Ethical Use of Electronic Health Record Data and Artificial Intelligence: Recommendations of the Primary Care Informatics Working Group of the International Medical Informatics Association

Abstract

SummaryObjective: To create practical recommendations for the curation of routinely collected health data and artificial intelligence (AI) in primary care with a focus on ensuring their ethical use. Methods: We defined data curation as the process of management of data throughout its lifecycle to ensure it can be used into the future. We used a literature review and Delphi exercises to capture insights from the Primary Care Informatics Working Group (PCIWG) of the International Medical Informatics Association (IMIA). Results: We created six recommendations: (1) Ensure consent and formal process to govern access and sharing throughout the data life cycle; (2) Sustainable data creation/collection requires trust and permission; (3) Pay attention to Extract-Transform-Load (ETL) processes as they may have unrecognised risks; (4) Integrate data governance and data quality management to support clinical practice in integrated care systems; (5) Recognise the need for new processes to address the ethical issues arising from AI in primary care; (6) Apply an ethical framework mapped to the data life cycle, including an assessment of data quality to achieve effective data curation.Conclusions: The ethical use of data needs to be integrated within the curation process, hence running throughout the data lifecycle. Current information systems may not fully detect the risks associated with ETL and AI; they need careful scrutiny. With distributed integrated care systems where data are often used remote from documentation, harmonised data quality assessment, management, and governance is important. These recommendations should help maintain trust and connectedness in contemporary information systems and planned developments.

Guidelines and quality criteria for artificial intelligence-based prediction models in healthcare: a scoping review

“…Patient privacy. The literature advocates that, before starting data collection, the development team should ensure compliance with relevant privacy legislation (e.g., General Data Protection Regulation (GDPR) 29 , the Personal Information Protection and Electronic Documents Act (PIPEDA) 30 or the Health Insurance Portability and Accountability Act (HIPAA) 31 ) and take measures to protect the privacy of the individuals whose data are used for AIPM development, evaluation, or application 8,12,20,23,26,[32][33][34][35][36] . Consultation with data protection specialists has been recommended 23 .…”

“…Data quality. Extensive assessment of data quality has been widely recommended 6,7,12,13,16,22,24,26,33,37,64,65 . For both feature variables as well as outcomes, this involves the inspection and description of missing data, consideration of potential errors in measurement, and their underlying mechanisms (e.g., random or systematic) 3,6,9,13,[15][16][17]20,22,27,37,46,47,66,67 .…”

“…A clear definition of how and when each variable was measured should be provided 3,6,9,[12][13][14][15]17,21,22,25,37,46,50,58,62,64,65 , including specification of measurement instruments or tools (e.g., make and model of devices). Any known data quality risks and limitations should be reported and related to potential impact on the AIPM's predictions and its validation (with special attention to algorithmic bias) 3,13,20,22,26,32,33,37,43,57 . An additional validity check could be performed by randomly sampling a portion of the data and manually checking it for errors 28,61 .…”

“…Security encompasses the protection of the AIPM and its (personal) data against malicious actors 9,22,32 . Two risks particularly concerning an AIPM are the misuse of the (often large amounts of) development and validation data 23,33 and software vulnerabilities introduced by the new AIPM code and infrastructure 23 . Security measures protecting against these vulnerabilities form part of the AIPM architecture and should be tested before deployment 32 .…”

“…This is in contrast with linear regression and decision trees, which have been considered inherently interpretable approaches. Irrespective of the modeling choice, facilitating interpretability is generally encouraged 13,23,24,32,33,40,41,57,62,71 , in particular when AIPMs rely on sensitive social and demographic data, or if the AIPM's predictions significantly affect healthcare decision making and a patient's treatment 16,22,41 . Moreover, under the GDPR 29 , patients have a right to an explanation that enables them to understand why a particular decision was reached 36,40,41 .…”