There was some consensus that a consent framework should be more open, instead of very rigorous, again returning to the idea of making patient- generated data available for the 'greater good'. Participants agreed to keep the purpose of using patient-generated data localized in a few key areas, such as public health, care, quality, planning, and improvement. Data stored and backed up in a Canadian jurisdiction There was no consensus around this standard. While many participants believed that PGD should be stored and back up in a Canadian jurisdiction, just as many did not have any qualms about having data stored in other countries, such as the United States. As long as there are good privacy and security regulations in place, some participants felt it did not matter if the data was stored in another country.

Security measures in place and communicated clearly Participants were in agreement that organizations should make it clear what kind of process they undergo and have in place, including what security measures they use. If this information differs between their projects, organizations need to make that clear. Based on what these processes are, patients may change their consent.

Suggestions of standards to add: While attendees agreed overall with the standards that were presented at the workshop, there were also some themes discussed that did not fall in the categories listed above. Participants listed some additional standards that they believed should be added to the list:

- • data - There was a lot of discussion that was generated around de-identified data and • data - There was a lot of discussion that was generated around de-identified data and how that process would work. This included questions around what level data should be de- identified, and if all data is de-identified, does a consent form still need to be signed?
- • - patients and users should be able to reconcile incorrect data or data that doesn't • - patients and users should be able to reconcile incorrect data or data that doesn't reflect their experience
- • for incapacitated individuals - the consent process would have to be different for • for incapacitated individuals - the consent process would have to be different for individuals who cannot consent themselves, but participants were unsure about how to begin to address this topic.
- • hub and education - There needs to be an education component around these standards. • hub and education - There needs to be an education component around these standards. Patients need to clearly understand who has their data, how it is stored, the laws and regulations that govern PGD use, and proper transparency of how this is all done.
- • quality - Data must be complete and purposeful in order to be relevant to stakeholders and be • quality - Data must be complete and purposeful in order to be relevant to stakeholders and be used appropriately

##### Next Steps:

Our patient partners from PAN have reviewed and analyzed the discussions and materials from the patient-generated data workshops, as well as information generated from PAN discussions and PAN survey results. They have used the feedback they received from these sources to refine their principles for patient-generated data.