Health and New Technologies

One of the most prevalent public health problem is mental illness, with a predominance of people with depression. However, mental illness is still under diagnosed and, in the UK,only 37% of adults suffering from depression get access to treatments.

Artificial intelligence (AI) in mental healthcare has the potential to transform our approach of mental illness, and this blog will focus on the use of AI within social media (SM) as tools to identify individuals with mental illness. SM are influential online platforms, with about 92% of adolescents going online daily and sharing personal content. Based on the general presumption that words may predict our future mental health, AI analyses different information to detect uncommon patterns of expression. For instance, researchers in 2017 trained machine-learning systems to analyze the colors of images posted on Instagram to detect depression. Snapchat also launched a new monitoring feature to detect searches for words related to mental illness and return links for the user to adequate mental health information or services. Last but not least, Facebook developed a suicide algorithm to predict risks of suicide attempt of the users, and then flag the posts in case of risks to alert the team of content moderators.

In this blog, I will argue that even though the use of AI within SM to detect mental illness is an interesting technique that could be further considered, there are still too many concerns to overcome that should prevent the use of this tool. This blog will first consider the expected benefits of AI within SM for mental illness and then explore the legal and ethical concerns.

The expected benefits

While interactions on SM platforms can provide peer support for people with mental illness, the use of machine-learning techniques can be another way to help improving users' mental health. Techniques used by general practice to diagnose mental illness have proven to be relatively ineffective due to the complexity of human beings. By being able to process massive amounts of data, machine-learning techniques can make predictions with a high accuracy rate. Coupled with the large amounts of data on SM, it seems that the use of AI within SM is an adequate tool to diagnose mental illness. For instance, research on AI analysing pictures on Instagram to detect markers of depression achieved a 70% success rate. Even though this technology is in its infancy, it is likely that the detection of mental illness and subsequent interventions for access to mental health information or services can provide real benefits to users.

However, the algorithmic assessment of mental health states on SM raises significant legal and ethical concerns, and this blog will focus in particular on the lack of transparency of these algorithms and the risks for users' privacy.

Transparency

First, the algorithms used by SM companies are generally black boxes of decision-making, either because they are protected as trade secret, or because the vast amount of data processed to infer mental illness make them opaque. It is thus nearly impossible to explain how they reach their conclusions. This opacity raises concerns regarding the  transparency needed to ensure trust of the users and allow further analysis by experts. Currently, it is unlikely that these algorithms would comply with the right to explanation under the GDPR.

Privacy and data protection

Secondly, as shown by the suspension of the Samaritans Radar twitter app in 2015, the greater concern with the use of AI within SM to diagnose mental illness is probably the concern of users' privacy and the protection of their data, especially in the context of mental health.

While healthcare professionals are held to confidentiality standards, companies using AI online to diagnose mental illness are not subject to the same obligations. This practice may circumvent traditional protection of confidentiality, such as with Facebook's communication of a user's information to take him to hospital even though the user said he was well.

Another concern is that mental health state information collected and processed by SM platforms is not covered by the adequate data protection laws that should apply for sensitive personal data. First, it can be difficult to anonymise users' posts, as there can be a lot of context in a picture or a message. Moreover, the existing companies using these services do not obtain an explicit informed consent from the users, who may not be aware of the scanning of their posts and cannot even opt-out. This is in part why Facebook's algorithms to predict suicide risks have been banned in Europe. Within the climate of distrust of SM usage of personal data, a recent survey in the UK has shown that individuals do not seem to be ready to provide consent for such analysis of their data for mental health services, and that to them the benefits would not outweigh the risks to privacy. Another major concern is related to third parties access to this data, such as advertising companies, insurance companies or employers. Being highly sensitive, the disclosure of mental health condition could have a range of negative impacts on those who are identified as having such conditions, with for instance a risk of discrimination or stigmatization.

Direct-to-consumer genetic testing (DTC-GT) companies, such as 23 and Me, are offering ancestry and health kits which analyse consumers’ genetic composition to provide information on their ancestry, on their likelihood to develop ‘fun’ traits such as eye color, and on their predispositions for some diseases such as Alzheimer. DTC-GT companies have conveyed the idea that these tests have many benefits for consumers. Based on the trend of personalized genomic medicine, it is put forward that they can provide valuable information on consumers’ health and that they will be able, without any intervention of the clinical setting, to be proactive in their health monitoring and management.

However, DTC-GT companies are largely unregulated. Coupled with the fact that these tests are of low clinical validity, this practice raises many legal and ethical concerns. One of the main questions is whether DTC-GT services help consumers to make autonomous decisions. Focusing mainly on the companies’ practices, this blog will argue that DTC-GT services are more of a hindrance for autonomous decision-making. After considering the notion of autonomous decision-making within the specific context of DTC-GT, the persuasive marketing approach and the lack of genetic counselling of DTC-GT companies will then be discussed to show to what extend their services inhibit autonomous decision-making.  

Autonomous decision-making within the context of DTC-GT

In bioethics, the notion of autonomy refers to the ability of a competent person to make his or her own decisions about their health care freely and without external influence. Within the DTC-GT context, this may only happen when consumers both do not have an exaggerated vision of the tests’ benefits and have received and understood sufficient information on the nature and characteristics of the tests, which depend on the informed consent process they went through.

A persuasive marketing approach

First, marketing campaigns convey the message that consumers will be empowered and capable of making better decisions in the management of their health. On the website of 23 and Me, testimonials are reporting that the tests results ‘have been life changing’. There are also video and advice from a consultant, suggesting that people have the social responsibility to take care of their health and to take advantage of these services. The information is not provided in a neutral way and create incentives to buy these tests.  

These techniques attempt to manipulate the ability of consumers to reason and judge freely on whether they need this service or not. In contrast to claims and advertisement regulations for drugs or food supplements,  this commercial communication presumes the consumers are autonomous and rational. As already mentioned, DTC-GT is at the intersection between the medical and the commercial context. By exaggerating the benefits, suggesting that DTC-GT are clinically useful and passing the risks and limits of the test under silence, consumers may have unrealistic expectations for these tests. This communication does not serve the purpose of supporting autonomous decision-making and bypass the individual’s capacity to rationally reason and make decisions based on adequate and trustworthy information.

Lack of adequate genetic counselling

Secondly, it is known that genetic counseling has an important role to play to ensure informed consent and autonomous decision-making. Genetic counsellors can, among other things, explain to consumers the nature and characteristics of the tests, their benefits and limits, the diseases being tested for, the other potential factors to consider, as well as explain the results and present the subsequent possible actions the consumer can take. By giving them this information and promoting a constructive dialogue, consumers are put at the center of decisions about the management of their health. Armed with all the necessary tools, they can critically reflect on the different outcomes and it can be considered that consumers are exercising autonomous decision-making, even if their decisions involve in fine uncertainties and psychological harm.

A recent study showed that most DTC-GT companies fail to ensure an adequate genetic counselling service. Before the consumers order the test, access to a genetic counsellor is never offered. At the same time, the information on the websites are blurring the lines between, on one hand, the tests related to ancestry and fun traits, and, on the other hand, the tests related to health and serious diseases. As a result, consumers may not be fully aware of the sensitivity of certain information they will receive nor on what is the exact value of these tests. Once the test results are released, 23 and Me simply advises consumers to consult a professional without providing internal access to genetic counsellors. The results may be difficult to understand for most of the consumers, who may even be surprised and overwhelmed by some information. Considering also the importance of the false-positive or false-negative, the lack of genetic counselling may lead consumers to make inappropriate decisions. This lack of support from DTC-GT companies is a hindrance for autonomous decision-making on further treatments or changes in lifestyles.

The expected effect of more autonomy may then prove to be futile. If DTC-GT services do not help consumers to make autonomous decisions, then consumers may go and see their GPs to obtain advice. Even if DTC-GT information may be useful, they do not really empower the consumers but rather give further information to GPs when interacting with their patients.

Nowadays, smartphone applications related to health and wearable devices are increasingly developed in the commercial sector for different purposes, such as measuring fitness or losing weight.

The EU General Data Protection Regulation 2016 (GDPR) defines data concerning health as personal data which reveal information about the health status of a person. In 2016, the Dutch Data Protection Authority (DPA) gave clarifications on what is data concerning health. The Nike+ Running application could correlate information on users’ running with other personal data provided for the creation of the account to have information on the health of the user. The DPA concluded that the application was collecting and processing data related to health.  Therefore, personal data collected by a connected object outside the medical context may constitute data related to health if information about the user’s health status can be deduced from it.

Pursuant to the GDPR, the processing of data concerning health is in principle prohibited, but one relevant exemption is when the person concerned gives an explicit consent. The Article 29 Working Party has specified that an explicit consent refers to “the way consent is expressed by the data subject” and can for instance be given in a written statement. Furthermore, the consent should always be freely given, informed, unambiguous and specific to a particular process. As a consequence, companies have to take measures to ensure all these conditions for users of an application collecting data related to health are met.

In order to have a legally compliant consent, one of the main challenges is to ensure that users of these applications understand what they are consenting to when they register an account and that they understand the Privacy Policies and Terms and Conditions.  The GDPR provides a solution: The Principle of Privacy by Design (Art. 25 GDPR), which requires that data controllers and processors take into account confidentiality, security and data protection throughout the planning phase and lifecycle of the connected objects.

After the revelation of the partnership between Google and the American health provider Ascension for the mass collection of individual’s medical records, I have decided to write on the (lack of) protection of health data when citizens are surfing on the internet for medical information or services. 

The recent ICO’s guidance on the use of cookies and similar technologies (e.g. JavaScript objects) clarifies how the Privacy and Electronic Communications Regulations (PECR) and the General Data Protection Regulation (GDPR) interact to regulate the use of cookies. Pursuant to Regulation 6 of PECR, consent is generally required when placing cookies on website users’s devices. The consent must always respect the GDPR’s conditions, and thus be freely given, specific, unambiguous and informed, regardless of whether the data accessed is personal or not. Third-party cookies are frequently used by advertising technology companies to build a profile of users’s behavior for direct advertising. In this case, the guidance specifies that the users’ consent is always required, and third-party sharing should be disclosed to users. Moreover, the guidance highlights the importance of a “clear and specific consent for more privacy-intrusive cookies, such as those collecting sensitive personal data such as health data”. 

Despite these regulations, the design of many websites to obtain consent to not allow a meaningful consent and users are generally unaware of the exact use of tracking technologies by advertising companies. In their daily life, users tend to accept the use of cookies to have a full access to the website services (see for example https://www.healthline.com/) and do not read the - overly complicated- cookie policies. This reality is even more frightening when users access websites for health information or services, or when they disclose health data. 

While the commercial imperative for cookies on ad-funded websites may be defensible, the Ad Tech Surveillance on the Public Sector web Report from Cookiebot reveals that ad companies use diverse tracking practices on several non-ad funded public health websites. For example, the official website of the Irish Health Service Executive organisation contains the ‘ShareThis’ tool that acts as a ‘Trojan horse’ and, through it, 20 tech companies have inserted ad trackers. 

This raises not only serious privacy concerns and health data leakage, but also a risk of manipulation and discrimination. Once processed by the ad companies, data may be resold to other companies, such as insurance companies, that will exploit users’ sensitive facts about their health condition. 

Once again, today’s topic is not directly related to the health sector... even if government’s willingness to combat harmful content online contributes to the protection of internet user’s mental health ! 

Given the importance of data and medical devices in the medical sector, I would like to focus on the legal protection of medical devices computer programs and the data they generate. 

Implantable and wearable medical devices (IWMDs) are nowadays developed for diagnostic, monitoring and therapeutic applications (e.g. insulin pumps, pacemakers or glucose monitors). These IWMDs are connected to area networks, computers, smartphones, and to cloud--based medical data repositories. 

Access to IWMDs is generally limited by technological protection measures (TPMs), which are the systems by which a copyright holder may restrict access to its software (e.g. encryption or scrambling). In the United States, circumvention of TPMs that control access to copyrighted work are prohibited by the Section 1201 of the Digital Millennium Copyright Act (DMCA). In other words, by protecting TPMs in software, the DMCA prevents third-party inspection of health data. As a consequence, until 2015, medical devices manufacturers could prevent access to many valuable health data for their analysis and scientific research. Also, patients couldn’t access to their own health data generated by the medical devices they were using. 

The Copyright Office of the Library of Congress conducts every three years a rulemaking process in order to determine exemptions to the anti-circumvention provisions. Since October 2015, the scope of these exemptions has been extended to medical devices computer programs and the patient data they generated. 

More precisely, the office has separated the exemption in two: for the person accessing software for security testing or research, and for patients accessing their data. The first exemption is for good-faith security research, by researchers investigating personal monitoring system, as long as they are not used by patients. The second exemption is exclusively for patients who request access to information that is being generated by their own medical devices or personal monitoring systems. 

Such anti-circumvention exemptions can support safety issues and better access to information that enables scientific research. This type of research is essential to ensure patient safety and should be allowed in a period where medical devices manufacturers make a greater use of TPMs. For the second exemption however, the question is whether patients access to their own medical information effectively help them to better monitor and treat their health conditions. On one hand, this access can help patients to understand the evolution of  their health condition and take remedial action without having to wait for doctor’s advice. On the other hand, particular attention must be paid to the data made available directly to patients, so as not to cause misunderstanding, stress or even a risk of misbehaviour.