CONSENT

[Debra Turnbull]

NOTE - Matrix updated July 24, 2026

Hi all!

I am working on a project around Consent in healthcare. Consent in the commercial realm is out of scope.

Based on the above image, I have identified the main "buckets" of consent. My main question is: what's missing? What have I forgotten?

Thanks everyone.

You're not patient-centred unless you're consent centred (C. Johnston)

[Kim Locke]

@Debra-Turnbull Patient consent for their data to be used in a clinical trial or patient consent for their tissue/cells/blood to be used in clinical trials? I know that researchers will collect heart or brain tissue, but I'm not sure about what is collected from limbs to be put into a biobank? That would need consent too.

[Kim Locke]

@Kim-Locke Oh! Also usage of any of the patient data to be used to "train" AI or even used to analyze images or other patient data with AI.
ie. If you want to compare all my liver CT scans with AI for trending growth with adenomas, you have to ask me if it's ok to use the liver CT scans from x date to x date. If you want to fetch them from OTHER health systems, you're welcome to do that...just let me know first.

[Debra Turnbull]

@Kim-Locke

Hi Kim!

So, Clinical Trials follow exact processes and procedures. These rules are defined in TCPS2 (Tri-Council Policy Statement: Ethical Conduct for Research Involving Humans), found here:

• https://ethics.gc.ca/eng/policy-politique_tcps2-eptc2_2022.html

In a nutshell - it defines the rules of engagement of clinical trials / studies.

One such rule is that the trial subject (patient/volunteer) must be informed of all activities that directly impacts them - via informed consent. This information is contained in the Informed Consent Form (ICF); which the patient-participant signs; acknowledging their awareness of study activities. Study activities must be included in the ICF and may include:

• sample collection: tissues, biofluids

• responses to surveys, EEG, ECG, observations...

If samples are collected, the ICF stipulates where the samples are stored (biobank), analysed and where the analysis results are stored. All 3 locations - if not the same - must be listed individually; with their associated activity/role. There may be 2 locations listed for sample storage: prior and post analysis.

If samples are being shipped outside of Canada (or even to another province) this must be specified with an address in the ICF.

With regards to patient data to be included in the trial data set, this only happens after signing the ICF. lf something from your health record is being collected - this too must be clearly stated in ICF. Usually, a study doctor (principle Investigator or PI) will scan your health record to identify you as a potential candidate. Only if you meet their criteria - and you have consented to be approached for study - will they contact you to offer an initial meeting.

All to say: ICF and clinical trials are precise things and activities.

[Debra Turnbull]

@Kim-Locke
Yeah, training AI is a commercial activity by AI software vendors. Legally they are not permitted to access healthcare data from Canadian patients. Privacy laws block that.

Now, as for as what data went into the AI-CDSS or Radiology AI... my understanding was that was US data. You would need to do a deeper dive for those answers.

[Kim Locke]

@Debra-Turnbull This makes me feel less weird about patient consent in clinical trials or even other non-clinical trial studies. If only we could be so precise about AI usage and collection of data.

[Kim Locke]

@Debra-Turnbull Ahh, that's interesting about US data.

I hope that if there's any Canadian companies that want Canadian patient data to train their AIs with, that they would approach PAN first.

[Debra Turnbull]

@Kim-Locke
You have to remember - AI is a new "thing". Drug trials have been going on for a couple centuries (?) now. Formalizing the rules for human testing started as a result of the Nuremburg Trials.

[Debra Turnbull]

Attention Ontario Patients:

Ontario Health is granting access to your Electronic Health Record (EHR); which resides in the provincial Healthcare databases (repositories). Additionally, there are Consent Directives.

You can learn about the details here at:

• eHealth Ontario - https://ehealthontario.on.ca/en/privacy/managing-access-to-your-ehr, and

• Ontario Health - https://ontariohealth.ca/news/memo-changes-consent-management-electronic-health-record

Recording your Consent Directives looks like a manual process - there is a form. Unfortunately, access is granted to the specific datasets and not the clinician.

[Debra Turnbull]

@Kim-Locke
Thanks for the reminder - I did not communicate the AI aspect very well. So, I updated the matrix and reposted it above.

[Chris Johnston]

@Debra-Turnbull @Kim-Locke

I'm intrigued Deb - why is AI training out of scope?

Many smaller scale facility-based AI projects are using patient data for training and there's little or no discussion of how or if they're informing patients or seeking consent. While these projects start as facility-based, the longer term goal is often commercialization, and that can mean the physicians starting their own company or selling it to a larger AI corporation. So essentially the developers and the AI corps exploit and profit from patient data with no transparency, and no clear benefit to the patients whose data has been exploited.

Surely that's a consent issue worth discussing? My personal view is it should be very much in-scope for any discussion of consent in a healthcare setting.

[Lori Herod]

@Debra-Turnbull - This seems to be centred on medical healthcare and does not include other types (e.g., mental health, dental healthcare). It might be best to specify that you are referring to medical healthcare or better yet, make it so it can be also used by researchers in other areas of healthcare. Patient oriented research (POR) has become a major facet of research in all areas of healthcare and it's safe to assume AI will be used.

Lori Herod, EdD
Patient Partner Complex Trauma

[Debra Turnbull]

@Chris-Johnston @Kim-Locke @Lori-Herod
Consent for AI training, as far as I can see, does not exist.

I am seeing: 1. Consent for Healthcare and then 2. Consent for Commercial use. I'm not seeing any Consent for AI.

2. Consent for Commercial Use means that you give your permission to the gathering of your Personal Identifiers (PI) for setting up your account for services like electricity or telecom: phone, TV, internet, etc. Then there are your accounts with the city, province, country for: water, taxes, etc. And then – there's the financial sector – banks, bank loans, credit applications, credit cards... I don't even want to think about on-line banking (which I have been avoiding...)

Currently, I'm seeing a discussion around the idea of a “Digital Wallet” for every individual/person in this country. The idea is that this “Wallet” stores your Digital Identity (which contains your PI). The service companies (examples in the previous paragraph) would have access to this online resource, in order to link your Digital Identity with their account of you. The oversight body that would “keep” these Digital Identities would need to: provide security, verify linkage requests from (valid) commercial entities, establish and maintain those linkages, provide you with a list of all of your linkages, etc. Any entity with those kinds of resources would have to come from the national level; with the appropriate regulatory framework.

1. Consent for Healthcare Use is different, in that – if you show up at the door of a healthcare organization (doctor's office, clinic, hospital, etc.) - you are automatically consenting to the collection of your personal identifiers (PI) and your personal health information (PHI) – for the purpose of care. By going to the front desk and handing over your health card (PI), you grant consent to this PI data collection. When seeing the doctor, they will collect details of your health status: symptoms, observations... and enter those (PHI) into their EMR (or write on paper if they are old-school). Therefore, PI + PHI = health service.

Research
There are different types of research that satisfy different purposes. Commercial research, such as those conducted by drug discovery projects, is a for-profit endeavour that benefits the drug companies. Drug companies engage physicians (Principle Investigators) in healthcare delivery organizations to conduct projects - clinical trials – that follow TCPS2. The healthcare organization benefits from a contract fee. The hospital physicians that conduct the trials benefit by helping their patients and moving therapeutics discoveries forward.

Next, is the quality improvement (QI) research that happens within healthcare organizations. These are internally conducted to remove barriers, improve workflows and reduce harm – for patients and staff. These activities tend to be part of regular operations and are classified as “overhead”. (I'm not as familiar with these activities.) Do we have a QI person in the house to comment?

Finally, there is research in academia. The goal of the researcher is data collection for publication. The researcher is compensated with a salary from the academic organization to answer research questions (solve problems). Hopefully, the experiment, the data and conclusion get submitted, and accepted by a prominent science journal. Some researchers teach; some do not. The activities tend to be not-for-profit. The prestige of the pursuit of science is the goal.

Now, to your example: it falls into the last “research” category. I've seen examples coming out of academia where a researcher – affiliated with the hospital and the university and teaches - gets an idea for an AI project. They gathers PHI for the project (where is the consent? I have no idea), creates an algorithm off of that PHI, and releases it into the hospital for testing and oversight. Up to now, I don't know what patient consent process is being followed – other than the consent for care.

Then, they decide to start up a company in order to sell the algorithm as a product. For me – this crosses the red line and enters into the commercial realm. The PHI used to develop the product is not accounted for; nor traceable. After many years, the researcher gets fed up (with managing a company) and decides to sell the company; which includes all intellectual rights to said AI product. The buyer is from the US. An American entity now owns an AI product trained on Canadian data. Apparently, our data is highly prized.

In Summary
There is Consent for Healthcare and Consent for Commercial Use. Add to that, the variations of Consent needed for research - some are for commercial needs; while others are for internal processes. In terms of academic settings, I don't know if there are any concrete rules. Some may follow regulations and others may not. We don't know.

No wonder patients, clinicians and programmers are easily confused: two flavours of Consent; mixed with three categories of healthcare Research. We need to redefine and classify what we mean by “consent”.

Consent for AI training – I have yet to see an example of this.

//////////

Thanks for allowing me the opportunity to consolidate my thoughts, Chris.

[Debra Turnbull]

@Lori-Herod

I must admit - I do not know what consent for mental health would look like. Can you describe this please?

As far as dental - this is sort of a combination of commercial and health delivery... along with crossover into insurance.

Dental offices run as commercial entities - they do not follow TPA (transfer payment agreements) with the provincial governments. Their funds come from insurance dental plans - for those patients lucky enough to get it - and pay-out-of-pocket dollars from patients. Dentists are licensed by the province and have the affiliated provincial colleges to answer to. Here in Ontario we have: Royal College of Dental Sugeons of Ontario

All to say - each health service model will vary. And you are correct medical/physical health is a bit of an "odd duck" because of the way it is funded.