Consent forms used by patient assistance programs raise privacy concerns

Potential privacy concerns

The collection of patient data by PAPs is an area of concern. Family physicians might be involved in connecting patients with PAPs to help them access medications or services or both. Further, some PAPs allow physicians to consent on behalf of patients, but providing this consent puts physicians in a potentially vulnerable position in terms of patient privacy. For these reasons, we believe all physicians referring individuals to PAPs should be aware of potential privacy concerns.

What constitutes meaningful consent?

The Office of the Privacy Commissioner (OPC) of Canada has guidelines for obtaining meaningful consent for the collection, use, and disclosure of personal data.^4,5 These guidelines include the need to provide clear information about what PHI is collected, with whom the data will be shared, and exactly for what the information will be used. They specify that individuals must be given the choice to opt in or out of “any collection … of personal information not necessary for the product or service” and be given the opportunity to reconsent should there be changes to privacy practices or new uses for PHI.^4,5 Finally, where PHI is collected in Canada but stored and accessed in other countries, OPC guidelines state that individuals must be informed at the time of data collection if their data might be accessed by foreign authorities.⁶

We audited PAP consent forms for 23 drugs used to treat patients with rare diseases; the medications are manufactured by 14 different pharmaceutical corporations and available through British Columbia’s Expensive Drugs for Rare Diseases program.⁷ Forms were collected from prescribing physicians and reviewed relative to OPC privacy guidelines.^4-6 The forms were published from 2015 onward (although 6 forms did not have version dates) and available upon request from PAPs. Additional details about the forms included in this audit are presented in Supplemental Table 1, available from CFPlus.*

Forms were considered to satisfy OPC guidelines if they provided specific, complete information on what PHI was collected; how it was used; to whom and where it was disclosed; how long it was retained and how it was disposed of retroactively upon withdrawal of consent; and if patient notification was required to enact any change in the collection, use, or disclosure of PHI. Use of open-ended or broad language in the consent wording or description of terms, such as “including but not limited to” and “subject to future changes without notification or reconsenting,” was considered unsatisfactory. Example excerpts are provided in Supplemental Table 1.*

None of the forms satisfied all OPC priorities for meaningful consent^4-6 and several areas of concern were noted in all 23 forms, as follows.

Lack of clarity as to specific PHI being collected. The forms used general terms to describe data collection, such as “personal information” collected for the purposes of “program objectives” without specifying what information would be collected and what those objectives were. In other examples, some details were provided but then left open ended (eg, “including but not limited to”), so it was not possible to know exactly what PHI was being collected.

Lack of clarity around specifically why or for what purposes PHI is being collected, used, or disclosed. Open-ended phrases were used, such as “use of personal data for purposes such as (but not limited to) marketing, adverse event reporting” or “and any other uses.” In 20 of 23 forms (87%), statements embedded in the small-print privacy policy section indicated that de-identified patient data might be used for commercial uses and shared with manufacturers. “Commercial uses” included “market research, user experience, program improvement, or quality control” and “other” undefined PAP uses.

Failure to disclose with which parties PHI is being shared. In some cases data sharing was open ended, described as sharing with “other third parties” or “including without limitation,” meaning it was impossible to know who would have PHI access.

Inability of patients to opt in or out of specific program services. Patient assistance program services were grouped together so that patients could not opt in or out of program service components. For example, patients wanting to use a PAP for help with insurance coverage but not wanting calls about medication compliance could not opt out of services they did not want.

Lack of clarity regarding when consent should be reviewed. All forms specified that patients may withdraw consent, yet some failed to outline what would happen to their data once they withdrew consent or for how long their data would be stored afterward. Some forms specifically stated that patients would not be notified or asked to reconsent prior to changes coming into effect such as new PHI collection, uses, or disclosures to a third party.

Lack of clarity around risks of harm related to sharing PHI. Regarding sharing of data, forms used vague language such as “may be transferred to an affiliate outside your country” without indicating where the PHI might go or any specific privacy risks that might be present in countries whose privacy policies differed from those in Canada. No forms offered patients retroactive data removal upon withdrawal of consent.

Of the 23 PAP consent forms we audited from pharmaceutical companies providing expensive drugs for rare diseases, 20 were provided to patients by clinical teams directly involved in patient care. This is a concern, as patients could infer that the PAP has a similar degree of trustworthiness in serving patient needs as their clinical care team.⁸ Research suggests patients have a high level of trust in health care institutions but distrust commercial entities.⁸ When a physician provides a PAP consent form, the patient may apply the trust they have for their doctor to the PAP, which might not be appropriate given PAPs’ links to the pharmaceutical industry.

Barrier to and opportunities for change

Between 2021 and 2023 we shared our findings and suggestions for improvement with agencies and 4 manufacturers providing PAPs (responsible for nearly half of the drugs in this audit). However, despite their expressed willingness to make general improvements to the forms unrelated to these privacy concerns, they cited barriers to change, including the requirement to obtain approval from various stakeholders and international legal constraints. Regarding the latter point, manufacturers want to use consistent forms across countries, so the language used in the forms must be acceptable around the world, not just in Canada. Thus, it is not easy for manufacturers to resolve privacy concerns quickly. Federal legislation to ensure patients have clarity about how their data might be used by PAPs could be considered. However, even if there were an appetite for legislative solutions, these would take time to enact. Meanwhile, what can physicians do to reduce risks to patients? Physicians who refer patients to PAPs might consider the following options.

Decline the use of PAPs for patients who do not need PAP services. Enrolment in a PAP cannot be a prerequisite for the patient to receive a drug (unless the drug is being supplied free of charge by the manufacturer). For patients who do not need other services provided by PAPs (such as help with insurance), bypassing the PAP altogether will protect patient privacy.

Discuss the need for ongoing enrolment in a PAP at follow-up visits. If patients enrol in a PAP for insurance verification assistance, they might not need other PAP services once this issue is resolved. Patient assistance programs allow patients to withdraw consent, so by asking patients about their ongoing needs at each visit, the total duration of time that PHI is collected could be limited.

Set ground rules with PAPs for patients being referred. Physicians often will meet with representatives of manufacturers or PAPs to learn about new programs. If physicians have concerns about some services being provided, they can ask the PAP not to offer those services to patients they refer. For example, some programs offer to assess treatment response by reviewing patient bloodwork results, but physicians might not want patient test results shared with PAPs. In this example, physicians might specify that the PAP should not request test results of their patients.