Digital health refers to the use of IT, services, and processes to support health care delivery [1]. These technologies include but are not limited to electronic health records (EHRs), consumer wearable devices, mobile apps, remote patient monitoring, artificial intelligence (AI), and virtual care [1-3]. Digital health tools can support improved patient engagement and empowerment and enhance care quality and delivery [4,5]. The success of these tools hinges on their ability to share patient data (herein referred to as personal health information [PHI]) to support clinical care [6], enable patient access to health records [7], and progress research and health system analytics (ie, secondary use) [8]. Opportunities for using digital health tools continue to grow as the potential for applications of AI, machine learning, and deep learning expands. Various types of AI are currently being used to support the development of learning health care systems [9]. With the growing volume of data produced through digital health tools, there is considerable interest in consolidating these data silos [10-12]. Numerous health care organizations aim to establish learning health systems to achieve these benefits; however, this work cannot be done without patients’ consent to share their PHI [13]. These systems require large amounts of PHI to develop algorithms that can guide improvements in patient safety, quality of care, and health outcomes [9].

The growing importance of and interest in integrating AI and other digital health tools into care raises questions on how to protect patient privacy. Although the public is supportive of investments in these technologies [14,15], there is also a corresponding concern about the potential for unethical or harmful uses of their PHI [16-18], especially as it relates to use by commercial entities. As health care data breaches and instances of misuse of PHI by commercial entities become more common [19], there is a need to support individuals in better understanding what they are consenting to (ie, becoming informed data citizens). It is necessary to reach a balance between protecting patient privacy and realizing the benefits of digital innovations to support meaningful consent and see success in this space. This balancing act is a product of polarizing perspectives grounded in the different values of various stakeholders in the health care community [20]. Privacy as contextual integrity [21] suggests that the appropriateness of information sharing should be based on the norms of specific social contexts, and trust in a product or service is predicated on the degree of consistency with expectations [21]. Contextual integrity also suggests that these norms should not only consider the societal perspectives and values but also account for the individual interests and preferences of the affected parties. To understand these norms, numerous studies have explored patient willingness to consent to share PHI [9,13,22]. Factors related to willingness include individuals’ perspectives on the privacy and security of their PHI, the relevance of sharing, and how sharing PHI would directly affect the quality of care [9].

Patient willingness to share PHI to support advancements in health care is improved when there is transparency, especially when the information regarding the collection, use, and disclosure of their PHI is clearly stated [22]. Moreover, this transparency is often seen as a mechanism for improving the trustworthiness of digital health tools [22]. There are ongoing efforts to improve consent processes by providing patients with improved transparency on PHI management, enabling them to make more informed and meaningful choices about PHI sharing [16,23]. Innovative consent processes through the use of electronic consent (eConsent) have become common practice by health care organizations and digital health service providers for obtaining consent. eConsent refers to the use of electronic information systems (ie, multimedia resources such as infographics, videos, and embedded links) to convey information commonly found in a paper-based consent form such that an individual’s consent is obtained electronically [24,25]. With the growing use of eConsent, new consent models have emerged, each providing individuals with varying control and autonomy over the collection, use, and sharing of their PHI. Broad consent models [26] (ie, consenting to the use of PHI for broad purposes) have commonly been used by digital health service providers; however, newer consent models such as dynamic consent [26] (ie, providing consent through a web-based platform, with the ability to set or change consent preferences) are being adopted to better support meaningful and informed consent practices. The Office of the Privacy Commissioner (OPC) of Canada has deemed meaningful consent a vital component of Canadian privacy legislation, citing the importance of meaningful consent and choice in establishing and sustaining public trust in digital health [27,28]. This review explores patient perspectives and preferences regarding digital health consent. Patient experiences with digital health consent will also be explored to generate insights into optimizing the effectiveness of digital health consent processes, making consent meaningful for patients.

State-of-the-art reviews are intended to summarize emerging trends and synthesize insights from the most current literature [29]. This state-of-the-art review was conducted to understand the current state of research concerning patient perspectives on digital health consent. Understanding the current state is essential as research on consent is primarily driven in the context of understanding its role in participant recruitment [30], biobanks [31,32], registries [33,34], and secondary use [35,36], but there has been limited attention paid to consent within a broader digital health context [17]. The objectives of this review were to characterize the state of evidence, explore what is known about the patient perspective and experience with digital health consent, and provide recommendations on designing and implementing digital health consent based on the findings.

A structured literature search was developed and deployed in 4 electronic databases: MEDLINE, IEEE Xplore, Scopus, and Web of Science. The initial literature search was conducted in March 2021 and updated in March 2022. Primary peer-reviewed articles published after January 2010 were included in the search. The search strategy was first developed using Medical Subject Headings and keywords in MEDLINE and then translated to the other databases. Key search terms used in each database included information systems, electronic health/medical records, telemedicine, telehealth, mobile apps, mHealth, digital/virtual health, artificial intelligence, consent, informed consent, eConsent, consent model, consent framework, consent pathway, consent requirement, consent standards, eGovernment, and eServices. The search terms were combined using Boolean logic operators (eg, digital health OR eConsent AND consent OR framework). Although the search terms used were quite broad in nature, we narrowed our search to specifically include papers that described digital health interventions or innovations and consent preferences, behaviors, or experiences of patient populations. The full search strategy is presented in Multimedia Appendix 1.

The search results were uploaded to Covidence, a literature screening and data extraction tool. In total, 2 reviewers (NS and IK) piloted the extraction tool with the first 50 articles and independently screened the titles and abstracts for relevancy afterward. Any discrepancies or conflicts were discussed and resolved. A total of 3 reviewers (IK, DI, and HB) independently assessed the full text of all relevant articles. Articles were flagged for discussion if it was unclear whether they met the inclusion criteria. In total, 2 authors (IK and JK) repeated these steps when updating the search.

Articles were included if they met all the following criteria: (1) described an eConsent or consent process, design, or development; (2) focused on patients’ perspectives, preferences, acceptance, or behaviors; (3) were set in a digital health or health IT context; and (4) described the use of digital health or health IT or digital PHI for health care delivery, health research or analytics, or consumer use. Study eligibility was not limited by study design, thereby allowing for the inclusion of various study designs. Only studies published in English were eligible for inclusion. Studies that did not meet the inclusion criteria were excluded from the review.

A standardized data extraction form was developed on REDCap (Research Electronic Data Capture; Vanderbilt University), a secure software database for storing research data [37]. In total, 4 researchers (IK, DI, HB, and JK) independently extracted data from each article using a standardized data extraction template. Once extraction was complete, the full research team reviewed the compiled data. Three broad data collection categories were extracted from the articles: (1) study characteristics, (2) consent model, and (3) study results and main findings.

The extracted study characteristics included study title, year of publication, country of origin, sample size, sample source (eg, research, biobank or patient participant, and national or regional sample), study context or setting, study method, and study design and objectives. Data on consent models were extracted and categorized based on the seminal eConsent model framework by Coeira and Clarke [38]. The framework was then expanded to include contemporary models [26,39-42]. The types of consent models include broad open, broad controlled, broad tiered/menu/meta, dynamic, and general denial consent. The main findings of each study were extracted verbatim if they provided statistical analysis of patient perspectives and experiences with digital health consent.

A qualitative content analysis [43] of the free-text data was conducted using Microsoft Excel (Microsoft Corp). The analysis used an inductive approach in which the research team created codes and categories over several coding sessions. Once the coding was complete, the lead and senior authors (IK and NS) reviewed and refined the codes. Frequencies and percentages were calculated using Microsoft Excel.

A detailed overview of the included studies is presented in Multimedia Appendix 2 [44-116].

The search strategy yielded 3133 unique citations. Following the screening process, 2.39% (75/3133) of the articles were eligible for extraction. The flowchart of the search selection process can be found in Figure 1.

Of the 75 studies included in this review, 58 (77%) were published within the last 5 years (between 2017 and 2022), and 48 (64%) were conducted in the United States. Most studies were conducted within a clinical care (33/75, 44%) or research context (29/75, 39%) where the study sample of focus was primarily research, biobank, and patient participants (54/75, 72%). Nearly half of the studies (36/75, 48%) used quantitative research methods, commonly using cross-sectional surveys (35/75, 47%) to collect data. The primary purpose of most studies was to understand participants’ willingness to share PHI (25/75, 33%) and participants’ perceived usability and comprehension of an eConsent platform (25/75, 33%). More than half of the studies (39/75, 52%) focused on participants’ hypothetical views on digital health consent. A total of 21% (16/75) of the studies described the design or development of an eConsent platform. In total, 27% (20/75) of the studies described the implementation, usability, or evaluation of an existing eConsent platform. Further details about the study characteristics are shown in Table 1.

Table 2 presents a typology of consent models, outlining the models used across the studies. More than half of the included studies (40/75, 53%) did not describe or report the consent model used. Broad open consent was the most explored model (11/75, 15%) [44-54], followed by dynamic consent (8/75, 11%) [55-62], broad controlled consent (4/75, 5%) [63-66], broad tiered/meta/menu consent (3/75, 4%) [67-69], and general denial consent (2/75, 3%) [70,71].

In total, 9% (7/75) of the studies compared various consent models to understand whether a specific model increased participants’ comprehension of what they were consenting to or made them more willing to consent. Within these studies, patient consent model preferences varied; however, in most studies (5/7, 71%), participants preferred granular, informative, and transparent consent choices [72-76]. For example, Kim et al [76] found that 76.6% (955/1246) of the participants made sharing choices to select at least one PHI value that they would not want to share with a particular researcher. Participants also noted that, if consent choices were not offered, they were less likely to share their PHI. Kaufman et al [72] found that, when presented with various consent models, participants had similar preferences for general denial (1873/2601, 72%), broad tiered/menu/meta (1951/2601, 75%), and dynamic consent (1899/2601, 73%). A broad open consent model was the least preferred among participants, with 64% (1665/2601) stating that they would be willing to share their PHI under this model.

The remaining 29% (2/7) of the studies found that participants preferred broad open consent. Riordan et al [77] found that broader consent models may be appropriate under specific circumstances, where 91% (2873/3157) of respondents expected to be explicitly asked for consent for their identifiable records to be accessed for health provision, research, or planning, whereas half (1547/3157, 49%) of the respondents expected to be asked for consent if their records were deidentified. Brown et al [78] found that more participants (19/31, 61%) preferred a broad open consent model over a broad tiered consent model (10/31, 32%) when agreeing to the secondary use of their biospecimens. Participants least preferred “notice consent” (ie, general denial consent), stating that it was not informative and did not invoke a sense of control over their PHI sharing preferences.

In total, 91% (68/75) of the studies described the patient perspective or experience with digital health consent. These studies were further categorized according to their primary purpose (as described in Table 1): (1) user comprehension of consent notices and consent information needs (31/68, 46%), (2) willingness to consent to participate (12/68, 18%), and (3) willingness to consent to share PHI (25/68, 37%).

Consent in digital health is contextually driven such that it is often dependent on who is using or accessing one’s PHI, how their PHI will be used, and for what purpose. The findings of this review underscore the context dependency of consent as there were mixed results on patient perspectives on consent models and willingness to share their PHI. For instance, broad consent models may be acceptable in specific study contexts. In contrast, consent models that provided patients with more control were favored in others (ie, broad tiered, menu, or meta and dynamic consent). Similarly, patient willingness to share their PHI, consent behaviors, perceptions, and preferences varied by study. Given this variance, enabling individuals to make informed choices based on their contexts is critical. At the most rudimentary level, individuals require specific and easily comprehensible information on who their PHI is being shared with, for what purpose their PHI will be used, and how the privacy and security of their PHI will be ensured [10,117]. Providing individuals with adequate information to make an informed choice fosters transparency—the moral and ethical obligation to enable meaningful consent [72,97,117,118]. The insights gathered and summarized in this review highlight the need to recognize individual behaviors and preferences when designing and implementing the consent processes of digital health initiatives and the importance of building and sustaining trust and transparency.

Trust is central to individual consent behaviors, preferences, and perceptions. Willingness to consent often depended on the entity collecting PHI, where most individuals were comfortable sharing PHI with their health care providers, health care organizations, and academic researchers. Comfort in sharing PHI declined with recipients outside the individual’s circle of care, particularly with commercial or for-profit entities. There is a growing body of evidence highlighting individuals’ significant discomfort in sharing their PHI with commercial and for-profit entities, primarily because of a lack of trust in these entities [10,13,119-121]. This discomfort has been predominantly attributed to privacy concerns, loss of control and autonomy over one’s PHI, and the potential for misuse of one’s PHI (ie, for monetary gains) [13,19,121,122]. There was an evident desire for individuals to have greater control over their PHI-sharing preferences, largely attributing these needs to past privacy experiences, health care experiences, and general health care perceptions. Specifically, this review found that those with positive experiences within the health care system and those with access to a trusted usual source of care were more willing to share their PHI [110,112].

In contrast, those with poor health care experiences and awareness of commercial entities misusing PHI were less willing to share their PHI [105,111,112]. Unsurprisingly, other studies have found mixed results on how past health care and privacy experiences affect intentions to share [10,19,123]. This supports the notion that privacy concerns are contextually driven such that individual experiences, environmental factors, and personal dispositions influence consent behaviors and attitudes [124]. Thus, to build trust in sharing PHI outside the circle of care, understanding the influence of these past experiences on individual privacy concerns warrants further consideration and research [19,123].

Although many individuals were concerned about the potential risks of consenting and the confidentiality of their PHI, in several studies, the benefits outweighed the potential risks [55,67,71,103,105,107,115]. There was a general willingness to share PHI in support of research efforts and improvements to health care outcomes so long as the benefits of sharing were clear [19]. A sense of social responsibility and altruistic beliefs about improving care and treatment outcomes for oneself and society prevailed. A common explanation for this behavior is the privacy calculus, where an individual’s information-sharing decisions are based on a weighing of future consequences related to the benefits and risks of sharing [125]. For instance, Kaufman et al [126] found that general concerns about protecting one’s privacy were not substantially related to their willingness to participate in a biobank. This discordance or privacy paradox is echoed in a systematic review of patient privacy perspectives on health information exchange [124], concluding that studies are increasingly finding that individuals often rationalize the risks of sharing information by considering the potential benefits (ie, privacy calculus).

The need to modernize consent processes for the digital age is widely recognized as legislation has not kept pace with the rapidly evolving digital health environment [10,27,117]. The implementation of consent processes that adequately reflect and incorporate end users’ needs has been slow and insufficient. To modernize consent processes, dynamic consent models have been commonly adopted to allow individuals to update or alter their consent preferences when needed [127]. Dynamic consent has been described as a means to improve individual autonomy by enhancing choice, comprehension, and engagement in the consent process [26,41]. Although dynamic consent may enhance informed choice, studies in this review more commonly explored or implemented broad consent models. The rationale for implementing broad consent models has been attributed to the ease of implementation, the minimal impediment to the progression of research, and the lowered risk of “consent fatigue” [26,39]. From the patient perspective, this study found that consent models that offered enhanced control and options over their PHI were preferred over a broad consent model [35,72-76].

Interestingly, this review also found that the type of consent model may have little relevance to participants’ decisions to consent [73,75]. Instead, consent decisions depended on whether individuals felt well informed and trusted with whom they shared their PHI. For instance, Soni et al [108] found that, although mental health information was deemed sensitive among participants, they were still willing to share it depending on who the provider was (eg, behavioral vs nonbehavioral health care provider). This adds to the notion that preference for data sharing is not solely tied to the type of data being shared but instead is intrinsically associated with past experiences (ie, stigma and discrimination) and trust in the data recipient [108]. This finding is especially salient as the mental health privacy discourse is heightened by special legislation and expectations grounded in the subjective sensitivity of the PHI—often contributing to the disconnect between the historical paternalistic approach to protecting patient privacy and their nuanced data-sharing preferences [128]. Improving transparency around data sharing and the impacts of sharing may empower these individuals to better contextualize their past experiences, thereby supporting greater autonomy in data-sharing decisions and trust in the data recipients.

In terms of transparency, there was mixed evidence on the best practices for presenting information on consent forms. The mixed evidence is characterized by a dichotomy, where some assert that more detailed information better supports consent decisions [129], whereas others contend that brevity supports meaningful consent [130-132]. However, this review also found suggestive evidence that the quantity of information presented in a consent notice is less important when considering the quality of the information presented (ie, clear, transparent, and informative) [75,100,102,103,111,113]. As society becomes increasingly digital, consent design considerations should stem beyond document length and instead prioritize innovations in the presentation of consent information [117]. As illustrated in this review, customizable electronic formats can facilitate more informed consent decisions (eg, links, drop-down menus, and multimedia) [30,36]. Consistent with the meaningful consent guidelines of the OPC, this customizable approach would allow individuals to control how much information they wish to process, thereby tailoring the consent form to support an informed decision [28]. Future research should focus on understanding individual consent requirements when designing and developing eConsent platforms, aiding in implementing more meaningful functionalities.

This review provides insights into patient consent preferences in the digital health context. Given the rapid adoption and integration of digital health technologies in clinical care settings, it is unsurprising that many of the included studies were published within the last 5 years (2017 to 2022; 58/75, 77%). The summative findings of this review present the current state of patient consent preferences and emerging consent practices in the digital health context. Currently, most studies focus on collecting and using electronic PHI and EHR data for biobanks and research initiatives. Few studies (6/75, 8%) focused on understanding patient preferences, behaviors, and perspectives on consent in AI (ie, precision medicine, machine learning, and deep learning). As AI becomes more pervasive in clinical predictions and diagnosis, treatment recommendations and decision support, and consumer health innovations, additional research is needed to explore individuals’ consent preferences and experiences in these contexts.

Consistent with state-of-the-art reviews, this study highlighted gaps in digital health consent research. Although the included studies explored patient or public consent preferences, many (40/75, 53%) failed to clearly outline the type of consent model used. Reporting the consent model is essential as it provides greater context to the study findings, especially concerning individual perceptions. As with privacy research [124,133], more than half (39/75, 52%) of the studies relied on hypothetical scenarios to understand participants’ consent decisions. Although these studies generate insights that can inform how to approach consent for digital health initiatives, they only represent intentions rather than behaviors. They are subject to the privacy paradox [10,124]. Moreover, this review found that there were fewer qualitative and mixed methods studies. These formative or needs assessment studies may benefit from qualitative and mixed methods approaches to better understand individual preferences and behaviors [124].

When considering how health equity has become increasingly important in health care research [134], it was surprising to see the lack of publications exploring consent with a health equity lens. Such studies analyzed how various sociodemographic factors affected participants’ consent behaviors and preferences, finding that race, age, income, and education individually contributed to consent and data-sharing preferences. However, these findings do not provide enough depth to understand the collective, intersectional factors that influence these decisions [10]. By viewing these factors individually, the underlying and multifaceted impacts of trust and antecedents on consent behaviors and decisions are not adequately acknowledged [133]. Future research must extend beyond the notion that individual characteristics such as race and age are in themselves associated with consent decisions and examine the influences of past and current experiences (eg, distrust in the health care system and negative health care and privacy experiences) on consent behaviors [71,135,136]. In doing so, we may uncover valuable insights into building trust and empowerment within these groups.

Finally, the findings of this review highlight important considerations for designing consent in the digital health era. The design of meaningful consent processes must be rooted in co-design approaches, transparent practices, and integrated knowledge translation. As echoed by the OPC Meaningful Consent Guidelines [28], stakeholder and consumer perspectives must be included in the design of consent, where co-design with the general public, policy decision makers, digital health service providers, and graphic designers is needed. This will ensure that diverse needs and requirements are met throughout the design, development, and implementation of consent processes. Moreover, the transparency of consent notices was a reoccurring theme in this literature review, where willingness to consent was contingent on how informed individuals felt. Transparency can be facilitated by ensuring that information presented within consent notices is customizable, comprehensible, and accessible [117]. Furthermore, in progressing the call for meaningful consent in digital health, there is a strong need to ensure that knowledge dissemination and translation efforts are prioritized, especially with regard to sharing best practices and lessons learned from the use of eConsent platforms and consent models for digital health innovations.

There are some limitations to consider, most of which are related to the state-of-the-art review methodology [29,137]. State-of-the-art reviews intend to provide a snapshot of the most current literature on a given subject. Given the time-bound nature of this review methodology, it is possible that we did not include all the available literature. To mitigate this, we deployed our search strategy in several multidisciplinary academic search engines to obtain a comprehensive review of the literature. Furthermore, a quality assessment of the included articles was not conducted as it was beyond the scope of this review methodology. The search strategy and screening methodology should also be considered when interpreting the results. For instance, in this literature review, we searched only in MEDLINE-indexed journals as opposed to searching in PubMed-indexed journals, resulting in potentially relevant articles not being included in our search. Furthermore, by limiting the search of the literature to primary research studies published in the past decade, we may have missed studies that may have been relevant for inclusion in this review. However, fewer than one-quarter (17/75, 23%) of the studies included in this review were published before 2016. Considering the rapid advancements in digital health within the past decade, studies published before 2010 may not have provided much insight. Finally, 64% (48/75) of the studies included in this review were conducted in the United States, which may limit the generalizability of our findings given the differing cultural, social, legislative, and political environments in other countries. In addition, given the finding that consent preferences among individuals are context dependent, there is a need for further research focusing on patient and public digital health consent preferences in other regional and national contexts.

Consent is an increasingly important issue in the rapidly evolving digital health ecosystem. Implementing meaningful consent may be a complex endeavor as consent preferences and behaviors will vary based on context; however, this review found that most patients are willing to consent to share their PHI given the right circumstances. Suppose that the desired outcome is to use one’s PHI to develop, sustain, and enhance digital health innovations. In such cases, individuals must be provided with transparent information about the purpose of the collection and use of their PHI and the potential benefits, whether direct or indirect, of consenting to share their PHI. In addition to transparency, information must be customizable, allowing readers to tailor the granularity of detail to their individual needs. By enabling meaningful and informed consent, organizations can foster greater trust in their digital health solutions. Furthermore, to understand how to facilitate meaningful and informed consent in various contexts, patients and the public must be engaged in the design, development, and implementation of consent processes and notices for digital health initiatives. By doing so, consent practices in the digital health context will not simply act as a proxy for choice but will also be able to fulfill the notion of contextual integrity such that they account for individual interests and preferences in specific social contexts.