Promoting Awareness of Data Confidentiality and Security During the COVID-19 Pandemic in a Low-Income Country—Sierra Leone

Introduction

In November 2020, the World Health Organization issued Joint Statement by United Nations System Organizations on Data Protection and Privacy in the COVID-19 Response stating that collection of vast amounts of personal and sensitive data may potentially lead to the infringement of fundamental human rights and freedoms [1]. The Organization for Economic Cooperation and Development called on national governments to adhere to the international principles for data security and confidentiality [2, 3].

Sierra Leone is a West African country of 7.5 million people and is divided into sixteen districts and five regions [4]. Sierra Leone ranks 184 out of 193 countries and territories on the 2022 Human Development Index and is classified as low-income country by The World Bank [5, 6]. The healthcare system is resource-constrained and challenged by frequent infectious disease outbreaks, the 2014–2016 epidemic of Ebola Virus Disease, and the COVID-19 pandemic [7]. The Ministry of Health (MoH) oversees 29 hospitals and more than 1,200 peripheral health units [8].

The first case of COVID-19 was reported on the 30th of March 2020. It was followed by the national epidemic response measures, including lockdown, travel bans, and curfews [9, 10]. To promote data ownership, confidentiality, and security (DOCS) awareness, the MoH initiated training on the DOCS principles and issued a Data Security and Confidentiality Agreement for MoH COVID-19 responders. The training sessions were conducted by the Sierra Leone Epidemiological Data (SLED) Team. Since 2017, the SLED Team of Sierra Leonean data managers that was created by the MoH and supported by the US Centers for Disease Control and Prevention (CDC), has been assisting with management and use of the Sierra Leone Ebola Database (Database) and helping families through a family reunification program to identify graves of their loved ones who were lost during the epidemic [11, 12]. Since its inception, the SLED Team was trained on identification of personally identifiable information (PII) and DOCS by MoH and CDC specialists and through online courses, which enabled them to develop training materials to establish and strengthen this expertise more broadly in the country.

This paper describes the methods used by the SLED Team to assist the MoH in bringing awareness of the DOCS principles to MoH COVID-19 responders. Similar efforts may benefit other countries where the knowledge, resources, and governing rules for protection of personal data are limited [13].

Methods

Training Materials

The DOCS materials were developed based on the training provided as part of 2018 3-day workshop for the Sierra Leoneans. DOCS sessions included presentations on PII recognition, principles of confidentiality and data ownership, information disclosure, electronic and physical data security, with discussions of real-life scenarios. Later, the DOCS sessions were delivered as a part of data management, surveillance, emergency management and other trainings to COVID-19 responders lasting 30 min to 3 h. A training module on principles of cyber security and an optional DOCS Jeopardy game were added to the training. To deliver basic DOCS information, the duration of a training session needs to be 2 h with 30 min for discussion.

DOCS Jeopardy

A game of DOCS Jeopardy was created to test the participant’s knowledge and encouraged the attendees to think deeply about real-life DOCS situations. The game included the following four categories: Confidentiality, Disclosure, Physical and Electronic Security, and PII. Generally, each question was based on a real-life scenario, such as, “You are a medical doctor in Connaught Hospital and one of your HIV positive patients proposed to your sister but has never revealed this information to her. What should you do?” Attendees participated in Jeopardy as individuals, but also worked in teams to answer the questions. The participants were awarded symbolic prizes, usually a piece of candy, for correct answers to encourage engagement. The DOCS Jeopardy game was received with great enthusiasm and resulted in thoughtful discussions. The DOCS Jeopardy game takes 1–3 h and was not always conducted due to allotted time constraints.

Data Security and Confidentiality Agreement

To ensure that COVID-19 responders understand their responsibility for unauthorized disclosure of PII, the MoH established a Data Security and Confidentiality Agreement that is required to be signed by attendees of DOCS training sessions. The Agreement states basic requirements for confidentiality protection, such as “I will not make any unauthorized copy, transfer, modification or purging of confidential information.” It concludes with a note about disciplinary measures that may be taken if these requirements are willfully violated. Signed by the attendee, the agreements were collected by the supervisors. The text of the Data Security and Confidentiality Agreement is in Supplementary Material S1.

Memory Card

A Questions-and-Answers (Q&A) Memory Card was created, containing answers to typical questions asked by participants during the training sessions, such as “Why is the training on data ownership, confidentiality, and security being offered now?” The Q&A Memory Card was distributed at the end of each session for use by the attendees and for sharing with their co-workers. The Q&A Memory Card is presented in the Supplementary Material S2.

Training Evaluation Form

To assess pre-training knowledge, needs for training improvement and to understand challenges in maintaining DOCS principles, at the beginning and at the end of each session the SLED Team distributed a Training Evaluation Forms (Form). Completing the Form was voluntary and anonymous. The Form contains questions such as whether the presenter was engaging and easy to follow, or if the attendee would be able to maintain DOCS principles, and, if not, what were their challenges in maintaining DOCS. A template of the Training Evaluation Form is in Supplementary Material S3.

Training Report

After each DOCS session, one of the team members developed a training report that included date, place, and duration of the training, name of the organization, description of the attendees’ occupations, the questions asked and answers provided, and participants feedback and comments. These reports were used to identify gaps in knowledge, the need for data protection infrastructure, and to improve training delivery. A template of the Training report is in Supplementary Material S4.

Tracking System

A tracking system was created to keep records of completed DOCS training sessions and for planning purposes. The tracking system captures the following data elements: contact person name and email, requesting organization, address, and time of the training, planned and actual number of attendees, attendees’ occupation, and comments.

Training Under COVID-19 Circumstances

Each training was conducted following COVID-19 precautions, such as social distancing and wearing masks. Online training to the attendees in the distant districts was conducted at the early stage of epidemic.

Results

By October 2023, the SLED Team trained more than 2,500 healthcare workers and COVID-19 responders. The DOCS training was conducted as a part of the MoH, CDC, WHO, UNICEF, African Field Epidemiology Network (AFENET), and other organizations’ trainings or workshops. The number of participants varied from 7 to 110, and included district medical officers, surveillance officers, data managers, laboratory sample collectors, and other healthcare workers and COVID-19 responders. All filled out pre-training evaluation forms (n = 468) indicated low or no knowledge of the DOCS principles with comments such as “No knowledge in data security and confidentiality” or “I have been uncertain about how to securely share sensitive data with colleagues.”

In 33% (372 out of 1,110) of post-training evaluation forms, participants noted that they would like to have a follow-up training and gain more knowledge of DOCS. At each session, attendees expressed interest in the topic and initiated discussions about their ability and challenges to maintain the DOCS principles. These discussions led to development of the Q&A Memory Card and the Evaluation Form with a goal to assess major challenges.

Multiple concerns were expressed by the participants. Data ownership was a difficult concept for participants to understand, some believed that everyone working with data should be a data owner. Many participants described their challenges with electronic data security, from difficulties with memorizing changing passwords to the lack of secure file transfer protocols or encryption for safe data transfer. Physical security was also a challenge in some settings, such as no locked cabinets for the hard copies. Some participants were concerned that their supervisors may not be aware of the DOCS principles and may not appreciate their data security protection efforts.

Although no evaluation of the training impact on improving data confidentiality was conducted, many participants offered suggestions on improving and expanding the scope of the DOCS training program, such as refresher training sessions, national DOCS educational program for all healthcare workers, appointment of MoH data confidentiality officers, and inclusion of DOCS in educational curriculum.

Online training that initially was provided to attendees in the distant districts experienced frequent interruption due to poor internet connection and other technical issues. These factors, and the novelty of the software and of distant learning for most of the participants, resulted in the loss of motivation and cancellation of online session. In these cases, instructors who were present in the training room switched to another training topic. As a result, online training was discontinued and only in-person training was provided.

Discussion

This work documents and underscores the need to promote awareness of data confidentiality and security throughout the COVID-19 pandemic in Sierra Leone and provides details of trainings on the principles of ownership of data, maintaining data confidentiality and security. Starting with the early days of the COVID-19 pandemic, the SLED Team was able to train over 2,500 COVID-19 responders. Participants appreciated the trainings as they had low knowledge on DOCS prior to the trainings. They were enthusiastic in their motivation to apply the principles of DOCS and recommended dissemination of the trainings to all healthcare workers in the country.

Maintaining PII confidentiality is mandated by the Constitution of Sierra Leone [14], however, as in many other African countries [13], the rules governing the protection of personal data and mechanisms for enforcing them are limited. In this digital age, vast amounts of patient data are captured electronically. Although electronic data has its advantages, it also poses the challenge of maintaining its confidentiality. This challenge is more pronounced in responding to healthcare emergencies, such as Ebola Virus Disease or COVID-19. Previous studies [15, 16] have extensively described patients’ concerns about unauthorized information disclosure. Having knowledge of these concerns and the DOCS principles is critical for healthcare workers.

The DOCS training program presents a solution to build an awareness of the responsible use of personal data to serve the essential need for data sharing. More efforts should be directed to implementation of these principles in the healthcare data managing practice.

Author Contributions

JK: Conceptualization, project administration, supervision, writing–review and editing; MV: Conceptualization, project administration, supervision, writing–review and editing; BB: Data analysis, methodology, project administration, validation, writing–original draft, writing–review and editing; KD: Data analysis, validation, writing–original draft, writing–review and editing; YG: Conceptualization, data analysis, methodology, project administration, supervision, validation, writing–original draft, writing–review and editing; MF: Project administration, supervision, writing–review and editing; JH: Data analysis, methodology, project administration, validation, writing–original draft; EI: Methodology, project administration, supervision, writing–review and editing; AJ: Conceptualization, methodology, supervision, writing–review and editing; MK: Data analysis, methodology, project administration, validation, writing–original draft, writing–review and editing; DK: Conceptualization, methodology, validation, writing–original draft, writing–review and editing; DM: Conceptualization, project administration, supervision, writing–review and editing; TS: Conceptualization, project administration, supervision, writing–review and editing; JR: Conceptualization, methodology, validation, writing–review and editing. All authors contributed to the article and approved the submitted version.

Funding

The author(s) declare that no financial support was received for the research, authorship, and/or publication of this article.

Conflict of Interest

The authors declare that they do not have any conflicts of interest.

Supplementary Material

The Supplementary Material for this article can be found online at: https://www.ssph-journal.org/articles/10.3389/phrs.2024.1607540/full#supplementary-material

References