdiction of the public health agency. The physicians did not differentiate between federal or provincial jurisdictions. The items in group (b) pertain to exerting control over the data through de-identification, and limits on sharing with third parties, which they perceived as having equal impact on willingness to share information. The items in group (c) pertain to independent oversight, irrespective of who provides it.

We did not find any statistically significant differences nor associations among the participant profile shape, elevation, or scatter and the physicians' years of practice experience and gender. This means that variation in years of practice experience and gender do not explain variations in the participant responses to the questions.

The qualitative findings are organized into six themes. Each theme presents a coherent issue, although it may cover multiple constructs.

Our participants were also concerned about patients possibly complaining about them or suing them, if they inappropriately disclosed information. One participant told a story of being contacted by a patient's lawyer, after data was abstracted from the patient's chart and entered into a provincial registry.

In the focus group discussion, a not insignificant amount of mistrust between physicians and "government authorities" was also apparent. Specifically, some participating physicians were concerned that the data that they provided to public health was being, or would be linked to their performances as physicians: "I could see some [physicians] being a bit concerned...if [data] were linked to some performance evaluation, like, are you not picking up enough..." and "I have a few letters from the ministry over the years, telling me that I was more than two standard deviations outside the norm, but I do palliative care, so I do too many house calls apparently, because I do home palliative care, and you get a couple of those letters, and they ask you to justify your practice, and it makes you feel a little bit paranoid about, you know, big brother watching."

Poor data handling practices and breaches by government data recipients, even if they are not at public health agencies, have made some participants concerned about disclosing health information to public health.

Throughout the discussions, there was also variation in how patient information should be de-identified (for example, including or not including postal codes) and as such, the need for clear guidelines on what constitutes de-identified patient information was expressed.

De-identification by itself, however, was not seen as enough. Engaging the patients in the disclosure decision was suggested as "the patient needs to have a role in [the disclosure]. They need to say, that is okay". Several of the participating physicians suggested the need for obtaining individual consent by stating that "confidentiality and privacy is not a mass issue, it's an individual issue, so the individual should be informed specifically" whereas others stated that, "There has to be explicit consent, it cannot be implied consent. Just because I saw this doctor, the information will be transferred to public health. That's not acceptable". That said, many physicians also stated that obtaining individual consent was generally seen as not practical as "most of [them] don't have the time to spend explaining patient consent for something like this." However, other participants thought that the consent processes could be more general, for example, posters in the physicians' offices notifying patients that their de-identified information may be released to public health agencies. This was seen as a more practical alternative to obtaining individual consent.

Physicians were reluctant to provide certain types of patient data because they did not know for what purpose the data were being, or would be, used for and who it might be shared with afterwards. For example, one participant said, "Well I'm concerned about how they might use it....I mean if they use the data for their own internal operations, that's fine, but if they want to share it with a non-healthcare agency, I don't think that's fine". Likewise, another stated, "We should have the right to know why they are using [it], and what are the reason[s] for collecting and what the data is for."

Participating physicians stated that they would like to have a comprehensive data sharing agreement with public health agencies prior to disclosing any patient-level data. Included in this data sharing agreement, physicians would like to see information about how the data would be used (for what purpose), how long the data will be kept, as well as who will have access to it. These agreements would not only provide the physicians with, "assurances that data will not be used for things beyond the use of the agency it's going to" but also help to "get physicians involved", and make them feel more "comfortable to comply".

Participating physicians questioned how the data requested by public health agencies would benefit their patients: "What benefit would it offer to the individual [patient] for us to release their private health data? What does public health have to offer them that's going to be of benefit to them?" and "Does public health really need to know this information? And can they show us a very clear pathway of how the information can either improve patient care or patient outcomes?" A stronger incentive than general benefit to the population was also seen as important. For example, one participant stated "Patients look to us to be their expert and to be their advocate. So, we, as physicians, are happy to provide the information to public health for the greater good for public health, for the country as a whole, but on the other hand, in return we need to be given something of value that we can give to our patients, so we don't feel like we are compromising our patients." Another stated, "As long [as the data] is going to benefit the patient, it shouldn't just be for the sake of research or somebody's PhD thesis. It has to benefit the patient."

This suggests that being clear about the uses of the data is a necessary, but insufficient condition for the physicians to be willing to disclose patient information. The link to patient benefit needs to be articulated clearly when information is requested, and has to be adequately demonstrated.

Historically, physicians have indicated that they have not received sufficient feedback from public health agencies [7, 19, 89], and many participants reiterated this fact in the focus group discussions. This insufficient communication often results in physicians who are unmotivated to provide the data. The lack of feedback to physicians was articulated by statements, such as: "The region I'm in, we don't, we have to call public [health], we have to harass them to get any kind of information. If I happen to not watch the news that day, I'm less informed than my patients, as to what's happening, you know, we feel like we have to run after them in order to get any information, and that's specific to this, you know, this recent issue. But generally, I don't feel like we get regular updates as to what is happening in the community. It's like it is always a matter of take, take, take from us. And rarely do we get to see what comes of that". Moreover, for those who have provided data to public health: "It's just a matter of, or the fact that we keep giving them stuff, and we don't get anything in return, we get no communication in return."

The format of the feedback is also important. For example, in terms of information formatting, physicians would like, "Large format. Simple, easy to understand numbers", "concise, something... [they] can read", and "One page. [We'll] read one page". Several physicians also stated that they would like to control the quantity, type, and frequency of feedback and information they receive, and as such, an Internet-based information repository that is regularly updated with local information would be highly beneficial. For the most part, the participating physicians are particularly interested in obtaining clinically relevant information that they can use to provide better service to their patients: "So, clinically relevant information, so, for example, if [public health agencies] are seeing a larger volume in your community, that's helpful to me, because maybe, for example, mine, it might look different. And public health is in the unique position that they are receiving all this information, but they may be disseminating numbers, and what we want to know is clinically relevant information. If you have that information, is it possible for you to package it in a way that for clinicians it is useful to us?"

On the other hand, there was also concern expressed about too much repetitive information being provided by public health [90]. For example, one participant noted "I'm on the other side where I'm being bombarded with useless flyers, useless [expletive] flyers, like I don't want to open, like I see the email address and I'm at the point where I kind of briefly open it, then delete it ... it's useless and it takes so much time. They add in all of their letterhead, all of the little pictures that take, depending on where you are, you are using dial up internet that takes forever to download, ... this is not useful. This is what we mean by useful information. Just text, that we can get anywhere, factual information and updates as to what's happening, [the] repetitive hand washing posters are not helpful. I got it, I got it."

Despite calls for weighting the public good more heavily in the context of a pandemic [41‐48], physicians did not see it that way: their privacy reservations remained quite strong. Our results can be represented in the conceptual model of Figure 2. The collection/control/awareness box includes a list of recommended actions, mostly for public health agencies who wish to collect the data from family physicians. These actions would have a positive impact on the trusting beliefs that we found in our study, and a negative impact on the risk beliefs that we found. Trusting beliefs positively influence the intention to disclose patient information, and risk beliefs negatively influence it. Higher trusting beliefs reduce risk beliefs.

Three factors increased the degree to which the physicians perceived public health as dependable to protect health information, and that make up the trusting beliefs construct. The first is the degree to which public health has good data management practices in place (factor T1). Stories in the press about data breaches at, or by public health agencies and health departments [91‐97] reduce trusting beliefs. Second, the data must not be used for any purposes other than those for which it was originally collected from the physicians (factor T2). Even though privacy legislation in some jurisdictions does permit uses different from those under which the data was collected [33], the exercise of such discretions may erode trusting beliefs. Third, the data disclosed by the physicians is not shared with other third parties (factor T3).

Four factors increase the possibility of perceived loss from disclosing the information, and these make up the risk beliefs construct. The first is damage to the physician patient relationship (factor R1), which can result in patients changing their behaviors to protect privacy. There is evidence that patients will adopt privacy protective behaviors when seeking care, if they have concerns about how their personal health information will be used or shared. For example, between 15% and 17% of US adults have changed their behavior to protect the privacy of their PHI, doing things such as: going to another doctor, paying out-of-pocket, even when insured, to avoid disclosure, not seeking care to avoid disclosure to an employer, giving inaccurate or incomplete information on medical history, self-treating or self-medicating, rather than seeing a provider, or asking a doctor not to write down the health problem or record a less serious or embarrassing condition [98‐101]. Privacy concerns have caused individuals to not be totally honest with their health care provider [102]. More than a quarter of teenagers indicated that they would not seek out health care if they had concerns about the confidentiality of their information [103]. A survey of service members who had been on active duty found that respondents were concerned that if they received treatment for their mental health problems, it would not be kept confidential and would have a negative impact on future job assignments and career advancement [104]. It has been estimated that 586,000 Americans did not seek earlier cancer treatment, and 2.07 million Americans did not seek treatment for mental illness due to privacy concerns, and fear of harm to job prospects or other life opportunities, if the information was not kept confidential [105]. In a survey of physicians in the US, nearly 87% reported that a patient had asked that information be kept out of their record, and nearly 78% of physicians said that they had withheld information from a patient's record due to privacy concerns [106]. Public opinion surveys in Canada found that, over the prior year, between 3-5% of Canadians have withheld information from their provider because of privacy concerns, and 1-3% have decided not to seek care for the same reasons [107]. Furthermore, between 11% and 13% of Canadians have, at some point, withheld information from a health care provider because of concerns over whom the information might be shared, or how it might be used [108‐110], with the highest regional percentage being in Alberta, at 20% [108]. Similar results have been reported by the Canadian Medical Association [111]. An estimated 735,000 Canadians decided not to see a health care provider because of concerns about the privacy of their information [112]. Specific vulnerable populations have reported similar privacy protective behaviors, such as adolescents, people with HIV, or who are at high risk for HIV, women undergoing genetic testing, mental health patients, and battered women [113].

The second risk beliefs factor (R2) is that of patient complaints or legal action if they are surprised by, or disapprove of how, and to whom their information is being disclosed. Disclosures by providers without individual patient consent have resulted in tortious or contractual claims of invasion of privacy, breach of confidentiality, or implied statutory violations under state law [114]. Concerns about their own privacy, and how their patient information could potentially be used against them is the third risk beliefs factor (R3) [115]. The lack of time to complete case report forms for public health has been an on-going problem [6, 11, 13, 17, 116]. The risks of investing scarce time, and disclosing their patients' information without getting back regular, actionable, and clear clinically relevant information from public health makes up the fourth risk factor (R4). This risk factor reflects the balance between costs and benefits: physicians would perceive less risk if the costs to provide information were mitigated by benefits. Of course, the lower the costs the better, or if someone else can cover these costs.

Based upon our results, we can make six recommendations of actions that public health agencies can take to influence the trusting and risk beliefs of family physicians. These would then, in turn, have a positive impact upon their willingness to disclose patient information. The recommendations make up the collection/control/awareness constructs on our conceptual model.

Canadian public opinion research has found that patients prefer to be provided for some form of opt-in or opt-out consent before their personal health information is used for secondary purposes (such as public health) [117‐123]. While some of our study participants advocated obtaining patient consent for disclosing their information to public health, it was generally seen as not practical [124], especially if there is a pandemic with many cases requiring reporting. Automation may ease the reporting burden [125‐128]. For example, electronic transmission of disease information from family physician practices participating in sentinel networks to public health units for disease surveillance is becoming common [129‐131], and the deployment of EMRs is also growing [132‐140]. Furthermore, the ability to electronically submit syndromic surveillance data to public health is one of the EMR "meaningful use" criteria in the US [141]. It remains an empirical question whether, in practice, time not spent on actual reporting due to automation could be used instead to obtain consent. Even if consent can be obtained with minimal impact on time, there is compelling evidence that consent results in biased data, because consenters and non-consenters differ on important demographic and socioeconomic characteristics [142].

In reality, patients are only given notice about data being reported to public health rather than being offered an opt-in or opt-out consent. For instance, when disease notification is mandated, physicians are reporting fully identifiable information, and it is expected that public health will follow-up with the patients. According to the participants in our focus groups, it is common practice among reporting physicians to inform the affected patients that public health has been notified, and that they may initiate contact tracing and disease control efforts with them directly.

In situations where collecting identifiable patient information (such as patient names) is not mandated, public health may still want those fields to link with other data sets [49]. Informing the patients during the encounter would likely require explanations of why this is happening, and who the data is going to. This would start to resemble obtaining consent in terms of effort required, and raises the question of what to do if the patient objects. Based upon the views of our participants, not informing the patients at all would likely not be acceptable. Under such circumstances, it may be possible for public health to deploy secure linking methods that do not require the disclosure of identifiable information [143].

Not all surveillance efforts need personally identifiable fields, (i.e. patient names and addresses), for example, as in indicator-based surveillance programs. In such cases, de-identified patient data can be disclosed. The public is more comfortable with their health information being used for secondary purposes if it is de-identified at the earliest opportunity [118, 119, 122, 144‐148]. There is no legislative requirement to obtain consent if the information disclosed is de-identified. Recent indicator-based surveillance efforts have required the de-identification of patient data before it was disclosed [72, 149, 150].

Therefore, it is recommended that, wherever possible, data disclosed by physicians should be de-identified (factor C1) and that public health should provide notices for physicians to post in their offices informing their patients that de-identified information will be disclosed for specific public health purposes (factor C2). Furthermore, to the extent that public health agencies can use the media to educate the public that their health information is being disclosed for public health purposes, then this could be another method of providing notice.

De-identification must mask the origin of the data as well. This will hide the practice which generated the data, and would address the physicians' concerns about how they themselves will be affected by data sharing. There has been concern expressed about the impact upon the physicians themselves of disclosing patient information [11, 151], in the context of being targeted by marketers, for example, or if the physician's information is being used to evaluate compliance with clinical practice guidelines, compliance with pay for performance programs, and concerns that their income could be affected if complete patient data from their practices was disclosed [152].

The location of the reporting practice is important to identify geographic patterns in a disease outbreak. To ensure that location is still known, even if the practice identity is masked, practices can report as a group, with each group consisting of a set of geographically adjacent practices. A protocol and system for the secure computation of case counts from physician practices for the purpose of surveillance has been developed [115]. Reporting as a group of practices can potentially make it more difficult for public health to identify the source of unusual spikes. This protocol therefore allows the public health unit to rank the data sources by their counts and hence initiate additional focused data gathering.

Our participants also indicated that they would be more motivated to disclose data if they were provided with actionable, regular, and clinically relevant information back from public health agencies that could be beneficial for their patients (e.g., timely alerts when there are local outbreaks, instead of first getting the information from the media and their patients). The lack of information back from public health agencies has been an on-going issue inhibiting willingness to disclose data [7, 19, 23, 125, 153‐155]. This is captured by the benefit factor C3 and feedback factor C4. Such feedback would provide a tangible short-term benefit to the physicians in exchange for the data. There do exist examples of context specific public health alerts integrated with EMRs [156].

The support of the professional Colleges could be helpful in two respects (factor C5). First, they could perform the legal review of a standard data sharing agreement with public health to ensure that it adequately covers all the important elements noted above, and protects the interests of the physicians. They can also provide external validation that the data to be collected is indeed required for the stated public health purposes, and is the minimum necessary to achieve these purposes. The "general limiting principles" in privacy laws stipulate that personal information should be collected, used, or disclosed only where no other information will serve the purpose [157].

Although some participants indicated that they would like to see research ethics review boards endorsing disclosures to public health, this is not likely to be practical, given that many REBs are already under-resourced. Furthermore, the underlying concern is with independent external validation, which can be provided by the professional Colleges.

Data sharing agreements between physicians and public health should be put in place (factor C6). Agreements would be beneficial for individual case reporting, as well as surveillance for situational awareness. The agreements would explain why the information is being collected (for what purpose), how it will be used, who would have access to that information, limits on disclosures to third parties, restrictions on attempts at re-identification for de-identified data, how long it will be retained, and provide assurances that good information security practices will be put in place to manage the data. Although putting such agreements into place with a large number of physicians and physician practices would be time consuming, this would be a good investment to increase willingness to share information and increase reporting.