DIGITAL HEALTH PRIVACY AND AGE: QUALITY AND SAFETY IMPROVEMENT IN LONG-TERM-CARE RACHEL ZURAW* TARA SKLAR** TABLE OF CONTENTS INTRODUCTION. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 I. SENSOR TECHNOLOGY IN LONG-TERM CARE. . . . . . . . . . . . . . . . . . . . . . . . . 86 II. QUALITY IMPROVEMENT WITH CLIENT FEEDBACK MODEL. . . . . . . . . . . . . . 87 A. Gathering Data on Quality of Care. . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 B. Cost-Savings and Workforce Shortages.. . . . . . . . . . . . . . . . . . . . . . . . 91 III. PRIVACY AND DATA PROTECTION WITH DIGITAL HEALTH. . . . . . . . . . . . . . 93 IV. MEANINGFUL INFORMED CONSENT WITH COGNITIVE AGING. . . . . . . . . . . . 96 V. CONCLUSION. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 INTRODUCTION “With enormous governmental expenditures for community-based, long-term care taxpayers and their representatives will demand quality as the ever-growing number of consumers of these services.”1 Professor Eleanor Kinney pioneered an area of research in community-based, long-term care that is at a critical point today: the standardization of services to ensure quality and safety, along with individualization based on patient preferences. Kinney defines “community-based, long-term care” as health and personal care that supports daily living activities, is delivered over a sustained period to persons who have lost some capacity for self-care, and has the primary goal to prevent premature institutionalization.2 Delivering this basic and fundamental care in the private home and the local community is less costly than providing it in an institution; however, it still faces impediments such as workforce challenges, rising costs, and concerns with the increasing prevalence of elder abuse.3 As the population ages and the number of older Americans managing multiple chronic conditions grows, it is essential to develop additional * J.D., M.Be, Lecturer, University of California, Berkeley, School of Law. ** J.D., M.P.H., Professor of Health Law, University of Arizona James E. Rogers College of Law. 1. Eleanor D. Kinney et al., Quality Improvement in Community-Based, Long-Term Care: Theory and Reality, 20 AM. J.L. & MED. 59, 60 (1994) [hereinafter Kinney et al., Theory and Reality]. 2. Id. at 61, 69. Activities of Daily Living (ADLs) include eating, bathing, toileting, and dressing. 3. Tara Sklar & Rachel Zuraw, Preparing to Age in Place: The Role of Medicaid Waivers in Elder Abuse Prevention, 28 ANNALS HEALTH L. & LIFE SCI. 195, 196 (2019). 86 INDIANA HEALTH LAW REVIEW [Vol. 17:85 resources to provide sustainable community-based, long-term care. Sensor monitoring technologies provide a promising avenue for improving access to such care, with developers making major breakthroughs in the provision of long-term care at both senior residential facilities and directly in the home. We are seeing a growth in the use of sensors to reduce staffing, enable older adults to have a greater degree of self-management, and manage overall costs. The advantages of sensor monitoring technology are not, however, without their risks: the necessary trade-offs between innovation and privacy are heightened when applied to an older population where decreased cognitive function plays a larger role. While there is emerging scholarship on sensor privacy concerns in health care and for patient data sharing, there is limited literature that explores sensor privacy and consent practices for these devices by seniors in long-term care settings.4 This Article is dedicated to the forward-looking insights generated by Kinney’s research to improve quality and safety in community-based, long-term care and investigates how the use of sensor technology can be optimally integrated with privacy protections to support this goal. I. SENSOR TECHNOLOGY IN LONG-TERM CARE Sensor monitoring technologies have been steadily rising in popularity and are now touted as one of the great hopes to sustainably care for a growing aging population.5 The common types of sensors used in long-term care are ambient sensors that can be installed in the home and wearable sensors or ‘wearables’ that can be worn on the body or clothing. Both types of sensors provide continuous monitoring with ambient sensors geared more towards observing the environment (e.g., motion detection, object contact, sounds, pressure, temperature) and wearables measuring an individual’s health status, such as heart rate, respiration rate, and muscle movements. Estimates predict another surge in use over the next few years, which expects the market for wearables to double to a $27 billion market by 2022.6 Both ambient sensors and wearables are being used in a range of ways to support Activities of Daily Living (“ADLs”), detect falls, and health status monitoring. They are implemented in all kinds of devices, ranging from steady eating utensils to tools that facilitate medication adherence or provide warnings to caregivers if individuals wander from a safe area, and more.7 In particular, 4. Md. Zia Uddin, Weria Khaksar & Jim Torresen, Ambient Sensors for Elderly Care and Independent Living: A Survey, 18 SENSORS 2027, 2048 (2018). 5. Id. at 2028. 6. See Paul Lamkin, Smart Wearables Market to Double by 2022: $27 Billion Industry Forecast, FORBES (Oct. 23, 2018, 8:04 AM), https://www.forbes.com/sites/paullamkin/2018/ 10/23/smart-wearables-market-to-double-by-2022-27-billion-industry-forecast/#3583a50c2656 [https://perma.cc/CLL3-SGCX]. 7. There are numerous sensors available to detect and predict falls. Walabot is an example of an ambient sensor that is wall-mounted and can be used to detect falls, whereas WalkJoy is a wearable that claims to be able to reduce falls by stimulating nerve activity in the legs and feet. 2020] DIGITAL HEALTH PRIVACY AND AGE 87 wearables are rapidly increasing in their abilities to collect a growing range of physiological functions—such as brain activity, hydration levels, blood pressure, stress, and blood glucose, to name a few—which can be used to manage chronic conditions by tracking overall health and wellness.8 How do these sensors work? They collect raw data from their continuous monitoring and input it into the device’s algorithm, which is then uploaded via a Bluetooth or wireless connection to a server for further processing, including the use of machine learning to determine the current status of the user.9 Data may be collected in real-time, at scheduled intervals, or through proximity-based uploads.10 The collected data may be used for regular vital sign monitoring, alerting users and caregivers of risky situations, and signaling when medical attention may be needed. There is a developing awareness among sensor product developers and researchers that older adults may prefer ambient sensors over wearables due to physical discomfort with long-term skin attachment and weight from the devices.11 Additionally, some studies have observed that older adults with dementia may remove wearables from their bodies because they forgot their purpose or found them too invasive.12 In general, non-invasive sensors, whether ambient or wearable, should strive to be acceptable to older adults in order to avoid risk of rejection. Meanwhile, those operating long-term care facilities as well as senior living communities, are actively incorporating sensors to enable individuals with diminished physical or rational capacity to live independently for a longer period with less full-time supervision. This type of sensor technology may be the missing key for community-based, long-term care to realize its full potential in preventing premature placement in institutional care. And given that this technology is already largely in place and growing, our legal protections must catch up. II. QUALITY IMPROVEMENT WITH CLIENT FEEDBACK MODEL One critical consequence of the move to an aging in place or in-home care Carepredict uses temperature sensors to monitor ADLs and has an assistance button feature to alert caregivers with a two-way audio communication feature. These sensors enable seniors to largely care for themselves and have access to support when necessary. 8. See e.g., Caroline Saunders, Balancing Innovation and Regulation: Why the FDA should adopt a More Dynamic Risk-Based System for Wearables, 58 JURIMETRICS: J.L., SCI. & TECH. 83 (2017). 9. Uddin et al., supra note 4, at 2048. 10. See generally Christophe Mombers, Kathleen Legako & Annette Gilchrist, Identifying Medical Wearables and Sensor Technologies that Deliver Data on Clinical Endpoints, 81 BRIT. J. CLINICAL PHARMACOLOGY 196, 198 (2015), https://bpspubs.onlinelibrary.wiley.com/doi/pdf/ 10.1111/bcp.12818 [https://perma.cc/8N6B-QMGJ]. 11. Uddin et al., supra note 4, at 2033, 2047. 12. Id. at 2033. 88 INDIANA HEALTH LAW REVIEW [Vol. 17:85 model is that it comes with an inherent lack of standardization and transparency. In contrast, facilities that provide long-term care often participate in the Medicare program and therefore must comply with the Medicare Conditions of Participation which have an established federal standard for quality of care metrics, staffing, facilities, and services.13 Facilities’ oversight by the Centers for Medicare and Medicaid (CMS) and their state accreditation agencies are enforced through regular monitoring and reporting.14 Individuals receiving care in their communities and homes do not receive the same level of CMS oversight and, as a result, are much less likely to be monitored on a regular basis.15 An exception is, effective 2004, all Medicare-certified home health agencies are required to participate in quality improvement work by reporting data to the Outcome and Assessment Information Set (OASIS): the shared data set for Medicare beneficiaries employing a home health service.16 This is in part accomplished through 34-question surveys that evaluate care based on the six factors taken from the National Academy of Medicine to define quality: effectiveness, efficiency, equity, patient centeredness, safety, and timeliness.17 The reporting on these factors is based on outcome measures (defined as an assessment of “the results of health care that are experienced by patients”) and process measures (defined as “the rate of home health agency use of specific evidence-based processes of care”).18 Survey data, though, is a far cry from the formal monitoring and reporting that long-term care facilities are required to undergo. Home and community-based care therefore presents a unique combination of challenges, as Kinney recognized: while it is necessary to establish and maintain 13. 42 C.F.R. § 483.1 (2019). 14. 42 C.F.R. § 483.75 (2019). 15. Medicaid Home and Community-Based Services (HCBS) waivers support the majority of state aging in place programs and are highly variable with different requirements for caregiver background checks, competencies, and frequency as well as method for oversight visits. Some states do not require any site visits by the state case manager and consider periodic phone calls to Medicaid recipients as sufficient for adequate oversight. See generally Sklar & Zuraw, supra note 3. See also Sidney D. Watson, From Almshouses to Nursing Homes and Community Care: Lessons from Medicaid’s History, 26 GA. ST. U.L. REV., 937, 963-64 (2010) (describing states’ flexibility in how they tailor waivers and their covered services). 16. Vincent Mor, Improving the Quality of Long-Term Care with Better Information, 83 MILBANK Q. 333, 336-37 (2005); Home Health Quality Reporting Program, CTRS. FOR MEDICAID & MEDICARE SERV. (Last Modified June 5, 2019), https://www.cms.gov/Medicare/Quality- In it iat ives-Patien t-Assessment-Instruments/HomeHealthQualityIn its/ index.h tml [https://perma.cc/YB92-D6YH]. 17. Home Health Quality Reporting Program, CTRS. FOR MEDICAID & MEDICARE SERV. (June 5, 2019, 9:53 PM), https://www.cms.gov/Medicare/Quality-Initiatives-Patient-Assessment- Instruments/HomeHealthQualityInits/index.html [https://perma.cc/7RU3-PHSL]. 18. Home Health Quality Measures, CTRS. FOR MEDICAID & MEDICARE SERV. (May 30, 2019), h t tps:/ /www.cms.gov/Medicare/Quality-In it iat ives-Patien t-Assessment- Instruments/HomeHealthQualityInits/Home-Health-Quality-Measures.html [https://perma.cc/43JB- S2G2]. 2020] DIGITAL HEALTH PRIVACY AND AGE 89 a standard of care to ensure quality and safety and that individuals are not neglected, the care provided is inherently individualized. Older adults frequently prefer to stay in their own homes precisely because they desire independence and freedom of choice over their personal care.19 There are two major issues at hand with delivered standardized, individual care: (1) what is meant by “quality of care” and (2) how that quality can be maintained or improved. A. Gathering Data on Quality of Care In looking at the first issue, we second Kinney’s emphasis that home-based and community-based care services are focused on maintaining ADLs.20 Assistance with ADLs is largely attendant care, rather than medical care, so does not require qualified medical professionals to perform.21 Kinney specifically noted that a focus on outcome-based analysis to determine the quality of care is fundamentally flawed in the long-term care context: no matter how excellent the program, the recipient’s condition will inevitably decline due to age.22 The true measure of the quality of long-term care, Kinney describes, is whether and how it relieves the burden of suffering and activities of daily living.23 The personal nature of the care provided makes the satisfaction of the recipient a critical metric in determining “quality” of assistance with ADLs. Kinney and her coauthors evaluated two different models for garnering quality of care data that could be used to fuel improvements: the client feedback model and the normative treatment planning model.24 The former requires a continuous flow of information from recipients of long-term care to receive an evaluation by a monitoring team who attempts to preserve individualized care and share the information back to the recipient.25 The latter calls for increased work standardization at the outset, with care plans addressing most needs and the 19. See generally Nat’l Acad. of Sci., Eng’g, & Med, Artificial Intelligence Applications for Older Adults and People with Disabilities: Balancing Safety and Autonomy: Proceedings of a Workshop in Brief, NAT’L ACAD . PRESS ., (May, 2019), http://nap.edu/25427 [https://perma.cc/YN8S-ETBA]; Michael K. McChrystal, The Privacy of Elders, 2 MARQUETTE ELDER’S ADVISOR 22 (2012). 20. Kinney et al., Theory and Reality, supra note 1, at 61. 21. Bridget Haeg, The Future of Caring for Elders in Their Homes: An Alternative to Nursing Homes, 9 NAELA J. 237, 252 (2013) (“[B]ecause personal care is not medical care in the traditional sense, it is inappropriate to apply the medical definition of quality to these services”); Home- and Community-Based Services, CTRS. FOR MEDICAID & MEDICARE SERV. (Dec. 5, 2017) https://www.cms.gov/Outreach-and-Education/American-Indian-Alaska-Native/AIAN/LTSS-TA- Center/info/hcbs.html [https://perma.cc/P6WU-K5ST]. 22. Kinney et al., Theory and Reality, supra note 1, at 66-67. 23. Id. at 69; see also Rosalie A. Kane & Robert L. Kane, Long-Term Care: Variations on a Quality Assurance Theme, 25 INQUIRY 132, 132-34 (1988). 24. Kinney et al., Theory and Reality, supra note 1, at 63-73. 25. Id. at 71-73. 90 INDIANA HEALTH LAW REVIEW [Vol. 17:85 providers evaluating the outcomes with each client.26 These models represent an essential tension between the focus of quality in home-based care and whether it will be measured based on the recipient experience or predictive, quantitative metrics. At the time of Kinney’s initial research more than twenty-five years ago, she concluded that “one drawback of the [continuous feedback model] is that feedback cannot be provided on a continual basis as long-term care clients are not really in a position to provide continuous feedback.”27 At the time, such feedback would have required care recipients—many of whom have reduced capacity—to fill out forms or complete interviews after receiving care, which is unrealistic on an ongoing basis. This is doubtless a major reason for the adoption of the ongoing normative and quantitative model by CMS, as represented by the OASIS system.28 Even though CMS continues to rely on the OASIS and recipient survey data, change is on the horizon with sensor technology advances. Continuous feedback is now possible in the delivery of long-term care.29 Care recipients’ health status and behavior can be observed effectively and affordably through sensor monitoring technologies, which could bring Kinney’s continuous feedback model to fruition. These technologies have the ability to collect millions of potential data points on a person, ranging from their physical movements to brain activity and hydration levels, that may link overall health outcomes with the appropriate level of care. The promise of these tools to prolong independent living in the home and community is clear, but the depth and detail of personal health data generated by this technology, even to a care team, inherently creates privacy concerns. What is quality in the context of community-based, long-term care? While the six factors used by CMS are laudable, we propose a critical, seventh factor: compliance with the recipient’s goals for their own care. Most recipients of long- term care are fully rational individuals capable of setting their own goals for care and defining their own quality of life. OASIS surveys make an attempt to incorporate the satisfaction of care recipients through the category of “patient willingness to recommend [the home health agency] to family and friends,” but this does not go far enough.30 We, therefore, find the advantages of the client feedback model to be the most compelling in this context. As noted by Kinney and her coauthors, it presents the following advantages: it is from the recipient’s perspective (remember, this is provision of care rather than treatment of a disease); it allows for evaluation of the trustworthiness of caregivers; and the iterative nature enables continuous improvement, rather than updates to 26. Id. at 71, 74. 27. See id. at 73. 28. Vincent Mor, Improving the Quality of Long-Term Care with Better Information, 83 THE MILBANK QUARTERLY 333, 336-37 (2005); Home Health Quality Reporting Program, supra note 17. 29. Supra Section I. 30. Home Health Quality Measures, supra note 18. 2020] DIGITAL HEALTH PRIVACY AND AGE 91 generalized plans.31 While Kinney had to caveat these advantages in 1994 by pointing out that collection of personal data was impeded by the lack of resources on the part of most care providers to continually interview clients and the clients’ own memory problems,32 we can now collect real-time data and impressions via sensors to address those concerns. Another avenue explored by Professor Kinney in her later work is comparative effectiveness research.33 Her research primarily looked at the establishment of the Patient-Centered Outcomes Research Institute (the “Institute”) through Title XI of the Social Security Act and Title IX of the Public Health Service Act.34 The purpose of the Institute includes a statutory duty to conduct and support research and evaluations of patient care, including long-term care.35 The Institute currently supports multiple projects relevant to long-term care and aging in place, including thirty-six comparative clinical effectiveness research studies focused on older adults’ health and thirteen studies focused on dementia and cognitive impairment.36 B. Cost-Savings and Workforce Shortages Aside from the fundamental difficulties of determining and improving upon the quality of care, in the home-based context, there are serious shortages of both money and staff to maintain the necessary level of care. Medicaid is the primary payor of home-based care services in the United States.37 Cost-containment is necessary to sustain the budget-constrained Medicaid program to serve the older generations now and in the years ahead and enable states to effectively serve their eligible populations. This provides yet another argument in favor of incorporating sensor technology to make home health care accessible to more individuals. The utilization of sensor monitoring technology to incorporate feedback for individual preferences and satisfaction levels over time has the potential to greatly reduce redundant and unnecessary care, thereby containing costs. This type of feedback model aligns with the concept of continuous quality 31. Kinney et al., Theory and Reality, supra note 1, at 73-74. 32. Id. 33. See generally Eleanor D. Kinney, Comparative Effectiveness Research Under the Patient Protection and Affordable Care Act: Can New Bottles Accommodate Old Wine?, 37 AM. J.L. & MED. 522 (2011). 34. Id. at 544-66. 35. 42 U.S.C. §1320e(b) (2019). 36. See Dementia and Cognitive Impairment, PATIENT-CENTERED OUTCOMES RES. INST., https://www.pcori.org/topics/dementia-and-cognitive-impairment [https://perma.cc/8KYH-K29W]; Older Adults’ Health, PATIENT-CENTERED OUTCOMES RES. INST., https://www.pcori.org/topics/ older-adults-health [https://perma.cc/N9KS-B4BV]. 37. Sklar & Zuraw, supra note 3, at 196. See also KIRSTEN J. COLELLO, CONG. RESEARCH SERV., IF 10343, Who Pays for Long-Term Services and Supports? (2018), https://fas.org/sgp/ crs/misc/IF10343.pdf [https://perma.cc/P2FR-PEXK] (“Medicaid is the largest single payer of LTSS in the United States.”). 92 INDIANA HEALTH LAW REVIEW [Vol. 17:85 improvement—systematically measuring and iteratively improving recipient satisfaction—as quality improvement is defined and measured from the recipient perspective.38 The collection of dense physiological data may identify early safety issues in regards to overall health and managing chronic conditions.39 Older adults can regularly add their voice to the data collected, and help identify potential areas of concern with their health status or difficulties. Workforce shortages in the long-term care are not a new phenomenon, but there are signs of improvement.40 While we have not yet reached the inflection point at which adoption of sensors and other technology can substitute for staff coverage, many experts anticipate significant cost savings once we reach that point.41 At the present time many long-term care patients, whether in facilities or in their own homes, require regular, in-person check-ins to monitor their health. Once it is possible to reliably monitor vital statistics and comfort via sensors, a smaller staff of caregivers will be able to provide care to far more individuals. We are seeing the beginnings of this trend with in-home caregiving services managed via smartphone applications and anticipate that it will only grow.42 38. See, e.g., Kinney et al., Theory and Reality, supra note 1. 39. See Home Health Quality Measures, supra note 18. See also Office of Disease Prevention and Health Promotion, Older Adults, HEALTHY PEOPLE, https://www.healthypeople.gov/2020/ topics-objectives/topic/older-adults [https://perma.cc/2CUR-6CW5]. 40. See generally INSTITUTE FOR THE FUTURE OF AGING SERVICES, THE LONG-TERM CARE WORKFORCE: CAN THE CRISIS BE FIXED? (Jan. 2007), https://www.leadingage.org/sites/ default/files/LTC_Workforce_Commission_Report.pdf [https://perma.cc/J9QC-U5N6]; see also Eduardo Porter, Home Health Care: Shouldn’t It Be Work Worth Doing?, N.Y. TIMES (Aug. 29, 2017), https://www.nytimes.com/2017/08/29/business/economy/home-health-care-work.html [https://perma.cc/UV7Y-F4J8]; Yvonne Rickert, How To Plan Ahead for Labor Shortages in Senior Living, LIFE CARE SERVICES (Jan. 11, 2017), https://www.senior-living-management.com/how-to- plan-ahead-for-labor-shortages-in-senior-living/ [https://perma.cc/B3EZ-FXG7]; Alex Kacik, Nursing Home Staffing Levels Often Fall Below CMS Expectations, MODERN HEALTHCARE (July 1, 2019), https://www.modernhealthcare.com/providers/nursing-home-staffing-levels-often-fall- below-cms-expectations [https://perma.cc/YWN2-YA9M]. 41. See, e.g., Sunghee H. Tak et al., Technology for Long-Term Care, 3 RES. GERONTOLOGICAL NURSING 61 (2010); See also Conner Girdley, Making Long-Term Care Intelligent: AI Provides Cost-Saving Solutions That Improve the Quality of Care, LANCASTER POLLARD (Mar. 13, 2018), https://www.lancasterpollard.com/the-capital-issue/making-long-term- care-intelligent-ai-provides-cost-saving-solutions-that-improve-the-quality-of-care/ [https://perma.cc/AB9Q-GBHV]; Cf. Patricia Sheehan, Technology Takes Off in Long-Term Care, IADVANCE SENIOR CARE (July 15, 2011), https://www.iadvanceseniorcare.com/technology-takes- off-in-long-term-care/ [https://perma.cc/5647-75U9]. 42. Home health care startups such as Honor, which connects consumers with caregivers through apps, have secured impressive venture capital backing in recent years—though they have also faced significant regulatory hurdles. See Amy Baxter, Honor Raises $50 Million to Target Hundreds of New Partners, Home Health Care News (May 22, 2018), https://homehealthcarenews. com / 2 0 1 8 / 0 5 / h o n o r - r a i s e s -5 0 -mil l ion -to-t a rge t -h u n dreds -of -n ew -par tn er s / [https://perma.cc/QWC3-W8ZN]; Jonah Comstock, Senior Care Startup HomeHero is Pivoting 2020] DIGITAL HEALTH PRIVACY AND AGE 93 III. PRIVACY AND DATA PROTECTION WITH DIGITAL HEALTH In exploring the advantages of incorporating monitoring technology into long-term care, we must also acknowledge the risks regarding personal health data that is continuously collected, stored indefinitely, and shared with minimal safeguards in place. Irrespective of a beneficial purpose, we must consider how this data may be protected. The current debate among privacy laws in the United States and abroad governing personal data protection is increasingly relevant for digital health.43 Advocates believe this type of technology will reduce inefficiencies, increase quality, and make health care more responsive to individual preferences. Detractors believe that it will leave vulnerable individuals open to profiling for predatory marketing and hacking. Lawmakers in the European Union and California have created the current marquee laws for protecting personal data with the passage of the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA), both of which call for greater transparency and stronger individual rights over personal data. The GDPR and CCPA are at the forefront of privacy legislation with their efforts to overhaul the status quo and provide principles for how data collection and processing should occur. The GDPR was passed by the EU in 2016 and went in effect in May 2018 across 31 countries, with implications for any entity that processes data from an EU resident.44 There are seven key principles laid out in the GDPR for processing of personal data: “[L]awfulness, fairness and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality (security); [and] accountability.”45 The underlying ideals of the GDPR that have gained the most traction in recent United States lawmaking can be summarized as follows: (1) A person’s data may only be collected for a specific purpose; (2) The person must be informed of and consent After Regulatory Hurdles, MOBILE HEALTH NEWS (Feb. 28, 2017), https://www.mobihealthnews. com /con ten t / sen ior -ca re -s t a r tu p-h omehero-pivotin g-a f t e r -regu la to ry-h u rd les [https://perma.cc/U6WJ-YCE4]. 43. Digital health is defined as technologies that provide data collected by health sensors, devices, and other tools which consumers, their caregivers as well as health care providers can use to better manage health outcomes and wellness related activities. See generally FOOD AND DRUG ADMIN., DIGITAL HEALTH INNOVATION ACTION PLAN (2017), https://www.fda.gov/media/106331/ download [https://perma.cc/C3EQ-AK5J]. 44. There are 28 EU member states and 31 states that are part of the European Economic Area. There are additional countries that the EU Commission recognizes as providing an adequate level of data under its “adequacy” status in Art. 45 of the GDPR. See Adequacy Decisions: How the EU Determines if a non-EU Country has an Adequate Level of Data Protection, EUROPEAN COMMISSION, https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside- eu/adequacy-protection-personal-data-non-eu-countries_en [https://perma.cc/DJ3P-5AEC]. 45. INFO. COMM’N OFF., Guide to the General Data Protection Regulation, in GUIDE TO DATA PROTECTION, https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the- general-data-protection-regulation-gdpr/ [https://perma.cc/44QW-C6N6]. 94 INDIANA HEALTH LAW REVIEW [Vol. 17:85 to the purpose for which their data is collected; (3) Only as much data as is necessary to achieve that purpose should be collected; (4) The collected data must be deleted at the request of the person from whom it was collected, or when it is no longer needed for the purpose for which it was collected.46 The CCPA was signed by Governor Brown on June 28, 2018 and went into effect on January 1, 2020. Although not as extensive in scope as the GDPR, it is arguably the strongest U.S. consumer privacy law to date and also an outcome of the GDPR’s influence. The CCPA provides a legal framework to protect personal data, though solely for California residents. It limits its applicability to cover only large entities with $25 million or more in gross revenues, processing data of 50,000 consumers, and 50% of revenue from data sales.47 CCPA also provides consumers with the right to know where data is collected and to whom it is sold, as well as the right to disclosure. A major divergence between the GDPR and CCPA and point of contention among state privacy laws is whether to have opt-in or opt-out consent. This controversy impacts the informed consent processes that long-term care operators may choose to adopt. The GDPR requires opt-in consent, which means individuals must provide consent to have their data be processed (collected and used). The CCPA, by contrast, uses an opt-out approach, which enables consumers to, at any time, opt-out from having their personal data sold.48 Critics of the GDPR claim the opt-in approach stymies innovation as it would be more costly to implement and lead to delays; they also question whether an opt-in approach protects individuals’ privacy.49 Advocates for the opt-in approach believe it is not possible to meaningfully opt-out as individuals are largely unaware of the amount of personal information about them that is being collected and assert that opt-out consent can be exploitative and erode trust.50 While GDPR and CCPA are currently at the forefront, as the popularity of digital health increases so do the efforts by federal and state governments to propose legislation allowing health technologies to flourish without (theoretically) compromising privacy. For example, there is presently a bi- partisan bill in the Senate—Senate Bill 1842, the Protecting Personal Health Data Act—which specifically addresses data collected from health tracking devices and applications.51 This bill has implications for those that provide long-term care 46. See id. 47. See CAL. CIV. CODE § 1798.140(c) (West 2019) (effective Jan. 1, 2020). 48. CAL. CIV. CODE § 1798.120(a) (West 2019) (effective Jan. 1, 2020). 49. See Law.com, Privacy Notices, Opt-In Clauses Debated as US Regulators Shape Federal Privacy Law, YAHOO! FINANCE (Mar. 12, 2019), https://finance.yahoo.com/news/privacy-notices- opt-clauses-debated-041541572.html [https://perma.cc/AB5K-TM4M]. 50. See id. See also Antonio Garcia Martinez, Why California’s Privacy Law Won’t Hurt Facebook or Google, WIRED (Aug. 31, 2018), https://www.wired.com/story/why-californias- privacy-law-wont-hurt-facebook-or-google/ [https://perma.cc/A5UC-5NG4]. 51. See Protecting Personal Health Data Act, S. 1842, 116th Cong. (2019) (The bill was introduced in response to a 2016 report issued by the Department of Health and Human Services entitled “Examining Oversight of the Privacy & Security of Health Data Collected by Entities Not 2020] DIGITAL HEALTH PRIVACY AND AGE 95 and are looking to adapt business models to further rely on sensors in the monitoring of wellness and delivery of care. The bill directs the Department of Health and Human Services (DHHS) to create regulations that strengthen privacy for data collected by consumer devices. This would include establishing standards for consent for the handling of personal health and other data and improving the ability of individuals to navigate their health privacy options, including by amending or deleting copies of their personal health data. If Senate Bill 1842 or a comparable version passes, long-term care providers may be held to similar expectations as business currently operating under the GDPR: they would need to have transparent policies around what data they are collecting and for what purpose, as well as create mechanisms to allow individuals to manage their personal data as requested. Individual states are also proposing to regulate digital health, with California at the forefront. California state representatives have drafted the “Information Privacy: Digital Health Feedback Systems” bill, which would expand their current health privacy law to include any information in possession of or derived from a digital health feedback system, which is broadly defined to include sensors, devices, and internet platforms.52 The evolving digital health data protection regulations could benefit from incorporating strategies that align with Kinney’s continuous feedback model, described above, which requires a continuous flow of information from recipients of long-term care to be evaluated by a monitoring team that would strive to preserve individualized care and loop back to the recipients.53 Emerging regulations around digital health could treat long-term clients as part of a circular process in the collection, analysis, and protection of personal data. Preliminary studies have examined privacy concerns among older users of mobile sensor technologies.54 Concerns regarding trust and control predominated; seniors emphasized the importance of knowing what kinds of personal data are being collected, for what purpose, and over what time period, and expressed a desire to limit use for commercial purposes. They also emphasized concerns regarding security, including protection against breaches and disclosure should a breach occur. Potential issues also arose regarding the accuracy of data and the ability to amend, if needed, for protection against potential discrimination in obtaining equitable insurance (health, life). These concerns are all highly relevant to the current privacy debate across the country and abroad. There are noted sensitivities among older adults regarding the continuous use of sensor monitoring technologies. Survey respondents expressed apprehension regarding how invasive they might be, even if they offer the ability to live independently over a longer period. The consent process may be a way to engage Regulated by HIPAA”). 52. See A.B. 384, Reg. Ses. 2019–2020 (Cal. 2019). 53. See Kinney et al., Theory and Reality, supra note 1, at 71-73. 54. See e.g., Sofia Siggelin, Seniors Privacy Concerns in Health Technology Wearables: Regulations vs. User Concerns, (2017) (unpublished B.A. thesis, Luleå University of Technology) http://www.diva-portal.org/smash/get/diva2:1104482/FULLTEXT03 [https://perma.cc/XX4L- CSZK]. 96 INDIANA HEALTH LAW REVIEW [Vol. 17:85 older adults by being responsive to their concerns regarding trust and control of their personal data and encourage higher levels of voluntary participation. A clear consent process, whether it is opt-in or opt-out, combined with Kinney’s continuous feedback model may offer a unique approach in which older adults could experience an increased level of comfort with the collection and use of their personal data because they are part of the quality improvement cycle. IV. MEANINGFUL INFORMED CONSENT WITH COGNITIVE AGING Data collection and consent has been the focus of outpourings of scholarship in recent years, as well as ongoing research and advocacy projects.55 To date, however, there has been a serious dearth of scholarship surrounding meaningful consent by older adults in the digital health privacy context. This underexamined area is particularly important now that sensor technology is making its way into homes and long-term care facilities.56 There are unique privacy interests for older adults that can and should be addressed separately from those of other groups of adults due to the complications of cognitive aging. Normal aging has been widely observed to come with cognitive changes, even where dementia or cognitive impairment are not present.57 Of particular note are findings that past aged 70, an individuals’ ability to maintain mental flexibility diminishes and they are less able to engage with new or abstract concepts.58 These are precisely the areas of cognition that are taxed by determining whether to consent to data collection, given the need to imagine possible future uses (both positive and negative) of one’s personal data. One of the most compelling proposals for ameliorating consenting problems is the use of dynamic consent procedures. Dynamic consent requires personalized consent paired with a communication platform intended to facilitate an ongoing communication as part of the evolving consent process.59 This has become increasingly popular in recruiting biobanking participants due to its ability to improve inclusivity through tailored engagement.60 Neither the GDPR nor the 55. See generally, e.g. Chris Jay Hoofnagle, Assessing the Federal Trade Commission’s Privacy Assessments, 14 IEEE SEC’Y & PRIVACY 58 (Mar. 2016) (for a small, though prominent sample); Paul Schwartz, Legal Access to Global Cloud Data, 118 COLUMBIA L. REV. 1681 (2018); Technology and Civil Liberties, ACLU NORTHERN CALIFORNIA, https://www.aclunc.org/issue/ technology-and-civil-liberties [https://perma.cc/7HA2-A4Z7]. 56. See supra Section I. 57. See, e.g., Caroline N. Harada, Marissa C. Natelson Love & Kristen Triebel, Normal Cognitive Aging, 29 CLIN. GERIATRIC MED. 737, 738 (2013). 58. Id. at 741. 59. Isabelle Budin-Ljosne et al., Dynamic Consent: A potential solution to some of the challenges of modern biomedical research, 18 BMC MED. ETHICS Art. 4 (2017), h t tps:/ /bmcmedeth ics.biomedcen t r a l . com/ar t ic les/10 .1186/s12910-016-0162-9 [https://perma.cc/ASS7-6ZTK]; Mary A. Majumder, et al., The Role of Participants in a Medical Information Commons, 47 J.L. Med. & Ethics 51, 53 (2019). 60. See, e.g., Megan Prictor, Harriet J.A. Teare & Jane Kaye, Equitable Participation in 2020] DIGITAL HEALTH PRIVACY AND AGE 97 CCPA currently requires the use of dynamic consent, but it could provide needed clarity as well as support for research and innovation goals. Dynamic consent procedures would dovetail well with the incorporation of sensor technology into senior care, and it would be a seemingly small step to incorporate ongoing communication to facilitate consent. Sensor technology is able to incorporate a two-way, ongoing communication that could potentially assist with both health status monitoring and simultaneous check-ins regarding the individual’s comfort with the usage of their data. Privacy laws do not, unfortunately, currently account for a decline in cognitive functioning as people age. Notably, both the GDPR and the CCPA have a special carve-out for children under 16 years of age preventing their data from being collected without their affirmative consent (or, if under 13, the affirmative consent of their parent or guardian). While it has long been acknowledged that minors have different privacy interests than adults, adults with diminished rational capacity—e.g., seniors suffering from dementia or Alzheimer’s disease—are in a different, yet unrecognized, category when it comes to the use of sensor technology for continuous monitoring. Children have not yet reached full decision-making capacity, whereas some older adults may no longer have the same decision-making capacity that they once held. Despite the parallels, older adults with diminished cognition should not be placed in the role of children under these privacy regimes. Demonstration of respect for the personhood of older adults requires that their needs and preferences, as individuals with extensive decision-making histories, be taken thoroughly into account. This may be done through intervention of informed guardians, the dynamic consent procedures detailed above, or some other means—but regardless, it is an important area of future study if we are to employ these technologies to improve long-term care. V. CONCLUSION This Article expands on issues identified in Kinney’s scholarship to shed light on the delicate balance of equities between privacy and access to care raised by the incorporation of sensors to monitor the care, health, and daily activities of older adults. While we have used this space to explore prevalent legal and ethical considerations around the increasing use of sensor monitoring technologies to support quality and safety improvements in community-based, long-term care, our primary intent is to flag critical questions for future study. The continuous feedback model proposed by Professor Kinney and her coauthors twenty-five years ago can provide a blueprint for how to provide care that is truly responsive to the needs and desires of older adults. But before diving headlong into that future, it is imperative for both scholars and technology Biobanks: The Risks and Benefits of a “Dynamic Consent” Approach, 6 FRONT PUB. HEALTH 253 (2018). 98 INDIANA HEALTH LAW REVIEW [Vol. 17:85 developers to consider how we are regarding and preserving the privacy interests of older adults. It is important to act sooner rather than later in this uncertain environment to establish clear processes around meaningful informed consent, data collection, and utilization as digital health continues to evolve and become a reality for community-based, long-term care.