September 4, 2024

Communicating About Data Security and Privacy in Health Research

By Katie Rush, Director of Public Relations and Science Communications, and Jilliene Drayton, Director of Participant Communications and Outreach, at the All of Us Research Program

All of Us team members support community engagement efforts across the country to raise awareness about the research program and the opportunity to take part.All of Us Research Program

When a person considers participating in research, there can be a natural struggle between their hope to contribute to science and their interest in protecting their privacy and data. Those of us working with NIH’s All of Us Research Program know this challenge well. Since 2018, All of Us has been inviting participants from across the United States to contribute their information to help researchers better understand how genetics, environmental factors, and life experiences impact our health.

We understand the sensitivity of what we’re asking participants to contribute. That’s why we’ve put data security and privacy at the forefront of our work. Beyond protecting people’s data, we know we need to ensure that participants have the information they need to understand and feel confident in how their data is protected.

When sharing information about research efforts like All of Us, it’s crucial for communicators to understand and convey the data protection and privacy safeguards that studies are using. There are four key approaches that we focus on at All of Us:

• Be Specific and Translate: The technical details of security standards can feel like a foreign language. That’s why it’s important for us to describe the key aspects of protections in plain language that’s accessible to participants and prospective participants.
  
  At All of Us, we emphasize several aspects of our data security and privacy measures. We share details about system security. These include strict rules on access, ongoing monitoring designed to detect unusual activity, and tests that can help us find vulnerabilities so they can be fixed. We highlight our privacy measures, such as the removal of direct identifiers (like names and addresses) prior to making data available for research, and encryption—or scrambling of the data to prevent it from being used by people who don’t have permission. We also ensure that participants know how we’re holding researchers accountable for responsible use of data through strict policies and required training.
• Talk About It on Repeat: Reiterating information about data protections and privacy is critical when talking about research to the public. This is especially true for longer studies or programs like All of Us that depend on people being engaged over time.
  
  Science and health communicators should look for opportunities to share—and re-share—helpful information that can support education, awareness, and confidence throughout participation in research programs. That means creating and promoting materials designed to increase understanding. For All of Us, these include videos that accompany the informed consent, specific sections of our websites that focus on our safeguards, dedicated fact sheets, and clear messages and FAQs that our frontline staff at health care and community organizations and at our call center can use to quickly and directly address questions from participants and the public.
• Provide Visibility into Data Use: Very often, participants are not made aware of how researchers are using their data. To help participants feel confident about sharing their information, communicators should create and share resources that explain who is using the data, how they’re using it, how the program is holding them accountable for using it responsibly, and what they’re learning.
  
  We do this in several ways. We post a list of organizations that have a Data Use and Registration Agreement in place. Researchers must be working with one of these organizations before they can sign up to become a registered user. We also maintain a directory of research projects underway. If something doesn’t look right, participants—or anyone else—can flag a research project for review by our Resource Access Board to ensure researchers are fulfilling their obligations for responsibly using the data. Finally, participants can see the impact of their data contributions through our listing of scientific publications that include All of Us data, and through selected research summaries, our Research Highlights, that we deliver to participants in a monthly newsletter.
• Be Real: It’s important to be upfront that even with the best protections, risks still exist. Ultimately, everyone is willing to accept a different level of risk. Sometimes the informed consent process ends with “No, thank you.” It’s the job of researchers and communicators to help potential participants understand what our safeguards are and what their limitations may be. With that information in hand, people can decide if taking part in the research program is the right choice for them.

Science and public health communicators are crucial to the success of research efforts. They can help people better understand the risks of taking part in research, the protections in place, and the greater societal benefits. And those efforts yield results. Every day we’re inspired by the more than 825,000 people who have joined the All of Us Research Program to share their health data and drive new discoveries, to pave the way to a healthier future for all communities. With effective communication about data privacy and protections, continued progress like this is possible.