Heuristics Identified in Health Data–Sharing Preferences of Patients With Cancer: Qualitative Focus Group Study

Introduction

IT in health care has generated a wide range of digital patient data collected during various health-related activities, including medical interactions, diagnoses, quality of life, treatments, drug adherence, and reimbursement [1-3]. Accessing real-world data allows for a detailed profile of a patient to better understand and target health issues and build evidence to understand the clinical and cost-effectiveness of personalized health technologies [4]. Access to clinical and routinely collected real-world data hinges on patient consent and legislation. As health institutions look toward data-sharing solutions that can support evidence generation for personalized care, they must consider how to best incorporate patient concerns and expectations to reach meaningful consent [5-9].

Understanding an individual’s process of providing consent involves modeling attitudes, context, and risks and benefits involved in the decision [10,11]. Decision-making modeling is typically grounded in utility theory, where rational actors deliberate on the outcomes of possible alternatives and make a decision that maximizes their utility, based on well-defined and consistent preferences and using unlimited cognitive processing power [12-15]. Simon [14,16] (1957, 1979) provided an alternative framework, arguing that in a complex and uncertain decision context, individuals hit a cognitive limit to their rational processing capabilities and instead satisfice their utility. The individual’s choice is based on the context-specific value placed on the potential outcomes rather than a rational assessment of their utility function [17-19].

Kahneman and Tversky [15,18] (1974) explored satisficing through heuristic theory and defined heuristics as the different rules of thumb used by individuals to substitute rational processing for quicker judgment calls. Kahneman [20] (2003) elaborated on the decision-making process as a dual-system model where system 1 rational (controlled, slow) and system 2 heuristic (intuitive, automatic) processes react during complex decision-making. The authors used this dual-system theory to develop Figure 1, which represents decision-making as an interaction among heuristics, attitudes, and the risk-benefit calculus, all of which are defined in Table 1 [21,22]. In this study, we take the position that the decision to share data is a complex process that involves the interaction of both heuristic and rational processes. In this map, the system 1 heuristic process interacts with the system 2 attitudes and risk-benefit calculus to form the decision to share data. The relationships between systems 1 and 2 are not reducible to a simple cause and effect; both systems nondirectionally influence each other to lead to a decision.

‎

Published research has found the presence of various heuristic processes in data-sharing decision-making [10,23-26]. However, very few have studied heuristics specifically used in health data sharing [7], meaning that the impact of heuristics on a patient’s consent to share health data is not well understood. This study addresses this evidence gap by asking what heuristics, if any, are used when deciding whether to share personal health data for research purposes and how they impact the outcome of a stated decision. We are investigating the presence of heuristic processes to understand whether patients may be using a decision process similar to Figure 1. Capturing the use of heuristic processing in the health data–sharing context helps illuminate whether consent processes can better serve patient decision-making by considering the factors that influence patients beyond their rational, utility-maximizing processes. These findings can support the development of consent mechanisms that represent the reality of this complex and context-dependent decision environment [5].

Methods

Overview

We conducted a qualitative focus group study with patients with cancer and survivors in Canada as part of the Canadian Network for Learning Healthcare Systems and Cost Effective ‘Omics Innovation (CLEO) project, an initiative evaluating 6 precision oncology programs in Canada to inform the design of a learning health care system for cancer research and care [27]. Patients with cancer were the chosen population for this focus group study because of their relevance to the CLEO project and convenience sampling for the study authors who worked at a cancer research institute. Focus groups were chosen because they are effective for collecting data on socially construed beliefs, for exploring concepts that are not easily measurable, and for revealing underlying thought processes [24,28,29]. As compared with interviews, their social setting allows for discussion that is influenced by others’ perspectives [30]. This discussion style can provide mental cues for participants, triggering memories, opinions, or feelings that represent heuristic processing.

Ethical Considerations

The protocol for data collection and analysis received ethics approval from the University of British Columbia BC Cancer Research Ethics Board (H20-00861). Participation in the focus groups was entirely voluntary. Consent for participation was collected through a consent form that described the goals of the study, the research team, the format of the focus group, expectations of participants, compensation, how confidentiality will be protected, and who to contact for more information. Consent forms were delivered by email to each participant before the focus group. The participants signed their forms as a PDF or through REDCap (Research Electronic Data Capture, Vanderbilt University), and only received the Zoom (Zoom Video Communications) link once they had completed the consent form. A copy of the consent form can be found in Multimedia Appendix 1. The participants received financial compensation of CAD $100 (US $70) after participating.

This study presented minimal risk to the participants. All demographic data collected from the participants through REDCap was stored in the REDCap platform and a locked folder on secure BC Cancer servers. We removed participant names from the transcripts and replaced them with anonymous identifiers. We stored the de-identified transcripts in a locked folder on BC Cancer servers.

Study Procedure

Individuals with a current or previous cancer diagnosis were recruited through a purposive sampling technique across provinces in Canada [30]. Participants were deliberately sampled to maximize diversity and not representativeness of the Canadian population. We recruited a diverse sample of cancer type, age, gender, and racial or cultural groups in order to hear from a wide range of perspectives. The participants were recruited from an advertisement posted on various provincial patient organizations (REACHBC, AbSPORU, and Cancer Care Ontario) and Kijiji, Craigslist, and Facebook patient groups. Oncologists at BC Cancer also supported purposive recruitment for racial and cultural diversity and cancer type. Those who expressed interest in participating were sent a screening survey that collected gender, age, racial or cultural group identity, cancer type, and general availability (a copy of the survey is mentioned in Multimedia Appendix 2). As screened candidates entered our selection process, we built a list based on those who provided variation in these demographic categories we collected, and we excluded those who did not provide demographic diversity compared with those previously selected. Those who were selected were invited to participate in a single focus group. They were sent the consent form and an introductory video on precision oncology and data-sharing platforms.

Focus groups were 90-minute sessions held and recorded over Zoom, facilitated by 2 female researchers at their workplace (SP and AH). At the time of the study, SP was a senior methodologist at BC Cancer with a PhD in epidemiology, ethics, and mixed-methods research. AH was a graduate student in public health with a bachelor’s degree in political science with no prior experience conducting focus groups. No relationship was established with the participants prior to the focus groups beyond the communication required to set up their participation.

The facilitators used a semistructured question guide informed by a literature review [31] to guide the discussions on preferences for the data-sharing process (Multimedia Appendix 3). The literature review identified key topic areas and evidence gaps in the study of preferences for secured data-sharing platforms. These included motivators for and concerns about sharing data, incentives to allow access, types of institutions that can access the data, and consent and control features. The facilitators used these topics to develop and prioritize questions for the focus groups. Two researchers (AH and DAR) also developed questions to probe for heuristic processing, although the open-ended nature of the conversations was enough to naturally reveal heuristic processing. After the focus groups, the participants completed a demographic survey and were sent a CAD $100 (US $70) honorarium. Transcripts were not returned to participants.

Data Analysis

Data collection and analysis happened concurrently to achieve constant comparison [32] and followed a thematic analysis approach. Thematic analysis is a qualitative practice used for identifying and interpreting patterns across the data on participants’ experiences, views, perspectives, and behaviors [33]. We chose this method because of the flexibility it offers in terms of theoretical approach and data analysis, allowing for a theoretical (deductive) application of a previously established theory to a novel research area [34]. Because this area is novel, we chose to extend our methods beyond cataloging or describing the results as topic summaries, and into the interpretation of these results, generating themes by reflexively identifying underlying motivators for the heuristic processing identified [35].

The research team worked to maintain a degree of transferability, dependability, and reflexivity in the data collection, analysis, and reporting [36]. Using the COREQ (Consolidated Criteria for Reporting Qualitative Research) standards, the explanation of the research setting and definition of heuristics increases the transferability of the study, and the documentation of our data collection and analysis processes encourages dependability of the findings [37]. This work also incorporated reflexive activities including team debriefing to review field notes after each focus group, weekly norming sessions, and working group consultations at major points along our study process [30].

We conducted a deductive analysis guided by a heuristic framework we developed from a review of literature on data-sharing heuristics. After focus group recordings were de-identified, transcribed, and checked for quality, 2 researchers (AH and SP) independently open-coded the transcripts, tagging the data for instances of the heuristic framework. Throughout the coding process, we refined and grouped heuristics to establish the final codebook. Statements could be coded with more than one heuristic. AH and SP conducted the coding process using QSR NVivo Software [38]. We completed data collection after reaching saturation, which we defined as the moment when analysis of new transcripts led to the same heuristic findings, with the same or similar impacts on the decision to share [39].

Once coding was complete, we looked for phrases in relevant passages of the transcript to identify the heuristics’ corresponding attitudes and intentions to share, following the decision-making model (Figure 1). Heuristic codes were grouped into categories that were inductively created by identifying what causes the heuristic to be triggered and then defining larger sociocultural spheres of influence related to these causes. Resulting themes were derived from the data, representing each of these categories’ heuristic influences on participants’ intentions to share their data. The participants did not provide feedback on the heuristic findings.

Results

In total, 3 researchers (AH, SP, and DAR) conducted 3 Zoom-based focus groups from January to April 2022. Overall, 19 participants took part in the focus groups, with 5 to 8 participants per group. One candidate completed the consent form and received the Zoom link but did not attend the focus group. A total of 4 candidates confirmed their availability for the focus group but ended communication before completing the consent form. Table 2 describes participant demographic characteristics.

We coded 12 heuristics in the transcripts following the codebook (Table 3). Heuristics each have their own definitions but overlap in how and why they are triggered and what outcomes they produce. The differences between some of these heuristics are nuanced and the researchers relied on definitions from literature to maintain distinctions between them. We generated 4 themes linked to 9 heuristics. The other 3 heuristics identified were minor, nonsaturated findings (gatekeeping, novelty, and representativeness), and were not included in the thematic analysis.

The Social: Altruism as a Social Rule of Data Sharing

The first theme was the motivation to act altruistically when deciding to share data. The community building heuristic was found throughout the transcripts in participants’ intention to benefit others. This heuristic captured the attitude of collectivity that participants felt toward others experiencing cancer, wanting to contribute to a “common good” [P07], “mankind” [P17], and the “big world” [P02]. Participant 7 explained, “everybody has their own rights. But we have to be together trying to help each other to survive the best we can.”

Some participants acknowledged the benefit they had received from the contributions that had come before them and wanted to share to “make somebody’s procedure better through my experience just as others have gone before me” [P04]. The community-building heuristic engendered strong intentions to share data for the benefit of others.

The social norms heuristic was also identified in instances where a decision not to share data was criticized, implying a social rule to be altruistic. For some participants, this rule was expressed as a disbelief at individuals who are unwilling to share their data: “I can’t see how anyone would put up a fight or why they would not want it shared” [P02]. Participant 17 similarly implied that the social benefit generated by sharing data should motivate everyone: “Isn’t most of that data for the betterment of mankind?... I was just struggling to even get my head around why we wouldn’t do this.”

At times, this sentiment was found in direct contrast to discussions of risk. One participant downplayed the financial risk of being denied insurance: “human life is way more important than a mortgage, I’m sorry. We have to be part of a common good, not be selfish” [P07]. Altruism was also identified in the discussion on providing monetary incentives for sharing data, where some participants questioned why some would want compensation, and that it seemed like a “totally opposite kind of attitude” [P12]. Through their vocal belief in these behavior patterns, participants relied on the social norms heuristic in their decision processes.

The Institutional: Trust as a Measure of Legitimacy

The second theme centered on instances where participants reacted to the type of entity accessing their data. The recognition heuristic was primarily used in reaction to for-profit companies accessing health data, expressing distrust and privacy concerns. Without prompting, the participants expressed negative associations with pharmaceutical and insurance companies, such as Participant 13 stating that insurance access “immediately turns [them] off.” Participant 18 shared,

I don’t think I have a problem with accessing all my data. But the question is who gets to access it, and then would I be able to opt out on certain [access] like a pharmaceutical company or an insurance company.

Some participants assumed for-profit to not have as high an ethical standard as other types of data requestors (such as academic researchers), tying this perception to the company’s morality, and whether their activity could be considered altruistic [P19]. This came out at times as a contrast between commercial and research activity, with one participant expressing that

…the only time I care [where my information is used] is when it’s being used for profit, for like a pharmaceutical company, that’s where I’m more hesitant … but if it’s just for research purposes, I’m happy.
[P11]

We coded trust in nonprofit and public researchers, as well as medical professionals, as the authority heuristic. During a conversation about managing data-sharing requests, Participant 18 recognized, “I don’t have the medical expertise in a lot of this,” and suggested, “I’d rather have a primary person or oncologist feeding me the information that I can trust a little bit more.” This demonstrated a reliance on their health care providers when considering whether to share data. Trust in researchers was also identified in instances of the reputation heuristic, where participants connected legitimacy and trust to the prestigiousness of public or nonprofit researchers and medical professionals. For example, one participant commented that

…we’re not dealing with gambling sites or anything disreputable. We are dealing with medical professionals who are highly respectable.
[P16]

Rather than examining the true risk of sharing with these types of entities, they relied on the recognition, reputation, and authority heuristics to evaluate their trust in them, which ultimately dictated their intentions to share.

The Informational: Gaining Power and Security Through Control

The third theme was the need for control over the data-sharing process. We coded the illusion of control heuristic if the participant believed that having personal controls over the data-sharing process reduced the probability of risks. Some participants expressed an interest in having controls in place to decide who gets access to what data and under what conditions to prevent a data leak. There appeared to be support for informed, detailed, and dynamic consent, which was valued by one participant to “give people some sense of control over what they want to share and what they don't want to share” [P19]. Other participants perceived a lack of control, with the understanding that “the second [your data] leaves you you’re no longer in control of that information” [P18]. In the face of this lack of control, these oversight features were important to our participants and gave them a sense of power over the data-sharing process, despite this kind of control not necessarily minimizing the risk.

This desire for controls was often connected to participants’ need to know more about the data request before allowing access, which we identified as the transparency heuristic. Some wanted to know about the storage of data:

I don’t want to say I’m 100 per cent in favor of sharing data, because I don’t necessarily know where it is going to be stored.
[P05]

Other participants wanted details on why and how the data was being used:

I need to understand the reasoning behind why on each and every aspect or piece of data. Then I would be all in.
[P13]

Being “all in” indicates a preference based on a heuristic response to the opacity of the data-sharing process, rather than on a deliberation of risks and benefits once receiving that detailed information. Whether in the form of information on or involvement in the data-sharing process, the perception of control was an important component of our participants’ decision-making processes to mitigate risk.

The Personal: Framing Risk and Benefit Through Personal Experiences

When explaining their decision-making processes, participants shared anecdotal experiences, feelings, and externally influenced beliefs tied to data sharing. Found across all focus groups was a reliance on the availability heuristic to evaluate the risk of cyberattacks. In these discussions, the participants recalled news stories that negatively impacted their intentions to share data:

Even just reading the paper today, you know that people are always trying to get at your data.
[P05]

This also included anecdotes that participants recalled from memory:

[U]nfortunately we just can’t trust everybody today because look at what we see in the world, right? … if you remember that – a few years ago where somebody left important data on a bus, of all things, that was in Vancouver, you know.
[P04]

These stories led the participants to believe that data breach was an inevitability, with one expressing, “it seems there is always something somewhere that goes wrong” [P04]. The inevitability and frequency of a breach were a substantial consideration for our participants when discussing the risks of sharing data, despite none reporting to have experienced a data breach themselves.

The participants also used the availability heuristic when referencing personal and peers’ experiences with and outside of cancer. Some of these experiences led to negative perceptions of sharing, in particular, those who had had or heard of “bad experiences with insurance people in the past” [P05] that made them fearful of health or employment insurance denial. Other experiences led to positive reflections on data sharing. This was evident in some participants’ treatment issues that could have been mitigated if data had been shared, such as a life-threatening reaction or an adverse side effect. As Participant 13 noted, “that’s what’s important about data sharing, knowing who else out there has had that experience.” Another participant explained their willingness to share through their own treatment experience, recalling:

I’m one of the ones that treatment worked. And there is some mystification around it… good data is just so important.
[P10]

These experiences were salient to decision-making processes, given the way participants used these anecdotes as rationales for deciding whether to share their data.

The affect heuristic was identified primarily through voiced emotion around for-profit involvement in the data-sharing process. These feelings included the loss aversion our participants felt toward insurance company access, such as Participant 5’s previous experience with insurance “cast[ing] a negative light on the insurance industry” [P05], and Participant 13’s feeling that insurance access “immediately turns [them] off” [P13]. Other participants felt uneasy about the sale of data, with one participant expressing, “this whole selling and stuff, that kind of scares me” [P04], and another who felt that “tying finance to personal data it just doesn’t feel right.” [P10]. Another felt “spiteful” toward for-profit companies [P11], wanting to limit their access to data, and another described for-profit activity as “sinister” [P19]. Many participants used their affective pool of feelings to explain their intentions. We found that the availability and affect heuristics triggered a more negative intention when the participants felt a distrust, privacy concern, or loss aversion, and positively when the participants found a personal benefit or collective benefit to sharing data.

Discussion

Implications of Findings for Consent

We identified qualitative patterns in the heuristics that patients with cancer use for health data sharing and how they impact decisions to share. Data-sharing themes found in our transcripts are not new to the data-sharing literature: research has found that individuals are motivated by altruism, are hesitant to share with for-profit entities, and want greater control over the process [31]. What makes our findings novel is the consideration of how heuristics play a role in the generation of these preferences. By studying underlying intentions, this study shows how the mechanism used to construct seemingly rational preferences for data sharing is influenced by heuristic processing. For example, previously studied preferences for greater transparency into the use of health data may, according to this study, be grounded in heuristic responses despite the appearance of deliberation. The heuristics analyzed in these focus groups therefore shed new light on how preferences are formed and prioritized when deciding to share data.

Heuristics, or “decision shortcuts,” ultimately prove relevant in response to the complex and uncertain decision of sharing data. If participants are in fact using heuristics, then their decisions may not represent informed consent in the sense that they are not rationally deliberating on all outcomes to come to a utility-maximizing decision [49]. Instead of relying on what may be an impossible deliberation for patients, decision mechanisms can directly address these patterns of heuristic behavior by applying behavioral economic strategies, such as providing simplifying and salient information on the true risks and benefits at the time of consent. This approach can disrupt cognitive bias without asking individuals to deliberate all probabilities for a rational decision, as previous research has shown [10,23,40]. By respecting the boundedness of patients’ processing capabilities, this kind of consent process can reach meaningful consent that is not necessarily a rational process but produces rational outcomes that maximize the patient’s utility. As argued by Noah [49] (2016), it is important to recognize the obstacles to achieving perfect utility-maximizing consent and to instead encourage support for the “right” decision depending on the patient and the circumstances. The evidence found in this study can guide the testing of relevant behavioral economics strategies to manage the gap between the difficulty and yet necessity of giving deliberative informed consent.

Limitations

These results are subject to limitations. First, the majority of our sample self-reported as white and of higher education and income, and participants skewed toward older age. Our findings lack perspectives that may be systematically different from what we captured [50,51]. Second, we did not put a limit on the length of time since the patients’ diagnosis or last treatment, which may have resulted in recall bias. Third, we chose to sample from patients with cancer and cancer survivors, who have unique experiences with their health and research in a way that may not be generalizable to individuals outside of this population [8,52,53]. Fourth, these findings are dependent on the subjectivity of the researchers’ applications of the heuristic framework. It is possible that the researchers confounded some of the heuristics, due to their similarities and the definitional nuances the researchers chose to apply. We attempted to mitigate this by having two researchers conduct independent analyses, applying a set of definitions informed by the literature, and comparing these two analyses during norming sessions. Finally, owing to study timelines and feasibility, we conducted all focus groups in English language.

Although not a limitation, we experienced some challenges with the use of Zoom for focus groups. This included the delayed and disruptive identification of one participant and another participant with poor sound quality. Following this first group, we developed a new identification process and were clearer about our expectations for sound quality from our participants, which resulted in smoother discussions in the next two groups.

Conclusion

This study investigated whether and which heuristic processes are used in intentions to share health data for research. By applying a novel heuristic perspective, this research illuminates the influence of heuristic processes in the formation of preferences around data sharing. Future research can expand this work beyond intentions to share, observing how these heuristics may or may not be evidenced in actual decision-making behavior. Our findings also have implications for future practice, where the design of consent mechanisms for sharing health data should consider the role of heuristic processes in this multifactorial decision, and how behavioral economics strategies can be used to encourage more meaningful patient engagement with their decision-making.