(My) Data for (my) Health – Privacy Calculi of Terminally-ill Patients with Rare Diseases

Digital healthcare information systems promise to improve care efficiency, to reduce complexity for patients, and to increase access to information and advance research efforts. A prominent example are multi-sided-platforms (MSP), which are essentially an information business, linking key healthcare stakeholders for individualized as well as aggregated information services. However, platform-based health innovation relies on the extensive collection, storage, and use of sensitive health information, raising issues of information privacy. This study uses the privacy calculus perspective to shed light on patients’ trade-off considerations. We use the case of a MSP, which connects patients, care providers and researchers, in order to model a multi-level calculus for health information of terminally ill patients. These insights inform stepwise consent options, which highlight the trade-offs between information value and patient privacy. By reflecting on the implications for patient empowerment this conceptual paper develops a research agenda on how to study and design responsible health information systems. 22 33 RD BLED ECONFERENCE ENABLING TECHNOLOGY FOR A SUSTAINABLE SOCIETY


Introduction
The delivery of healthcare and disease management are information intensive fields, in which the effective exchange of sensitive information is a crucial success factor. Digital technologies have started to transform healthcare worldwide based on promises of decreased costs and improved quality. Digital multi-sided platforms (MSP) act as intermediaries between different stakeholders such as patients, providers and purveyors (Davidson et al., 2018;Hagiu and Wright, 2015). Especially in light of severe neurological diseases like amyotrophic lateral sclerosis (ALS), healthcare providers struggle to keep up with the pace of the progressing symptoms and patients' increasing need for care, therapeutic interventions, assistive technologies, and medication (Funke et al., 2015). Here, MSP create new possibilities to promote a patient-centric model of care delivery and at the same time cut costs (Kuziemsky and Vimarlund, 2018). Several studies suggest that the use of information systems can enhance patient empowerment (Risling et al., 2017, Angst and Agarwal 2004, Deng et al., 2013. However, there is a promise-delivery gap concerning technology and data driven improvement of healthcare. In order to close the gap, challenges and wider implications for all stakeholders need to be considered (Davidson et al., 2018). Platform-based healthcare innovation claims are premised on the centralization, access and efficient use of large amounts of sensitive information. Thus, information privacy is becoming a critical topic involving perplexing trade-offs for patients: They have to weigh promises of sharing information against the potential risks and concerns related to losing control over their information (Laufer and Wolfe, 1977;Culnan and Armstrong, 1999). The sharing of medical information is not limited to impacting individuals only but yields promises to advance public health research efforts of profound societal relevance. In the context of ALS, data driven care studies appear to be particularly promising as the disease is rare (about 1% of the population are affected) and without any known cure. In addition to progressing the body of medical knowledge, direct impact of research efforts for the patient community can be expected. Ethical discourses evolve around data donations and the question whether medical data should be considered a common good (Hummel et al., 2019).
While benefits of using large amounts of medical data to foster innovation, increase efficiencies or improve medical and care research become apparent, they must be balanced with protecting personal privacy. The issue of information exchange on a healthcare platform has rarely been examined from a patient perspective and with respect to patient sovereignty and empowerment (Shen et al., 2019). The purpose of this research is thus to use the privacy calculus perspective in order to illustrate the dilemmas of terminally ill patients in the context of a healthcare MSP. More specifically it will address the question: (How) is it possible to balance information needs and patient privacy, while ensuring patients' empowerment?
This research will examine multiple trade-offs that arise from patients' perspectives on numerous information purposes from a privacy calculus perspective. Our empirical setting is Ambulanzpartner Soziotech GmbH (APST), a MSP that orchestrates case management for severe neurological diseases. APST acts as an intermediary between patients and care providers, and thus as information aggregator, guardian and gatekeeper (Fürstenau et al. 2019). It also collects and uses information for research purposes. Based on a rich case description we first shed light on the particularities of the healthcare MSP and its information centric practices. Focusing on the patient's perspective, privacy calculus theory is used as lens on the value of personal health information. We have used an extreme case sampling strategy to select the case, expecting that it will yield more clearly articulated views on privacy trade-offs. We propose exemplary design options that have the potential to enhance patients' information sovereignty and meet information needs appropriately. Finally, we will discuss relevant implications and provide an outlook for empirical investigations.
Our contributions are twofold: First, we contribute to the information privacy literature by enhancing the understanding of terminally ill patients' privacy perceptions in a digital healthcare context. We explore possible contingency factors that extend the privacy calculus in this realm. Second, we inform the design of a stepwise consent option that paves the way for an informed calculus. We further discuss and reflect on implications of platform-based information exchange in healthcare for patient empowerment to enable responsible healthcare innovation. ENABLING TECHNOLOGY FOR A SUSTAINABLE SOCIETY

Case Background
We use an extreme case to examine data-based healthcare management 1 . The operating logic of APST and the nature of information exchange via the healthcare MSP provide a backdrop for a deeper understanding of the trade-offs that patients face.

Platform-based Innovation for ALS Care
ALS is considered a "relentlessly progressive and fatal neurodegenerative disease characterized by progressive weakness of voluntary muscles of movement as well as those for swallowing, speech and respiration" (Soriani and Desnuelle 2017, p. 288).
Due to the severity and swift progression of the symptoms, patients are not only overwhelmed by the dire prognosis of a non-curable disease, but face challenges of organizing and adjusting medical care and assistive technology as the disease progresses. Thus, ALS care has profound ethical issues during treatment and care (for a review, see Seitzer et al. 2016). One of the several shortcomings in the German ALS Care System is the significant delay of providing assistive technology due to long insurance approval processes (Funke et al., 2015). APST aims to address these gaps and provides an illustration of how a digital health platform can facilitate the coordination and inter-professional cooperation of multiple providers as a multisided transaction platform model. APST is operating under two different logics: providing care management on the one hand and functioning as research infrastructure on the other. By maintaining the electronic health record and connecting patients and doctors with care providers and assistive technology providers, the platform aims to transform the field to a new way of care orchestration. Opportunities are created that lead not only to complexity reduction for individual patients but also promise an increase in efficiency and effectiveness of care provision (Fürstenau et al., 2018). Patient feedback on care services and devices is solicited in order to improve the quality of care and faciltiate a learning cycle. At the same time, the platform is connecting the patient pool with research partners to conduct medical and care studies or improve platform efficiency. Thus, the disclosure of personal health information holds not only potential benefits for the orchestration of patients' care but also for the platform and the related partners (service providers and researchers).

Information as Main Resource
Innovative modes of interaction are possible because of patient's health and medical information: As a digital intermediary, which collects, stores and redistributes information, APST relies on the extensive use and economization of patient data. APST thus combines the data-economy logic of information accumulation with the goal of providing a patient-centric care model. This raises potential conflicts of interest as it takes practices critically discussed in the context of data capitalism (Zuboff, 2019) to the realm of care. For APST, patient information is one of the main resources. Drawing on Levitan (1982), we depicted the information lifecycle for APST in Figure 1.  Levitan, 1982, p. 48) Information is acquired and generated by patients who provide personal information or a health record to the platform, give feedback or respond to surveys and take part in trials. By storing it centrally, APST is able to transform and prepare the information for further purposes. The different modes of interaction and the different stakeholders that are involved are illustrated by the flow of information via ENABLING TECHNOLOGY FOR A SUSTAINABLE SOCIETY information products to the various users. The information lifecycle sheds light on the dynamics that arise with information as the main resource from the perspective of APST and illustrates the diverse purposes and types of use for collected information. Patient information, which is provided by consenting patients, is essential for a successful operation of the platform. Empowering patients to make informed choices about providing information is crucial in order to ensure that APST is not only extracting value from the information but also -and primarilycreating value that will benefit patients. It is therefore crucial to understand how patients reach the decisions to consent and to share. We take the patients' perspective and model trade-offs initially within the parameters of the case before discussing options of generalizability.

Related Work
Information privacy has triggered a significant stream of interdisciplinary research (Smith et al., 2011). Due to the sensitive nature of relationships it has been a longrecognized issue in healthcare. Health information privacy research that addresses the patient's perspective has mainly considered concerns (Rindfleisch, 1997), risk perceptions, and information sensitivity which were found to influence the adoption of electronic health records (EHR) among others (Angst and Agarwal, 2009). The privacy calculus was introduced to social sciences by Laufer and Wolfe (1977). Following elaborations by Culnan and Armstrong (1999) it was refined and extended in order to explain how online users weigh privacy related risks against benefits, and became a prominent topic in IS research (Dinev and Hart, 2006). The examination of trade-offs has also been applied to health-related decisions (Dinev et al., 2016). Health information is perceived as having the highest risk profile compared to other personal data, when sharing decisions are considered (Milne et al., 2017). Next to information sensitivity, health information privacy concerns that address the use, collection, and access to information play a major role (Kenny and Connolly, 2016).
To mitigate the effects of risk as a major inhibitor, control and trust are discussed.
Perceived benefits and promises that are tied to the information sharing can compensate the perceived risks. Convenience, internet experience or personal factors (like emotions) were proposed to influence the calculus and attitudes of patients (Anderson and Agarwal, 2011;Dinev et al., 2015). We use the lens of the privacy calculus to develop a better understanding of privacy trade-offs in interorganizational relationships from the perspective of the data subject.

Patient's Privacy Trade-Off
Following we take the perspective of the ALS patient to examine and sketch out the relevant considerations in consent situations regarding APST. Perceived risks and benefits depend on the purpose of information usage. Thus, we distinguish between the main purposes or information products, as elaborated in the information lifecycle, to model the trade-offs that arise. In Table 1, type (1-10) and purpose of information (A-E), are tied to promises that a consent would yield, followed by potential risks. We model the perceptions based on publicly available information from APST, most is inferred from the data protection declaration (APST, 2020).
APST makes potential benefits (promises) related to different information purposes tangible for the patient. Also, secondary benefits like hopes for improvement for future patients, that do not directly relate to the individual patient, are likely to play a role. The table suggests that benefits can be tied to type of information and purpose, while this is not obvious for risks. Privacy valuations are sensitive to contextual and non-normative factors (Acquisti et al., 2013). The special context of ALS calls for distinct considerations: As ALS is a rare disease, additional information for research (D, E) is even more valuable. This however also gives rise to additional risks: with a small sample, the risk of deanonymization is higher. Patients with special and immediate care needs tend to be more interested in necessary care transactions than in concerns about their privacy (Lafky and Horan, 2011). This is presumably the case for ALS patients as the disease manifests quickly. The risk of leaking information to employers or others becomes irrelevant as soon as the disease becomes manifest and insurance providers are inevitably informed once they need to approve aid. Patients emotional responses might also play a role as it was indicated that altruistic perceptions can outweigh risks (Spencer et al., 2016). ENABLING TECHNOLOGY FOR A SUSTAINABLE SOCIETY Another boundary condition to consider is trust: while APST aims to create a trustworthy environment, the complexity of the relationships orchestrated by the paltform can lead to misspecifications of trust (Möhlmann and Jarvenpaa, 2019). By drawing on relevant literature as well as the parameters of the case, we conjecture that terminally ill patients perceive higher benefits from sharing information.

4
Towards an Informed Consent Calculus

The Consent Dilemma
Terminally ill patients depend on efficient and effective orchestration of healthcare.
In order to receive care, information exchange with doctors and caregivers is inevitable. In situations of advanced care needs, however, the patient is typically under enormous emotional strain, left with no time nor meaningful decision rights. This stands in stark contrast to the assumptions of economic rationality underlying the privacy calculus, as patients will most likely not be able to actually fully assess risks and benefits. Promises or benefits are most often tangible, while risks are delayed and hard to grasp (Acquisti et al., 2015). APST has addressed both, legal requirements and the aim to provide transparency to patients, with an extensive privacy policy, which needs to be signed by all stakeholder (APST, 2020). However, research has shown that privacy policies are often neither understood nor read, instead they may increase information asymmetries. Therefore, users' need to consent to conditions they are not able to comprehend creates a consent dilemma (Solove, 2012). It thus seems crucial to effectively empower patients in the context of a healthcare MSP, so that they understand the implications of their options as prerequisite for an informed and meaningful privacy calculus.

A Stepwise Consent Model
By proposing an exemplary stepwise, and dynamic option for consent we aim to illustrate how patients can be empowered to apply an informed mental calculus in the context of APST. Dynamic consent has been discussed in medical research for means of ethically gathering data for clinical trials (Spencer et al., 2016). Through legal advancements, dynamic consent has found its way into cookie consent management. We apply this approach to examine how a consent situation can be created that integrates the calculus and enables the patient to make an educated ENABLING TECHNOLOGY FOR A SUSTAINABLE SOCIETY decision. In Table 2, we depict a possibility to manage information provision consent for APST in a similar fashion. We translate the findings from Table 1 and Figure 1 in order to establish a consent option, that allows to differentiate between type of information and different purposes. We have developed one of the hypothetical consent options to share aid and medical data for information types 6, 9 and 10. We draw on psychological empowerment to inform this option further. Psychological empowerment is based on the concepts of autonomy, self-efficacy, meaning and impact (Spreitzer, 1995), which are reflected in patient empowerment (Bravo et al., 2015, McAllister et al., 2012. The options to decide for which purpose and in which form patient information is used, would enable patients to make informed and differentiated choices about sharing information. A consent option like the one depicted would illustrate the data driven logic of the platform. With a comprehensive overview, patients are presumably more capable to assess the impact of information sharing. We could better inform patients' privacy calculus by providing the information necessary to make a good judgement of personal risks Show information: Information about you, your care and aid prescriptions, usages, provider and physician information is neccessary to perform a transaction. For a transaction, we only share the minimum of relevant information needed. You can choose to provide this data in personalized or anonymized form for further analysis which helps to improve care efficiency, or provide it to relevant research efforts to advance care and medical research and benefits. We try to address uncertainty about future use by providing an overview over a range of possible purposes. In this way, we make the information lifecycle transparent for the patient. Being provided with further details on the consent decision, patients would not only have more control and autonomy in their privacy decision making but also understand the impact of their choice which enable them to attribute meaning to their consent. As privacy preferences are also not stable but evolving, it would be useful to apply this consent form dynamically. With the options to make convenient and economic choices we thus aim at patients' psychological empowerment.

Discussion, Limitations and Outlook
In the consent context of the case, patients act as active information contributors. By providing stepwise and dynamic consent, the patients' ability to make informed decisions is extended. She is now able to choose if, how, and to whom power over personal information is transferred. Acting in the patients' interest, APST thus takes on the role as an information trustee. By taking into account individual preferences, information provision can therefore be considered an exercise of sovereignty (Hummel et al., 2019). Still it needs to be critically assessed, if privacy in a data driven business model can truly be balanced in this way. It is conceivable, that reactance behavior is triggered and patients, as a matter of principle, have higher cautions for privacy and choose not to share information at all. Patients potentially react the same way as consumer who scrolls through software update notifications, leading to higher information asymmetries and a privacy apathy instead of information sovereignty (Hargittai and Marwick, 2016). In turn we argue that the problem of patient information overload can be mitgiated by structuring the decisions and presenting them in a way that faciltiates information consent, thus making it a design issue. A clear limitation is that we merely provide an exploration based on the theoretical as well as the case background and can not empirically validate perceptions and consent options. The rich theoretical background and the specific case insights, however, pave the way for this empirical examination of patients' privacy calculus towards a multi-level use of information on a healthcare platform. Further examination is needed to investigate the differences in perceptions and valuations, to see, how they relate to the different usages of information on the platform. In this way, the options that we modeled in chapter four need to be refined and empirically validated. This paper provides a hypothetical form of enhanced consent and further research needs to show how this leads to an increase in perceived empowerment. A first step would be to explore patients' privacy perceptions under the calculus framework. Modelling these valuations into the consent options, psychological trade-offs that are considered between the different options could be assessed. To do so, we propose a conjoint analysis. Thus, we will also be able to examine the relative importance of different bundles of options to truly understand what terminally ill patients perceive as empowering.

Conclusion
We have shed light on the dynamics of a healthcare MSP, which strives on various categories of patient information (see table 1) as main resource. Adapting the information lifecycle we show how the platform is drawing on a logic of accumulation, feedback based-learning and cautious monetization typical for business models in the data economy, yet with the explicit goal to improve patient care, care research, and medical research and thus create value for patients.
Information intensive practices incur considerable privacy concerns. We provide insights in the distinct perspective of terminally ill patients' privacy perceptions and decision making. This understanding opens up possibilities to enhance a patientcentered design in the light of a severe neurological disease. We propose a stepwise consent form to inform meaningful privacy options and to empower patients that interact with the healthcare platform. This provides an avenue for further empirical examination of patient empowerment that balances platform innovation, care, and medical research with information privacy. In this way, our research further contributes to the advancements of responsible and sustainable healthcare innovation and research practices.