Building trust in digital health: Managing privacy for statewide health information sharing

When it comes to digital health, the introduction of new systems often brings with it a mix of anticipation and apprehension. Victoria’s Digital Health Roadmap is no exception, with the state undertaking a multi-year transformative journey with the implementation of CareSync Exchange.

This statewide health information sharing system aims to enhance the availability of comprehensive, timely, and accurate health information for clinicians in public health services. However, the success of such a system hinges not only on its technical capabilities, but also on the trust it engenders among its users.

“One of the most challenging yet rewarding aspects of this project was the opportunity to listen to and understand a wide range of perspectives from people across the Victorian health sector,” says Manager Linh Do. “We were keen to try and reflect their perspectives together in a single document.”

This is where the Privacy Management Framework (PMF) comes into play. Nous was engaged to develop this critical element to ensure that CareSync Exchange is not just a technological advancement but a trusted partner in healthcare delivery.

The development of the PMF was meticulously planned, the process engaging an array of stakeholders to ensure that the framework was both comprehensive and inclusive. Over three stages, we consulted with more than 300 stakeholders, including health consumers, clinical and service managers, executives, and advisory groups. This extensive engagement was a deliberate effort to capture a wide range of perspectives and concerns around privacy.

“We invested a lot of time developing a plain English explanation of how health information is currently presented to clinicians,” says Principal Paul Kennedy, who directed the project. “Consumers in particular had little visibility of what actually happens behind the desk in health services, and this coloured their perception of health information sharing needs and risks. By closing that system knowledge gap, we equipped them to participate in the conversations on an equal footing.”

In the initial stage, we conducted a thorough desktop review of existing work, legislation, and technical documents. This was complemented by 13 focus groups with consumers and four with clinicians, each centred around sensitive information themes such as chronic conditions, gender identity, and mental health. These sessions were designed to be flexible, allowing participants to steer the conversation and share insights from their personal experiences. They wove a rich tapestry that informed the subsequent stages of the PMF’s development.

The second stage of the PMF’s development was characterised by a collaborative approach to solution design. Privacy concerns identified in the focus groups were used to draft initial solutions, which were then rigorously tested and refined with input from a wide range of stakeholders. This started with consumers and clinicians, but also included the department’s project team, advisory groups, and representatives from legal, technical, policy, and design roles. The iterative process ensured that the solutions were not only feasible but also aligned with the needs and expectations of all parties involved.

“The workshops were a particular highlight of the process,” says Do. “Consumers explained why they might be hesitant to share certain types of information. Clinicians explained why certain types of information could be critical for providing safe and effective care. It was great to see both groups listen to and understand each other’s perspectives and collaborate to identify potential solutions.” 

“What was clear was that you have to meet people where they are, using language and approaches that reflect their context and experiences.”

The final stage involved targeted consultation with a broader audience, including government agencies, health services, and organisations representing health consumers and clinicians. This step was crucial in validating the PMF and ensuring that it was robust but also workable. The feedback received was overwhelmingly positive, highlighting the framework’s clarity and accessibility.

The PMF’s successful development and endorsement by key governance stakeholders marked a significant milestone for CareSync Exchange.  This includes endorsement from the PMF Steering Committee, the Health Information Sharing Management Committee, and senior figures within the Department of Health. 

The publication of the PMF in the Government Gazette and on the department’s website on 11 June 2024 was a testament to its importance and the confidence it inspired. The framework not only sets a precedent for privacy management in digital health but also serves as a model for similar initiatives elsewhere.

With the PMF now in place, the focus shifts to its implementation. The strong feedback from consumers and steering committees also suggests that the PMF’s approach could be replicated in other contexts, further extending its impact.

It is clear that the success of digital health initiatives lies not just in technological innovation but in the trust and confidence they build among users. The PMF is an example of how a collaborative, consumer-focused approach can create a robust framework that safeguards privacy while enhancing healthcare delivery.

“People are rightly sensitive about their privacy and how their health information is managed,” says Kennedy, “but they also recognise the importance of clinicians having access to that information to provide best possible care. The Department committed the time and effort to make sure the privacy concerns and information needs were rigorously explored and tested, enabling the production of this important document.”