Physical factors that influence patients' privacy perception toward a psychiatric behavioral monitoring system: a qualitative study.

BACKGROUND: Psychiatric patients have privacy concerns when it comes to technology intervention in the hospital setting. In this paper, we present scenarios for psychiatric behavioral monitoring systems to be placed in psychiatric wards to understand patients' perception regarding privacy. Psychiatric behavioral monitoring refers to systems that are deemed useful in measuring clinical outcomes, but little research has been done on how these systems will impact patients' privacy.
METHODS: We conducted a case study in one teaching hospital in Malaysia. We investigated the physical factors that influence patients' perceived privacy with respect to a psychiatric monitoring system. The eight physical factors identified from the information system development privacy model, a comprehensive model for designing a privacy-sensitive information system, were adapted in this research. Scenario-based interviews were conducted with 25 patients in a psychiatric ward for 3 months.
RESULTS: Psychiatric patients were able to share how physical factors influence their perception of privacy. Results show how patients responded to each of these dimensions in the context of a psychiatric behavioral monitoring system.
CONCLUSION: Some subfactors under physical privacy are modified to reflect the data obtained in the interviews. We were able to capture the different physical factors that influence patient privacy.

Introduction

Privacy issues are a major concern among health care providers and patients, since a privacy breach can lead to undesirable outcomes. When it comes to technology and privacy, patients might not be aware that their private information is shared with other parties and may be vulnerable to threats. When implementing a behavioral monitoring system in a psychiatric ward, many privacy issues can arise as patients’ behavior is constantly monitored and recorded.

Westin1 defines privacy as “the claim of individuals, groups or institutions to determine for themselves when, how and to what extent information about them is communicated to others”. Altman2 defines privacy as “selective control of access to the self or to one’s group”. He postulated that a person’s relations with others might influence his or her privacy preferences. This study is based on Altman’s authoritative work on privacy.2 His research on privacy suggested to us the idea that patients might alter their privacy preferences based on their illness status, and they might choose who they want to share their health information with. Patients have their own definitions of “openness” and “closedness”, which may vary according to the individual.

In Malaysia, citizens have expressed the need for privacy in their daily activities, including the use of medical data. New legislation was recently passed by the Malaysian Ministry of Energy, Communications and Multimedia. The Personal Data Protection (PDP) bill was first conceived in 1998, amended over several years, and released officially in 2010. The purpose of the PDP 2010 is to regulate the collection, possession, processing, and use of personal data by any person or organization, in order to protect an individual’s personal information. The PDP protects any data that can identify an individual, including personal information such as name, address, age, MyKad (compulsory Malaysian personal identity document), photo, passport number, and video or other images captured via closed circuit television (CCTV).3 However, the PDP only applies to commercial entities such as companies, religious bodies, political parties, and charitable organizations; it does not include any information collected by the federal or state governments.4 Therefore, personal data are still open to possible harmful misuse.

Related work

Psychiatric behavioral monitoring systems

Tentori and Favela5 explored how monitoring behavioral patterns allowed a medical team to closely track patient activities and respond to alerts when problems were detected. Such a system would be useful for a nursing team as a means of regularly monitoring a patient’s condition. The system proposed by Tentori and Favela5 consisted of a band or bracelet worn by patients to monitor patients’ daily activities. In psychiatric wards, monitoring is done by tracking patients’ vital signs and behaviors. Rademeyer et al6 tracked psychiatric patients’ vital signs, oxygen saturation, and electrocardiograms using a wearable device that transmitted data to health care providers using a Bluetooth connection. Psychiatric patients need continuous monitoring because they may be at risk of death or injury when sedated or secluded. For restless and aggressive patients, a monitoring system can track their behavior continuously. Varshney7 also proposed behavioral monitoring systems for patients with dementia and delirium. Avancha et al8 also provided different scenarios on how mobile technology can monitor patients’ vital signs and contextual information such as locations when patients are receiving home monitoring services. In this paper, the privacy aspects and how a privacy framework can help ensure privacy protection are discussed.

Privacy and health information systems

Developers have few guidelines when designing applications that are effective in helping users manage their privacy preferences.9 Many vendors are developing new health care applications, but the privacy aspect is often ignored. In a recent work, Fernández-Alemán et al10 also performed a systematic review to analyze the security and privacy issues in electronic health record. Privacy is one of the main factors that contribute to slow adoption of, or resistance to, new technology. It is imperative that developers are provided with privacy-sensitive application guidelines, so that the systems they create will allow patients to manage their privacy preferences, resulting in better health care outcomes.

From our analysis of selected research papers, we have compiled a range of security and privacy issues raised by ubiquitous computing in general and by pervasive health care monitoring systems in particular. These issues focus on the human factor, including privacy concerns and needs.8,11–13 In 2015, patient and public views of electronic health record indicated that patients and public were worried about the security risks in such system and there is a need to create a trustworthy security and privacy framework to enable data to be exchanged across organizations.13 Overall, there has been little or no discussion of how patients can address their privacy concerns (eg, by managing privacy preferences) in currently available health information systems. The objective of the study is to identify patients’ perception on physical privacy dimensions proposed by Carew and Stapleton.14,15

Information system development (ISD) privacy framework

Carew and Stapleton14,15 proposed a comprehensive framework for ISD (Figure 1) that incorporates types, functions, and contributing factors of privacy. It is a comprehensive model intended to ensure that designers include privacy issues during design and development. Ramli and Zakaria16 have discussed how this ISD framework can be applied in a psychiatric context. There are four types of privacy based on Carew and Stapleton:14,15 physical, informational, social, and psychological. Each type has one or more dimensions. For this paper, we will discuss in detail the eight dimensions of physical privacy – environment, territoriality (property), territoriality (body), solitude (physical), repose, physical access, sensory and communication channels, and violator (humanness and relationship) – in the context of psychiatric care.

Figure 1

Information system development privacy framework.

Notes: Reproduced with permission from Information Systems Development. Towards a privacy framework for information systems development. 2005b:77–88. Carew P, Stapleton L. With permission of Springer.15

Description of physical factor

To better understand the physical factor, we have adapted Carew’s definition of each of its dimensions and provided examples of how these dimensions can be applied in a psychiatric care context. In general, physical privacy refers to the environment (office, home, and hospital) in which an individual may desire physical solitude.14 Different patients may have different perceptions about their own private space. Table 1 depicts all dimensions for the physical factor in ISD.

Table 1

Overview of study context: dimensions of physical factors

Explanation and relationship
Factor	Aspect	Privacy	Study context
Physical	Environment	Environment can impact an individual’s social behavior and, therefore, their privacy preferences2	A patient behavior may be influenced by their environment25
	Territoriality (property)	The property owned by someone defines their privacy perceptions for that particular territory	The property owned by someone defines their privacy perceptions for that particular territory
	Territoriality (body)	If a person tries to touch a patient, he can deny the touch either by actions or words26	If a patient is being monitored and his behavior is being recorded, although no physical contact is involved, this could still disturb his territoriality (watching through video)
	Solitude (physical)	Solitude means the freedom to be alone. A patient has the right to be free from remote observation	Monitoring patient behavior is standard procedure in most psychiatric wards, therefore, remote observation cannot simply be removed or rejected by a patient or family member
	Repose	Being free of such things as a public address system that makes loud noises or lighting that is too bright	The camera should not be too bulky or obvious, and the camera’s location should not interrupt the patient’s daily routine in the ward
	Physical access	An individual has the right to physically control access to himself26	Some patients may have experienced physical abuse or sexual abuse that caused their mental illness.27 This could lead to a patient having a negative attitude to physical contact and being traumatized
	Sensory and communication channels	If there are too many ways of communicating, it reduces one’s control over privacy1	Sensory and communication channels have no relation to this study because a patient who is in-ward is usually not available or accessible to the outside world
	Violator (humanness and relationship)	A violator is a human or object that intrudes upon an individual’s privacy	There is a need to increase health care providers’ ethical commitment to ensuring that a patient’s privacy is not violated18

Physical privacy needs to be considered when dealing with a patient, whether the interaction is between the patient and the health care provider or the patient and the family member. Being physically touched by a doctor may be perceived differently by different patients.

Below, we discuss how we applied each of the eight privacy dimensions addressed in this study: environment, territoriality (property), territoriality (body), solitude (physical), repose, physical access, sensory and communication channels, and violator (humanness and relationship).

For environment, we propose that a patient’s privacy preferences will be based on his or her physical environment. That is, depending on which environment the patient is in (eg, at home, in the psychiatric ward), his privacy preference will vary. We also recognize that if a patient is unstable or unwell, he may be unable to control his privacy needs, regardless of his environment.

For territoriality (property), a patient may not be able to control his privacy if he is in the ward. In the context of applying a monitoring system in the ward, we investigated patients’ feelings about a system that would monitor their behavior. Our question “How would you feel when being monitored by the monitoring system, knowing that you have no control over the system?” addresses the territoriality dimension.

Territoriality (body) refers to whether a patient’s body is fully owned and controlled by the patient. Patients can decline any bodily contact if they wish. In terms of a monitoring system, patients need the ability to deny the monitoring system permission to capture movements of their bodies. Without proper permission from patients, the system may violate body territoriality. During interviews, we asked participants the following: “Would you like to have full control of your body, or would you allow any health care provider (nurse, doctor) to touch you while you are not in a good condition? Would you feel that your body is being violated by the system even if there is no physical touching?”

Similar to body territoriality is the dimension of physical access, whereby it is an individual’s right to physically control access to the self. A patient’s condition sometimes requires health care providers to touch him, but patients have the right to decide who can touch them and when, depending on the situation. We asked, “If you are not in a psychotic condition, would you allow health care workers to touch you? Or would you set any limits as to who can touch you physically? Would you mind listing who can touch you?”

Solitude is the freedom to be alone. Based on Pedersen,17 a patient can decide if he or she is free from remote observation or not. In most psychiatric wards, CCTV or cameras are installed to help health care providers keep track of all activities. However, it is important to know how patients and family members react to remote observation and to provide a way for patients to retain their solitude rights despite this technology. In our interview, we explored this dimension by asking patients the following: “You know that you are being observed in the ward and you have no choice. Would you like to list your own information-sharing limitations for the system, such as who can monitor you and for how long?”

Repose addresses the freedom from loud noises or bright lighting. It is proposed that patients can choose to be free from a monitoring system that is too obvious, makes noise, or requires bright lighting. Since a monitoring system has physical components that are visible to anyone, the best way to provide repose is by putting the cameras and other components somewhere that does not interrupt the patient’s daily activities. We asked participants, “Will you feel disturbed by the camera’s location and position? Or will you feel excited by the camera’s location and position?”

The sensory and communications channel dimension addresses how the number of communication channels can limit a patient’s control over privacy. Patients in the ward cannot access many communication channels. In contrast, health care providers have multiple channels of communication (mobile phones, the Internet) that they can use to share patient information. We asked patients, “There is a camera there, watching you; do you feel you have less privacy? Or do you feel it is not violating your privacy?”

Violators are people or objects that intrude on an individual’s privacy. Magnusson et al18 suggested that health care providers should have an ethical commitment to ensuring that patients’ privacy is not violated. In this era of applying technology to health care, health care providers should be proactive in addressing patients’ privacy needs, especially if the technology will by physically intrusive. We asked participants about violators in this way: “Will you feel that the camera is violating your privacy? Or you will not feel anything about the camera because it is non-human?”

Methodology

A case study methodology was conducted in a teaching hospital in Malaysia. We received the ethics approval from the teaching hospital in 2011 with the ethical number (USMKK/PPP/JEPEM [236.3.(01)]). The ethics committee comprised clinicians and academic faculty in medical and health sciences colleges in Universiti Sains Malaysia. The first author attended an interview session with the ethics committee in early 2011 to describe the nature of the study, the inclusion and exclusion criteria. A few physicians in the ethics committee reviewed the inclusion criteria to ensure patient rights are reserved. This teaching hospital does not have a psychiatric behavioral monitoring system (PBMS) in place, but the ward has the same features as other psychiatric wards that have installed a monitoring system. Approximately 34 National Health Service (NHS) hospitals in the UK have installed CCTV in their mental wards.19 All NHS hospitals placed their CCTV cameras near patients’ bedside, which was also suitable for Hospital A’s setting. Both NHS hospitals and Hospital A were public hospitals rather than private mental institutions. The teaching hospital’s ward was also similar in setting to a mental ward in South Australia20 in that it had an open ward and a locked ward to accommodate patients with different mental illness severities. The hospitals had 20 beds each. Based on the comparisons above, we concluded that our selected teaching hospital was suitable as a case study due to its similarity to other hospitals around the world in terms of ward size, number of beds, types of wards (open and locked), as well as being a public hospital setting.

Twenty-five participants were involved in this study, consisting of 14 males and 11 females, and the interviews took place between February and April 2012. The interviews were conducted in Malay (the official language in Malaysia), transcribed, and then translated into English for analysis and reporting. All patients signed an informed consent form that had been reviewed by the ethics committee. NVIVO Qualitative Data Analysis software was used for data coding and analysis. For the physical factor, deductive coding was applied throughout the thematic analysis. Intercoder reliability was tested between two independent coders to ensure that the coding process was done correctly and to confirm the reliability of data.21

Results

Participants

All the names of participants are fictional names. We used Western names to represent the patients, while our patients were actually Malay Muslim with Arabic names such as Mohamad and Ahmad; patients’ age ranged from 14 to 54 years. For patients who were in the minor group (14 years old), informed consent was taken from the parents and guardians. The legal age in Malaysia is 18 years and above. Some patients had been admitted more than once. One patient (Michael) had been admitted 10 times, whereas two patients were in the ward for the first time (Paul and Jamie) and two were outpatients (Kathy and Nancy). Out of the 25 participants, 20 reported having an occupation varying from running a business to a government position such as police officer.

Dimensions for the physical factor

Patient responses to questions regarding the eight dimensions for physical privacy are discussed in the subsections below.

Environmental dimension (privacy vs location vs medical condition)

Patients felt comfortable in the ward when their privacy preferences were met. Patients who said that staying at home was preferable to staying in the ward were likely to be more protective of their information (in this case, recorded video of themselves). Based on the interview data, if patients stated that they felt they had no privacy in the ward, this indicated that they felt restricted from doing anything, even making a cup of coffee.

The first question for the environmental dimension was designed to elicit patients’ feelings about their stay in the ward in terms of whether it affected their privacy or not. All patients reported feeling uncomfortable staying in the ward at first. But after a week or so, some patients felt comfortable there and some even preferred it to being at home. Five patients (Michael, Sam, Alice, Sarah, and Helen) stated that they felt very comfortable staying in ward and thought that staying in ward did not affect their privacy at all. Below are examples of their responses.

I feel so comfortable here. If I am in the ward, I feel if at home I feel that I can’t but in the ward I feel relief. [Michael]

Michael felt more comfortable in the ward than at home. He felt that his actions at home were watched and controlled by family members. He was happy to think that someone was monitoring him in the ward to ensure his good health; this made him feel that he was in control of his privacy. For him, being monitored did not affect his privacy. However, he would put some limitations on monitoring.

I feel a little bit free. Here it’s a bit free compared to at home. At home, Mom always scolds me, I can’t do anything. [Sarah]

Sarah felt more limited in what she could do at home as compared to the hospital because her mother was not in the hospital to control her. For this reason, she preferred staying in the ward.

I like here better than home, happier. At home I can’t control my feelings. [Helen]

Helen did not explain why she could not control her feelings at home. It may be that at home she felt that family members controlled her behavior and actions, or it may be that while she was in ward she got medication that helped her control her feelings. Regardless, from her point of view, living in the ward surrounded by friends made her feel happy; she did not feel her privacy was compromised.

The other 20 patients stated that staying at home was more comfortable for them. Staying in ward affected their privacy for different reasons. Their movements and actions were more controlled in the ward than at home. Despite the fact that they were not happy with the hospital environment, they dealt with it, as they had no other choice if they wanted to recover and move on with their lives.

It is different here. I feel isolated. The privacy staying at home and here is a bit different. [Isaac]

I feel more comfortable and have more privacy at home compared to here, in the ward. [Adam]

Isaac and Adam specifically mentioned privacy as a reason that staying at home is better than staying in the ward. Patients who preferred to stay in the ward never mentioned privacy.

In this ward, I feel uncomfortable because it makes me feel isolated. I need to take my tablets for my health. I mean medicine. It is not comfortable here but for medicine, I have to. [Kathy]

Kathy preferred staying at home where she knew everyone and was able to blend into the family. She felt she had no choice, but to stay in the ward to receive treatment and cure her illness.

Territoriality (property)

For this dimension, interviewers asked patients how they would feel if there was a camera monitoring their behavior in the psychiatric ward, and whether they felt the monitoring would affect their privacy or not. Territoriality (property) refers to the patients’ personal belongings. A monitoring system may affect patients’ privacy by monitoring their belongings and themselves.

Because of the nature of their illnesses, four patients (Olsen, Kathy, Felicia, and Murdoch) said they would feel very happy if there was a camera monitoring their behavior because they enjoy the attention.

I like it and feel comfortable when I know there is a camera monitoring me. [Olsen]

Olsen said he liked to be watched and had no issue with someone monitoring his behavior; therefore, monitoring would not violate his privacy. He was open about sharing personal information and had no desire to limit monitoring.

Sixteen patients reported feeling comfortable with the idea of a monitoring system, and stated that they would have no problem if there was a camera monitoring their behavior in the ward. They felt that the camera would have no effect on their daily routines and that they would be able to act normally. Of these 16 patients, 2 (Michael and Abe) mentioned that it would be better if cameras were mounted only in certain places, even though the interviewers had not yet mentioned this. Michael and Abe suggested that cameras should be located near the beds and the meeting room, but not in the bathroom.

If it is possible, the camera position needs to be at a not so private place. For example, I think it would be okay if it were near the bed. [Michael]

The camera location clearly mattered to Michael. He preferred the camera to be near the bed. He wanted to have his privacy in certain locations. Abe agreed with Michael. He was comfortable with video monitoring in general, but felt there should be limits on where a camera could be placed.

It is okay if there is a camera monitoring my behavior every day in the ward, but it has to be only at certain appropriate places. [Abe]

Below are examples from other patients who would feel comfortable with cameras monitoring their behavior in the ward; these patients did not suggest any specific location for the cameras.

I am okay if there is a camera capturing my daily behavior in the ward. Yes, I would feel like I am being observed but I don’t mind because I have nothing. [Andrea]

Maybe at first, I would feel awkward, but later I would feel okay with the camera monitoring. [Brian]

Look at the purpose of the monitoring. If it is for the purpose of studying psychiatric patients, then it is something good. [Paul]

Five patients (Jamie, Jesse, Candice, Sarah, and Nancy) stated that they would feel unhappy and stressed if there was a camera monitoring their behavior in the ward.

I will feel stress because there are many monitors here [referring to the nurses]. If there is any camera monitoring, I am absolutely like a robot. It makes me feel disturbed and controlled. [Jamie]

Jamie did not like being watched by anyone, even the nurses.

A majority of the patients interviewed would be comfortable with camera monitoring, and only two patients stated a preference about where the cameras should be placed. Five patients were unhappy with the idea of camera monitoring. The reasons for this are discussed in the following sections.

Solitude

This dimension of physical privacy refers to how the patient would limit monitoring in order to achieve solitude from others for a period of time. The longer a patient would allow himself to be monitored, the less time he feels that he needs to be alone, and, we can infer, the lower his need for privacy.

To explore this dimension, we asked participants to list who they would allow to monitor them through the camera and to state any time limitations they would like to place on monitoring. If patients were not able to do this, the interviewers offered some suggestions for the patients to consider.

Each participant had his or her own privacy preferences regarding whom they would allow to perform the monitoring. Only one patient, Andrea, did not respond to this question. Six patients – Olsen, Stanley, Sandy, Sam, Helen, and Adam – would allow almost anyone to monitor them through the video camera with no time limitations; this included doctors, nurses, partners, parents, siblings, and friends. Henry would allow monitoring only with his consent. Other patients did not mention anything about consent. Some would allow parents and siblings to monitor them, whereas others would allow only their parents to monitor them. Jesse specifically said that she would not allow her ex-husband to monitor her.

Territoriality (body) and physical access

Controlling access to one’s body is one way of controlling privacy. This means that patients should have the right to make decisions about access to their bodies when they are feeling well. It is also suggested that their decisions should be respected even when or if their mental condition deteriorates. For this question, patients were asked if they would allow any physical contact at times when they are not in a good mental condition. Follow-up questions included how they would like to control their territoriality (body) in the ward and which part(s) of the body could be accessed by health care providers. Patients were asked to list whom they would allow to touch them if they were not in a good condition. Fifteen participants said they would allow doctors and nurses to touch them for medication or treatment purposes.

If it is for medication purposes, I don’t see why I should not allow doctors and nurses to touch me. [Andrea]

Doctors know what to do. They learned. So why not? Other patients cannot touch me because they have no experience. [Paul]

Andrea and Paul had no issue with allowing doctors and nurses to touch them because they recognized that health care providers have experience dealing with and treating their illnesses. They would allow all necessary steps to be taken in order to medicate them properly.

Only three patients (Alex, Felicia and Candice) expressed some preference about who could touch them. For Alex, it would depend on the situation. Felicia would only allow Sister Jesse, a nurse, to touch her, because she felt that only Sister Jesse understood her feelings.

Patient responses to this question showed that the majority of patients would allow only doctors and nurses to touch them while giving treatment. They believed that people with no knowledge should not be easily able to touch them. This shows that territoriality (body) and physical access are important privacy factors for psychiatric patients. Because these two dimensions elicited the same answers from patients during the interview, these dimensions were combined into one in the ISD privacy framework.

Repose

This dimension explores whether a person can be in repose (calm and peaceful) knowing that a camera is monitoring them. We asked participants if the camera’s position or location would excite or disturb them and what they thought would be a suitable location and position for the camera. For psychiatric patients, feeling excited or disturbed could exacerbate their tendency to be highly emotional, which could lead to uncontrollable actions. Therefore, it is important to respect their need for repose.

Only Jamie did not agree with any of the camera locations suggested by interviewers. Each time the interviewers suggested a location for the camera, he just shook his head, showing that he did not agree. He did not give any reasons for his negative responses.

Abe and Michael suggested that the cameras should be hidden to avoid causing any excitement or disturbed feelings. They felt that camera location is a big issue that could affect their feelings and privacy.

Twelve patients stated that camera locations could be near the beds, but not near bathroom. Some patients stated that it might be okay to put the camera outside the bathroom, but putting it inside the toilet would be seriously disturbing for them. Below are some statements from patients on this topic.

It is okay if the camera is in the ward. But I don’t like it if it is near to the toilet. It is too private to me. [Kathy]

Five patients did not want the camera to be near their bed or near the toilet. They suggested that the camera should be located only at the nurse’s station and the dining table. They did not want anyone monitoring them while they were sleeping. Below are responses from Jesse on this matter.

I think the camera location is an important issue for me. I will absolutely feel disturbed by the camera location. If it is near to the toilet, I feel disturbed because they can see me changing clothes and I don’t think it is appropriate as I am old, too. If it is near to bed also makes me feel disturbed. [Jesse]

Although most patients felt that certain camera locations could excite and disturb them, five patients expressed the opposite opinion. They stated that the camera’s location would not affect them at all. They would be comfortable with a camera in any location, even in the toilet, because monitoring by doctors and nurses is for their own safety. Based on their answers, examples of which are given below, it appears that the presence of a camera would make them feel pleased and excited instead of disturbed. They would be happy knowing that someone was monitoring them, regardless of the camera location.

I don’t mind if they want to put the camera anywhere. Anywhere is okay with me, even in the toilet watching me while I am showering. I think it is a need for them to monitor my safety. If they do that, I feel healthy and active. [Helen]

Twenty of the patients stated that cameras in certain locations could disturb their feelings and violate their privacy, and five patients stated that having the camera in certain locations could affect their behavior. This shows that repose is an important factor to build into a privacy framework for patient-monitoring ISD, since each patient has his or her own preferences about camera location.

Sensory and communication channels and violators

The sensory and communication channel dimension is about the channels of communication and how they affect privacy. A violator refers to the agent violating a person’s privacy; the degree of violation that could occur is based on the relationship between the person and the violator. For example, those with a closer relationship may impose a potentially less severe violation. In this study, the sensory and communication channel under investigation is the monitoring camera, which allows others to monitor a patient’s behavior. Though a camera is not human, violation can still happen when another human is watching through the camera or watching a previously recorded video. In this case, doctors and nurses may be the violators from the patient’s perspective.

When these two dimensions were discussed with participants during the interview, the answers received were substantially the same for both; therefore, these two dimensions were combined at the end of the data analysis into a single “violator” dimension. Following are examples of answers given by patients when asked about sensory and communication channels and violators. Responses demonstrate how these two factors are related and why they can be considered as one factor.

Nine patients felt that their privacy would be violated by being monitored through the camera.

I feel less freedom if I know there is a camera monitoring me. [Jamie]

Yes. I feel the camera could violate my privacy because I know someone is monitoring me. [Candice]

If there is a camera monitoring, I need to change clothes immediately, not as usual. So I think I feel less privacy. I would feel disturbed by the camera’s existence especially if the camera was in the toilet. I don’t like the camera to be in the toilet. [Sarah]

Knowing that someone is monitoring her behavior would make Sarah feel awkward and uneasy. She would feel very disturbed by the camera’s existence, to the point that it may affect her daily routines. On the other hand, Felicia and Michael would feel okay if there was a camera monitoring their behavior, but they would place some restrictions on where the camera could be located and who could monitor them. Michael was precise in describing how he would want the monitoring to be done so as not to disturb him.

It is nothing, as usual. But don’t show it off. It is better to hide the CCTV as now everything is high technology. Do not make it any bigger. Other patients might smash the camera. If it is possible, hide the camera so I won’t feel disturbed by looking at the camera. [Michael]

The rest of the patients said they would feel comfortable with camera monitoring; they felt that the camera’s presence would not be disturbing and would not violate their privacy at all.

Based on the interview responses, there are three types of privacy preferences among the patients. Thirteen patients (a majority) stated that they would be comfortable with camera monitoring and did not feel that it would result in any less privacy. Two patients expressed preferences about the camera’s location. The remaining patients stated that knowing someone was watching them through the camera could affect their privacy. For some patients, the nature of their mental health issues meant they would find camera monitoring exciting and would be happy with the attention. During the interviews, a few patients stated that no one cared about them; this suggests that they desire attention from others, especially family members and doctors. Knowing that someone was monitoring them would make them feel better and loved. In some ways, behavior monitoring can have a positive effect on a patient’s feelings. As for patients who were concerned about their safety, they felt the presence of the monitoring system would ensure they were safe since they were being watched by the medical team.

Discussion and future work

We adapted Carew and Stapleton14,15 who carefully designed their framework to incorporate all the important factors for privacy needs. When there is a system to be implemented in a health care setting, especially one that will affect patients, it is imperative to study how the system affects the physical aspect of patient privacy. Our in-depth interviews with 25 patients in one teaching hospital in Malaysia gathered valuable data on this topic from psychiatric patients, most of whom were staying in the ward during the time of the interviews.

Interestingly, many psychiatric patients were not clear about the boundaries of their own bodies and how to control access to their personal space. Many patients gave consent for doctors and nurses to have physical contact with them in order to provide medical assistance. Some stated that only specific medical team members were allowed to have physical contact with them, as they felt that they had a close relationship with those individuals. These questions need to be asked in the context of an ISD privacy framework, as the monitoring system would be a third party that records all instances of physical contact. Since psychiatric patients’ emotional states can fluctuate rapidly, a physical monitoring system can be exciting or disturbing to them. In our study, participants were able to articulate where the camera should be placed (eg, near the bed, but not in the shower room) and some suggested that cameras should be hidden so they would not be disturbed by the monitoring system. This study supports the study of Papoutsi et al12 that investigated the patient concerns on privacy and how important privacy protection was in any health care.

Our in-depth interviews showed that patients clearly had mixed feelings about a monitoring system which aligned with patients and public concerns.12 Patients appreciated the technology that may be used in their wards in the future, but they also expressed concerns and fears about how the technology might violate or intrude upon their physical privacy. These detailed accounts support the argument that developers should consider patients’ needs and address them in their technology, so that it can be both useful and well-accepted by the users. A similar study by Avancha et al8 looked at the privacy requirements among users for mobile technology.

Applying the original definition by Carew and Stapleton,14,15 territoriality (body) is a person’s physical body, which is the most inviolate of territories and any unwelcome contact is a violation, whereas physical access is the ability to control access to the self. In this study environment, territoriality (body) and physical access had the same function, in that patients felt it was their right to protect their own bodies and their privacy during their stay in the ward. Therefore, under the revised ISD framework (Figure 2), the physical access factor represents the territoriality (body) factor, too.

Figure 2

Modified model (right) and original model (left).

Notes: Reproduced with permission from Information Systems Development. Towards a privacy framework for information systems development. 2005b:77–88. Carew P, Stapleton L. With permission of Springer.15

Two other factors that were supported by data are violator and sensory and communication channel. In this case study, the monitoring system itself is a possible violator to patients through the sensory and communication channel. In the previous study by Carew and Stapleton, violator means human beings, whereas in this study, the monitoring camera was considered the violator because patients were aware of the possibility that they would be watched.

Other factors that were not supported by data are intimacy (internal) and intimacy (external). Revisiting the original definitions by Carew and Stapleton,14,15 intimacy (internal) is intimacy with colleagues, peers, and managers and intimacy (external) is intimacy with family and friends. In the psychiatric context, patients perceive internal and external intimacy the same way. Some patients might feel internal intimacy with their family; other patients may not, depending on their relationships with individual family members. Therefore, in the psychiatric context, external and internal intimacy can be defined as a single factor of intimacy to determine patient preference.

The limitation of the study is that it only looked at perceptions of privacy since the PBMS was not available in the ward. We relied on patients’ understanding of the scenario given, in order to elicit their perceptions of privacy.

Conclusion

Altman’s2 privacy definition posits that individuals are selective about sharing information with others. This research investigated how a PBMS can affect patients’ physical privacy. Even though it is explicitly recognized in the Universal Declaration of Human Rights that “Every person with a mental illness shall have the right to exercise all civil, political, economic, social, and cultural rights”,22 psychiatric patients are often denied the fundamental right to privacy. Psychiatric patients have the same rights to protect their physical privacy as other patients. Privacy for psychiatric patients needs to be protected to avoid prejudice and stigma, such as discrimination in employment and education, since the society still struggles to accept mental illness. In the international arena, privacy has been recognized as a fundamental right that must be protected;23 if any unauthorized technology intrudes patients’ privacy, the action is considered illegal. Patients should be able to change their privacy preferences in different situations and conditions, based on their environments and relationships.24 The study by Papoutsi et al12 clearly showed that patients and the public are worried about the security risks on health information systems and proposed privacy and security policies and procedures to protect patient privacy.

When staying in a hospital ward, patients are subjected to different technologies. One commonly used technology is a monitoring system. Even though this technology has not been applied in many hospitals in Malaysia, we anticipate that hospitals in Malaysia will soon begin adopting such technology. A PBMS must accommodate patient privacy preferences in order to be an effective and successful clinical intervention. Therefore, it is crucial not only to understand the readiness of patients to accept such a system, but also to explore patients’ perceived privacy concerns. By understanding patients’ privacy concerns and needs, we can provide developers with concrete guidelines for building a monitoring system that is effective and privacy-sensitive, in line with the organization’s ethical policies.