Long-term medical data storage: challenges with test results obtained by direct-to-consumer testing

Introduction to DTCT

In most countries, laboratory testing is part of healthcare and most of the testing such as for prophylaxis, risk assessment and therapy monitoring of chronic diseases is performed either by a medical doctor or under the supervision of a medical doctor. In most cases, this testing will take place by sending the patient’s specimen from the attending physician to the medical laboratory [1].

Glucose self-testing, beginning with non-invasive urine tests over testing from finger prick and currently continuous testing in interstitial fluid, was and is the most frequent application for laboratory testing in humans without the immediate supervision of a medical doctor. This kind of testing is called “point-of-care testing” (POCT). This term leaves open whether the testing is done by healthcare professionals or the patient himself and would not include self-testing in healthy subjects. Therefore, the term DTCT (“direct-to-consumer testing”) was introduced (for details, see [2, 3]). DTCT does not describe the place of testing: either close to the patient/consumer, which shares many features of POCT, or even using central laboratories to which the specimen (such as whole blood, saliva, cells obtained by a mouth wash) is sent by mail. Essentially all of this DTCT includes a transmission of the results through the internet and some long-term storage of the measured data using apps. The striking difference of DTCT compared with traditional testing is the lack of healthcare professionals in the preanalytical processes, such as for test selection and sample collection, and in the postanalytical processes, such as for data interpretation and counseling based on the test results.

The reasons why DTCT is used instead of real laboratory testing are manifold. Some may use it just out of curiosity. An illustrative example is a test offered by 23andMe [4] which investigates the personal ancestry including Neanderthalian heritage. Other DTCT may be triggered by commercial interests, for example tests for cytochrome p450 polymorphism designed as a gift to depressive relatives [5]. Others may use DTCT because of fear of discrimination, e.g. testing for human immunodeficiency virus (HIV) or sexually transmitted disease (STD) [6], because of the ease of use such as lactate testing during sports activities or because of the promise of lower costs compared to traditional testing [7].

The counterpart to the biochemical tests in DTCT are fitness trackers and apps, which are easily available at reasonable costs. These devices, also called “wearables” (for “wearable computers”) allow recording and storage of diverse physiological data, for example physical activity, body weight, heart rate or blood pressure. Attempts are already made to combine physiological and numerical biochemical data like in a diabetes diary app [3]. Numeric results obtained by wearables or by biochemical tests allow the automatic calculation of (usually proprietary) indices for personal fitness or the risk of adverse medical conditions [8].

Because of the unclear differentiation between healthcare testing, POCT and DTCT, it is obvious that test results from DTCT will also be used for healthcare purposes and that the challenges of long-term data storage must also be addressed for DTCT data. Currently, strong efforts are made by the European Commission in the “Horizon 2020 program” to establish long-term storage of medical data, either for the benefit of the patients, the attending physicians, the reduction of costs or to allow scientific studies [9].

Taken together, the current situation is characterized by numerous ideas for the different uses of DTCT data and very little regulation, quality assurance, data security or standardization of the data.

To safeguard the medical profession as well as the patients’ integrity is a clear necessity in regulating this long-term storage. Until recently, in healthcare the individual physician or the hospital was exclusively in charge of keeping patient records. In this concept, the quality and reliability of the data in the medical record is known (as medical data and the medical record were generated by the same person(s)). When DTCT data are included in medical records, data of different qualities are intermingled and any physician relying on that data is no longer able to draw the necessary medical conclusions which will have a direct impact on the quality of care for the patient.

The most prominent example of data failure in DTCT was Theranos, a company that tried to revolutionize the US market for laboratory medicine by testing capillary samples drawn from the neighborhood pharmacy and sending the test results directly to the patient [10] and even received a prestigious award from the European Patent Office, both for the nonexistent technology and the alleged cost reductions. Theranos also tested laboratory samples from university hospitals despite the technology employed being obviously not suitable for medical testing [11]. They claimed to be exempt from FDA approval as the tests allegedly were developed and used only within the organization (under the exemptions valid for laboratory developed tests) or they failed to reach minimum performance goals over extended periods of time for critical tests such as coagulation testing while employing standard laboratory technologies [12]. It is worth noting that Theranos received dramatic sanctions from the Centers for Medicare and Medicaid Services in July 2016 [7]. While some believe that the regulatory framework is even too lax in the United States of America [13], it is noteworthy that some countries such as the United Kingdom and Germany have no specific laws or regulations governing the ownership of a laboratory (with the exception of blood transfusion and embryology), requiring only registration with the devolved national independent regulator of health and social care services. In Germany, essentially no regulations are in place for non-medical laboratories: the “MTA-Gesetz” allows the testing of “simple tests” for laypersons and many DTCT tests might be categorized as these “simple tests” as long as they are not reimbursed by the public health insurance. It is noteworthy that DTCT – even when not performed according to German legal regulations (RiliBÄK) – is reimbursed by the government (“Beihilfestellen”) for public servants and their relatives.

The situation with DTCT is rather challenging for the patients and the medical laboratories. First, the definition of healthcare and the legal regulation which are necessary to protect patients’ integrity – despite being universal – are rather complex and even differ between countries. When internet technologies are used, country borders become invisible and national regulation will be of little meaning. This creates a paradox situation in the EU that on one hand a legal framework of EU directives such as “Regulation on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing (Directive 95/46/EC)” and detailed national regulations will ensure data security and because of the principle of subsidiarity in healthcare, an array of national regulations will limit the illicit access to health data effectively. On the other hand, all these regulations are without any meaning when the data are not hosted on a centralized server with a known location but in the cloud outside the EU such as in some DTCT apps or in wearable apps [14, 15].

Related to the world-wide marketplace of laboratory tests are attempts to blur the difference between laboratory testing for healthcare and for lifestyle purposes [4]. The first being highly limited and regulated with the need to obtain sufficient quality for proof medical decisions, the latter with very little regulation to allow free trade and the rules of the marketplace and without need to address a minimum level of quality for medical decision making.

It is obvious that for long-term storage of (medical) laboratory data, the numerical result of the testing device (such as a glucose concentration) alone is not sufficient but must be amended by data describing, e.g. the purpose of testing (such as screening versus monitoring or routine versus short turn around testing [STAT] [16]), the adherence to preanalytical conditions [17], the performance quality of the testing device including test method, the person (including qualification) who entered the data and whether the data were entered manually or automatically by data download [18]. Data on the performance quality of a testing device can be obtained by self-declaration, by legal regulation and by supervision of the authorities, but in reality, they are often obtained by marketing buzz only. Legal regulations, in particular, for in vitro diagnostics differ substantially between health systems: for example, in the US the Food and Drug Administration (FDA) approves test kits for use in healthcare and Clinical Laboratory Improvement Amendments (CLIA) approves medical laboratories individually on a regular basis. In Germany, the focus is on structural quality of medical laboratories and on performance quality (internal quality control and external quality assessment) which is regulated by the RiliBÄK (Guidelines of the National Physicians Chamber). RiliBÄK mandates, in detail, the quality management system as well as the scope and the minimum frequency of internal quality control and external quality assessment [18]. Test kits for healthcare are regulated by EU legislation similar to FDA approval (called “CE-marking”), but this marking addresses only the manufacturing process and does not address the actual result quality. This might change in the future as the new EU In Vitro Diagnostics Regulation requests clinical evidence for in vitro diagnostics [19].

However, for laboratory testing outside of healthcare (such as for lifestyle testing or for DTCT), there are no essential quality requirements, formal approval or clinical evidence to be met in Germany, while in the US, these laboratories in most cases will need CLIA approval. Another level of complexity is added when the patient/customer himself is involved in the testing process. Certain patients can be sufficiently trained in structured education courses under the supervision of physicians for selected tests such as in diabetes or coagulation self-monitoring [20]. In DTCT, however, some testing will be too complex for laypersons without any previous training and hence, obtaining wrong test results and/or drawing wrong consequences from the test results is very likely.

Unlike most tests in the real laboratory which are tested only a few times during the life of a patient and where the costs of testing are not the primary target of test development, many tests in DTCT were developed with the goal of obtaining a (very) low-cost testing device with which a high financial profit can be obtained. As expected, the lot to lot variation in these testing devices is markedly higher than in real laboratory tests and the fitness for purpose is highly dependent on the lot of a specific reagent/device combination used, such as been shown even in healthcare for glycated hemoglobin (HbA_1c) testing as POCT [21]. In this context, consumer rights are often used as false pretences to eliminate essential patient-protecting barriers currently present in healthcare. Instead, many perceived or apparent restrictions of trade may be necessary to guarantee quality and competence. For example, one important aspect of healthcare performed by clinical pathologists is the obligation to use only tests with proven medical value [22, 23], in contrast to the many unvalidated lifestyle tests that are offered to customers without regulatory control (“quackery”). In DTCT, the claim of medical value will be a challenge to be proven as the concept avoids medical professionals as well as the concept of testing at or by the consumer will make it nearly impossible to allow side-by-side evaluation of DTCT devices with real laboratory testing equipment. This issue has been studied extensively for POCT blood glucose testing: the challenges such as the stability of liquid control samples for internal and external quality control [24] as well as the need for a failure-proof design of devices and reagents including robustness to environmental conditions when testing is performed by laypersons and outside of the premises of a laboratory are not resolved yet.

The risk benefit evaluation of DTCT relies heavily on the perspective of the evaluator: the empowerment of patients and customers has questioned the paternalistic doctor-patient relationship. Notwithstanding possible benefits in the context of P4-medicine, self-monitoring contains the risk of potential harm [25]. For example, in diabetics, intense self-monitoring has been shown to increase depressive symptoms [26, 27]. There is even a very high chance that the tests produce only medical, psychological and economic harm to the users of the tests and even on the society as a whole [28]. If unnecessary laboratory tests are ordered, chances are very high that even under state-of-the-art analytical conditions numerous abnormal (=out of the reference range limits, 95% ranges) test results will occur just by chance. If medical tests with little medical meaning or/and insufficient performance are used, a very high percentage of all test results will be abnormal and will confuse the customer [11]. In addition, sophisticated regulations safeguard the patient but not the customer. In general, the patient-physician (such as a patient-clinical pathologist) relationship is based on trust and will adopt disruptive technologies slowly (concept of “primum non nocere”, do not harm) [29]. On the contrary, the relation between a customer and a vendor (such as the vendor of DTCT tests) is markedly influenced by competition, the law of the marketplace and even the interests of others, such as buyers of consumers’ health data (“Big data”) [30, 31]. New technologies will be the prime target of the law of the marketplace and any delay by legal or ethical restrictions will be regarded merely as unnecessary hurdles of free trade.

Data format in DTCT

DTCT results will be in a similar data format as laboratory tests: the readout of the testing can be “positive/negative” (such as in urine pregnancy testing or HIV antibody testing), semiquantitative (such as the urine dipstick or prostate-specific antigen [PSA] testing with immunochromatography devices), numbers (such as glucose testing) or even narrative comments (such as genetic testing performed in a central laboratory). The data can be obtained by visual comparison with a standard without a device (comparing the color or the intensity), readout of numeric data from a device, download of numeric data from a device or download of text data by using internet technologies. Essentially all situations will employ consumer electronic devices (such as tablets, smart phones, personal computers) and some instances will use a combination of a medical device (such a blood glucose meter) and a consumer electronic device.

Devices for storage of data will either store the data locally or will use internet technologies (“data cloud”). The current concepts of data storage allow the storage of unstructured data (like scans of paper files or portable document format [PDF]) as well as structured data. Laboratory data might be a prime target for structured data storage. However, two main requirements have to be met. First, RiliBÄK requires a minimum of additional information included in each test report (Table 1). Second, data storage of laboratory data requires adherence to rigorous standards for the preanalytics [32], analytics and postanalytics, so that only data of comparable quality are presented within the same data fields.

For long-term storage of laboratory data in Germany, the current concept employs standards for test description (LOINC [33] and SNOMED CT [16]), for units of measurement (UCUM) and data format for the interfaces (HL7) [34] (Sylvia Thun, personal communication). In this concept, the data are entered in the format of the readout from the testing device and stored in their original format. When the stored data are accessed, however, the results will be recalculated by the output device to the desired unit of measurement.

The advantage of this system is that the number of test codes can be kept rather low because otherwise different units of measurement would require separate test codes and that no transformation of data has to take place at the time of storage. In Germany, this topic is of very high importance because of the lack of a national standard and a large heterogeneity of reporting units (such as reporting hemoglobin concentration in the different SI units “g/dL”, “g/L” and “mmol/L”). Experiences with glucose testing devices as well as with middleware employed for POCT testing – however – demonstrated the high risks of this concept patients were facing when the declaration of the unit of measurement of the testing device did not match the unit of measurement. When test results are entered manually, the unit of entering the data should match the data format of the output; otherwise, the patient or customer cannot check for erroneous manual data input.

While in most clinical chemistry tests an international standard as well as a traceability chain has been achieved, most other tests such as serum proteins, tumor markers or hormones are highly dependent on the method employed [35]. Current “languages” such as LOINC or SNOWMED CT lack sufficient details. For cumulative presentation of data results of these tests, there must be sufficient information about the technique employed (name of manufacturer, name of the testing device or analytical system) on each single testing result when data are entered into a database allowing longitudinal data presentation [35]. Data from the external quality assessment institutions (in Germany RFB and INSTAND) might be used for the description of the techniques employed. Another concept might be the use of common reference ranges for certain tests such as for serum proteins [36].

Genetic data in DTCT

In genetic testing, some countries such as Austria, Switzerland and Germany have put strict laws in place to protect the patient and family members [37]. If samples are sent to other countries and in particular if treated as lifestyle tests, the impetus of these laws can be easily circumvented. Targets of novel testing formats are healthy subjects and genetic testing is offered to these persons “to guide their lifestyle”. Mostly, it remains unclear whether the purpose of this laboratory testing is only lifestyle coaching with automatic “canned comments” or whether in fact this testing should better be regarded as regular healthcare with individual diagnoses and recommendations. The background of such strict legislation is the idea of genetic data exceptionalism. It shall prevent in particular inaccurate promises, the discrimination against persons according to their genotype and elaborate data protection for the results of genetic analyses [23]. In the US, strict regulations are in place for medical genetic tests, however, the FDA allows genetic lifestyle tests in general. It is obvious that – rather unpredictably – some “innocent” genetic markers at a later point in time might become strong genetic markers with severe health implications for the patient and even his relatives. A prominent example is the ε4 genotypes of Apolipoprotein E (ApoE), which has only very little effects on lipoprotein metabolism [38] but has become one of the most important genetic risk markers for Alzheimer’s disease [39].

Genetic data are generally regarded to be dichotomous data with a certain mutation or polymorphism being present or absent. The quality of genetic data in healthcare is generally very good, with an error rate of about 1% only [40]. However, an error rate of 40% false-positive results in genetic DTCT [41] indicates that reliable clinical genetic data and DTCT data must be kept separate for long-term data storage.

The concept that moral worth and economic value are mediated through the concept of disruptive innovation such as in genetic DTCT opens numerous legal and illegal loopholes in a medical field usually regarded to be highly protected [42]. The potential of misuse of genetic data is large and not restricted to the patient or customer but might also affect the parents and offspring. Very frequently, the customer will not be even aware of the consequences when confronted with the numerous sophisticated online contracts when ordering a genetic DTCT kit [43]. In general, the online order will be for a plain saliva-sampling device and a voucher for testing and this can be easily obtained even for any foreign person. The infringement of the law such as the German Act of Gene Diagnostics occurs when the sample is mailed to the company even when the person is unaware of any wrongdoing at that moment.

When genetic data are regarded to be obtained in the healthcare setting, the storage and access of these data are highly regulated, e.g. in Germany, and the data must be deleted after 10 years. The regulations are even more complicated in patients below the legal age where the time of deletion cannot be calculated easily. In addition, the results of genetic testing must be deleted or being made inaccessible on the patient’s request. The immediate deletion of these data must also include the deletion of all data backups and any database or apps containing genetic data [37].

Data safety and security issues in DTCT

A characteristic and challenge of DTCT is the intense employment of IT services [44] and the trigger of DTCT is often the ease of use. A typical use case will be the storage of glucose testing results by diabetics. Data communication between the mobile measuring device with the data storage computer will occur via cable or, more frequently by wireless local area network (WLAN), near-field communication (NFC) or Bluetooth technology with its easy one button press technology, as used in the internet of things (IoT). The concepts for the wireless technologies are ease of use and low cost; security issues are of lower priority. It might be rather easy to delete or send fake test results to the app by duplicating the identity of the Bluetooth device and to even secretly surveil the user of these devices [15]. Users of these appliances might waive their basic human and consumer rights [14]. In apps relying on manual input, the quality of the data is undefined: data entry methods such as in state-of-the-art laboratory information systems (LIS) including double key entry and/or trace logs and role schemes for the operators do not fit into the concept of ease of use in DTCT apps.

The issue of different data units and false conclusions can be circumvented when numerical DTCT data are entered in a normalized format, such as a quantity quotient [45, 46] or a derivative of the z-score. In particular, the z-score could be easily employed for this long-term storage. In short, the deviation from the reference interval mean is calculated after log transformation of the data employing the reference range value limits, such as described earlier [47]. The result can be easily color-coded and even age-dependent reference range limits – a huge obstacle in long-term data collection – are fully considered by this concept.

The next challenge arises when DTCT is used for medical decisions. Experiences with the selective opt-out of specific data such as with the elektronische gesundheitsakte (ELGA) in Austria (i.e. allowing the patient to exclude certain data such as medical data obtained on a certain day) questions the feasibility of such a concept when used in DTCT.

Medical data are regarded as very sensitive data and numerous restrictions for storage and access must be obeyed by healthcare professionals. The intense use of external IT service providers is critical because of the risks such as data theft, right of possession of medical data issues, integrity of medical data, legal issues of cloud storage and numerous other issues [29].

Experiences with the storage of DTCT genetic data show frequent and inacceptable breaches of data security [48, 49].

Long-term storage of DTCT data

A trigger for long-term storage of medical data can be medical reasons, legal reasons or just the feasibility of long-term storage. The main medical reasons will be the detection of certain medical conditions by comparison of test results obtained over longer time periods (such as the increase of PSA or other tumor makers) or the ability for a repeated evaluation of medical results in the knowledge that a disease manifested afterward or the evaluation of data which do not change during life (i.e. germ line genetic data).

Legal reasons to aggressively address data safety issues are the requirement for physicians to keep records of their treatment and also to demonstrate that a certain condition was not present at the time of treatment (such as renal insufficiency at the time of application of contrast material for CT scans) or low hemoglobin before transfusing red blood cells. All these medical and legal reasons will be of no relevance in DTCT: for example, long-term evaluation of tumor markers is only useful if the kind of test and the standardization is identical and if preanalytical and analytical variation (permissible uncertainty [50]) can be kept under certain limits. At the current point in time, the responsibility such as for data integrity of DTCT medical data and the ownership of these hybrid medical-consumer data are obscure and any physician relying on these data is in high liability risks not covered by his insurance. When cloud technologies are employed, even different – contradictory – national legislations might be referred to.

Recommendations

Our recommendation is to use a nuanced system for the inclusion of DTCT data in medical long-term data storage.

First, high-volume medical DTCT data such as those obtained from continuous glucose measurement should be transmitted without manual intervention (i.e. by cable or wireless) into a specific (proprietary) app only. This app must comply with the regulations of the in vitro diagnostic (IVD) directive. The particular challenges of ownership of the data (by patient, attending physician, health service provider or government), of data integrity as well as the obligation to keep backups of this medical data have to be regulated by local authorities according to the local law.

Second, data from DTCT devices which produce discrete, self-contained data (such as the capillary blood glucose tests or lactate or urine pregnancy results) can be stored in an electronic patient record only if clearly labeled as a DTCT test and may not to be used for healthcare decision-making without proper real laboratory tests (Figure 1). These data as well as data obtained by wearables have to be kept unequivocally separate from the testing data obtained in healthcare. We recommend using the preferred terminology for laboratory tests (such as LOINC) and also recommend displaying the z-log score together with the readout of the instrument including the units of measurement. Printouts of these stored data, however, must comply with the RiliBÄK requirements (Table 1).

Figure 1:

Classification of different laboratory tests.

Tests can be differentiated between classical tests and tests performed at a certain location (such as POCT) and tests can be differentiated whether being performed with an evidence-based background or not. Lab tests testing has to be performed exclusively by laboratory medicine specialists, as regulated by national law (e.g. in Germany “MTA-Gesetz” and “Heilpraktikergesetz”) [29]. POCT can be performed by other health professionals or even the patients themselves according to national laws. There are no regulations for DTCT and for commercial lab testing as the regulations cover healthcare only. DTCT data can be stored in a medical database only if clearly marked as DTCT and/or POCT data.

Third, for DTCT with no obvious medical use (“lifestyle testing”) as well as for genetic testing, we strongly recommend against storing the data in a data record which will not be used in healthcare. Customers might use apps from third-party vendors, keep electronic files on their mobile phones or PCs or can decide to keep paper printouts of these lifestyle data alone.

Conclusions

DTCT is still performed in a rather unregulated legal gray zone and is characterized by the absence of claims of medical usefulness for most tests performed. Despite being an in vitro method, there is a very high chance of substantial medical harm if data from DTCT are used for medical decision-making as well as of severe economic and psychological impacts on the users of DTCT (such as psychological harm, follow-up procedures) and on the society as a whole with a huge negative impact on medical commons. Data integrity issues in DTCT are far from being solved.

There are very high personal liability risks for healthcare professionals relying on DTCT data and any long-term storage must clearly separate DTCT data from real medical data.