Collaboration and Trust in Healthcare Innovation ... - Semantic Scholar

Computer Supported Cooperative Work (2005) 14:369–398 DOI 10.1007/s10606-005-9001-0

Springer 2005

Collaboration and Trust in Healthcare Innovation: The eDiaMoND Case Study MARINA JIROTKA1, ROB PROCTER2, MARK HARTSWOOD2, ROGER SLACK2, ANDREW SIMPSON1, CATELIJNE COOPMANS3, CHRIS HINDS1 & ALEX VOSS2 1

Oxford University Computing Laboratory, Oxford, UK; 2School of Informatics, University of Edinburgh, Edinburgh, UK; 3Tanaka Business School, Imperial College, London, UK Abstract. This paper presents findings from an investigation into requirements for collaboration in e-Science in the context of eDiaMoND, a Grid-enabled prototype system intended in part to support breast cancer screening. Detailed studies based on ethnographic fieldwork reveal the importance of accountability and visibility of work for trust and for the various forms of ‘practical ethical action’ in which clinicians are seen to routinely engage in this setting. We discuss the implications of our findings, specifically for the prospect of using distributed screening to make more effective use of scarce clinical skills and, more generally, for realising the Grid’s potential for sharing data within and across institutions. Understanding how to afford trust and to provide adequate support for ethical concerns relating to the handling of sensitive data is a particular challenge for e-Health systems and for e-Science in general. Future e-Health and eScience systems will need to be compatible with the ways in which trust is achieved, and practical ethical actions are realised and embedded within work practices. Key words: collaboration, trust, healthcare, grid, breast-screening

1. Introduction The ‘e-Science’ vision is widely represented as a revolutionary shift in the way that scientific research is undertaken. It has emerged at a time when research practices that adhere to conventional disciplinary and organisational boundaries are increasingly recognised as being inadequate for meeting new research challenges. According to the e-Science vision, the solution lies in large scale, collaborative and multidisciplinary research that, in turn, calls for the development of more powerful computer-based research infrastructures. John Taylor, former Director General of Research Councils in the UK Office of Science and Technology, expresses the vision thus: ‘‘e-Science is about global collaboration in key areas of science and the next generation of infrastructure that will enable it’’ (Taylor, 2001). The e-Science vision is not only concerned with changing ‘the dynamic in which science is undertaken’ (ibid) but also with enabling the emergence of

370

marina jirotka et al.

new forms of science by developing technologies that support resource sharing amongst dynamic collections of individuals, institutions and systems, so-called ‘virtual organisations’ (Foster and Kesselman, 2004). The ‘Grid’,1 the technological infrastructure for e-Science, is not just a next generation Internet; it promises to erode the divide between scientific work, which is primarily done offline and scientific communication (Caldas, 2003). If e-Science is about providing researchers with on-demand access to distributed computing resources and data, and tools for distributed, large scale collaboration, this quantitative difference is expected to give rise to a qualitative one as well: science can tackle more complex problems and ask bigger questions, involving more than one scientific discipline or, as in the case study presented here, crossing the divide between research and clinical practice. It is important at this stage to remember that e-Science exists first and foremost as a powerful grand vision. As with all grand visions, tensions between the ambition to make e-Science the new paradigm for knowledge creation and the on-the-ground experience of those confronted with that vision, or trying to translate it into a workable reality, are to be expected.2 Thus, supporting collaboration on the scale envisaged by e-Science presents a number of challenges, not least for requirements engineering. Among these challenges are the development of a thorough understanding of the character of interdisciplinary work, the contexts in which scientific data is generated and used, and how data may be usefully and ethically presented and shared across scientific disciplines, both nationally and world wide. Because, at its heart, e-Science is about collaborative endeavour, we would argue that the insights and analytic perspectives of CSCW have much to say about whether – or to what extent – the e-Science vision is realisable and, if so, how. In this paper, we report on eDiaMoND, a flagship UK e-Science project that aims to develop a prototype of a national grid-based infrastructure to support digital mammography. As part of our involvement in requirements gathering for eDiaMoND, we have identified a number of collaborative practices, which play a part in the generation and the maintenance of trust relationships (between people, but also in relation to processes and artefacts), and in ensuring that health care delivery is done in an ethical way. We discuss the implications of these practices for eDiaMoND, for the requirements gathering process, and for the success of grid-based innovations in e-Health. Finally, we draw out implications for the e-Science vision more generally.

2. The NHS Breast Screening Programme and the eDiaMoND Vision 2.1.

MOTIVATION

Currently, one in nine women in Britain will develop breast cancer in their lifetime (Boseley, 2004). To provide early detection, the UK National Health

THE EDIAMOND CASE STUDY

371

Service (NHS) runs a Breast Screening Programme where women between the ages of 50 and 64 are invited for screening every 3 years. The NHS Breast Screening Programme (NHSBSP) began in 1988 and currently there are approximately 100 Breast Care Units (BCUs) each with an average catchment area of 45,000 women. The screening test is by mammography, where one or more X-ray films of each breast (called mammograms) are taken and examined for signs of abnormality by trained film readers3 (Figure 1). If suspicious features are evident, then the woman is called (‘recalled’) for further tests at an assessment clinic. Potential abnormalities include lesions of differing types, asymmetry between breasts and changes in breast tissue visible over time. Readers can often reach a decision on each case (which may involve reading 4 or more mammograms) in 15 seconds or less, although the degree of scrutiny given will depend on the particular characteristics of the case at hand – some mammograms are more difficult to interpret than others. To improve accuracy, it is common practice for cases to be ‘double read’, i.e., examined independently by two readers. Suspicious cases are recalled for further diagnostic tests. The objective of screening is to recall as many cancer cases as possible (high sensitivity) while recalling as few non-cancer cases as possible (high specificity). Around 1.5 million women are screened every year in the UK. At present, the NHSBSP relies almost entirely on the use of film (although some private hospitals and symptomatic clinics are exploring full field digital systems). In common with paper-based medical records, dependence on film presents a number of practical difficulties in terms of the accessibility, tractability and security of screening cases. The programme is currently undergoing a process of expansion, whereby the upper age limit at which women are screened is extended from 64 to 70, and 2 views of their breasts are taken at each (3-yearly) visit. This will result in 6 million mammograms being taken every

Figure 1. Shows a mammogram as it would be presented to readers on screen.

372


year, with a projected increase in workload of 50%, precisely at a time where there is also a reported shortage of readers (Geldman, 2002). 2.2.

THE EDIAMOND PILOT SYSTEM

eDiaMoND is an ambitious 2 year flagship pilot e-Science project of £4.1 m funded through EPSRC/DTI and IBM SUR4 grants. The project team is made up of academic and industrial collaborators over 12 sites. The aim of eDiaMoND is to demonstrate the value of grid technology to the NHS. To this end the project is building a grid-enabled, federated database of annotated, digitised mammograms and patient information, which will be piloted at four participating UK screening centres (Power et al., 2004). A number of prototype grid-enabled applications have also been developed to demonstrate how the database architecture can support screening work, radiologist training (Soutter et al., 2003) and epidemiological studies. The database will also be used for computer science research, including the development and evaluation of image analysis algorithms, search mechanisms for data mining, and image standardisation techniques. The eDiaMoND database embodies the e-Science vision of encouraging innovative approaches to research by enabling data generated at screening to be shared between a variety of disciplines (radiology practice and training, epidemiology and breast imaging) and made available to the whole breast care community, regardless of where or how it was generated. The project had three objectives, which can be stated thus: • The development of a Grid infrastructure to support the secure federation of images and patient data. • The design and construction of an appropriate database structure, together with the development of appropriate data mining tools. • The development of a number of end-user applications to validate the system. Technologically, the system realised the concept of a data grid. The concept of grid computing (Foster and Kesselman, 2004) is concerned with performing operations that span administrative domains. One can, then, think of a grid as the coming together of these independent organisations in the form of a virtual organisation. The core e-DiaMoND pilot system consists of middleware and a virtualised medical image store to support the eDiaMoND data grid concept. The virtualised image store consists of physical databases, each owned by a BCU participating in the eDiaMoND grid. The eDiaMoND grid forms from participating BCUs coming together as a virtual organisation that unites their individual databases as a single logical resource.


373

The key functions of e-DiaMoND are: • Image acquisition. This is the process of inputting X-ray mammograms into the system. A radiologist at the image capture workstation takes scanned X-ray films and adds patient information. Together, these are passed to the eDiaMoND grid. • Query. For example: an administrator may query data in the system to set up a reading session as part of the screening process; a radiologist may make ad hoc queries in screening, or in constructing sets of images suitable as training cases; or an epidemiologist may construct complex long-running queries that run across the entire archive. • Image retrieval. This is the retrieval from the grid of specified image files and reports. • Diagnosis reports. The system captures and manages reports made by radiologists during screening. • Image processing. This covers processes that categorise or manipulate the image data in support of data mining and Computer Aided Detection (CADe) services in the grid. All of the above functions have been implemented in a grid that allows BCUs to collaborate with each other but maintain individual policies on how data, for which they are responsible, is distributed and shared. The eDiaMoND grid allows BCUs to form a virtual organisation for breast screening without requiring any central authority or centralised IT resources. The manifestation of the eDiaMoND system as a grid should allow new techniques to be incorporated as additional services in the grid using open, standard interfaces (Figure 2).

Figure 2. Architecture overview for eDiaMoND showing connectivity of systems hosted at remote sites.

374 2.3.

marina jirotka et al. REQUIREMENTS FOR EDIAMOND AND BREAST SCREENING WORK PRACTICE

Digital technologies in general are beginning to transform medical record keeping, diagnosis, access to healthcare and, indeed, the nature of the consultation itself (Heath et al., 2003). Progress has often been painfully slow, however, and the longstanding problems associated with capturing requirements for e-Health and for the digitisation of data have been compared to ‘building a bridge across the Atlantic’ (cited in Heath et al., ibid). The eDiaMoND project may be viewed as an exercise in understanding this process of transformation, by investigating how Grid technologies can assist in the delivery of healthcare. In order to develop this understanding, we have been conducting a comprehensive requirements gathering exercise. As part of this, we drew on detailed analysis of work practices in screening (Hartswood and Procter, 2000; Hartswood et al., 2002, 2003a, b) and conducted further ethnographic studies (Anderson, 1994; Hughes et al., 1994) of work practices in a number of BCUs (Hinds and Coopmans, 2003). The aim of these studies was to observe in detail everyday working practices and to explicate the numerous, situated ways in which those practices are actually achieved. We also conducted quasi-naturalistic evaluations of prototype workstations with clinicians, in situ where possible (Jirotka, 2003). Clinicians also participated in design meetings and discussions, intended both to elicit their views on the vision of eDiaMoND, and also to aid our understanding of the current process of breast screening. Whilst these studies presented valuable information, they also raised tensions for us in our role as requirements engineers (Hartswood et al., 2005). Transforming the mammogram from a physical piece of film into a digital artefact, raised the possibilities of instant access, rapid exchange, and seamlessly distributed working. Indeed, one of eDiaMoND’s visions sought to use this digital mobility to share the workload between BCUs, sending cases to BCUs where the workload is less heavy or where readers are more experienced. In this sense, eDiaMoND promised to provide a solution to the NHSBSP’s forecast increase in workload. However, these grand visions of seamless distributed sharing, in common with the e-Science vision more generally, were often rendered more problematic when seen in relation to observations of local practice. In our role as requirements engineers we attempted to both identify and resolve these concerns, highlighting where initial technological proposals may be problematic, and shaping alternative forms that might better fit with existing work practices. Sometimes the concerns encountered resonated with similar findings from research in CSCW. For example, there were many informal ways in which expertise was shared within the domain and discussions centred around how the technology could support this informality. However, other concerns that emerged were less familiar yet critical to the achievement of screening in the


375

domain. In particular, one such area that seemed fundamental was the issue of trust. Concerns were raised both about how trust operates in the everyday work of the BCUs as a practical accomplishment, and how data could be shared in ways that are deemed to be ethical, that is, who could properly have access to what data and for what purposes. These concerns related to data shared within and between BCUs as well as more generally across the different applications of the intended eDiaMoND system. 3. Trust Understanding trust – whether it be trust in technology or interpersonal trust – and how new computer systems may impact on existing trust relations is, we argue, critical for the realisation of the e-Science vision. To believe, for example, that the inhibitors to the wider sharing of data and the realisation of collaborative research are only technical, is manifestly wrong. Unfortunately, present approaches to understanding trust in technology and interpersonal trust alike take too narrow a view of this important issue. For computer system designers, the notion of trust is often reduced merely to issues relating to security; indeed security policies are sometimes referred to as trust models (Schneier, 2000). Furthermore, security is generally seen as a non-functional requirement and, as such, presents difficulties for integration into the software development process. According to Giorgini et al. (2004), security mechanisms are often made to fit into a pre-existing design, leading to conflicts between potential functional and usability requirements. Software implementations often either assume relations of trust between users and between users and systems that do not exist or develop protection mechanisms that obstruct the effective use of the system and the activities it is supposed to support. While recent work in e-Commerce has broadened the notion of trust (Jones, 2000), most designers concerned with understanding and modelling security and trust requirements have continued to view trust in system-oriented terms (Giorgini et al., 2004), resulting in security policies and access controls that take little or no account of organisational trust relationships. In summary, current approaches to computer system design and development offer an incomplete understanding of security and trust related issues, and overall do not resolve them early enough in the development process (Tryfonas et al., 2001). Elsewhere, we have argued that if technology is to be useful and useable, this narrow technical orientation to trust needs to be supplemented with a thoroughgoing understanding of its social and organisational dimensions. A consideration of these dimensions of trust bears on both trust in technology and on interpersonal trust. With regard to trust in technology, it is important to attend to the ‘work’ of making systems ‘trustable’. We have shown that what it is for a system to be trustable is, in part, the achievement of those who

376


use it: this includes issues such as workarounds, tolerance of security and similar policies (as well as trusting that those policies will be enforced), and the development of a ‘biographical’ appreciation of the system and its policies as these appear to particular groups of users (Voss et al., 2002; Voss et al., in press). Such a focus on the practical work involved in achieving trust also enables us to understand the role of interpersonal trust and how this is accomplished and maintained in actual work settings, issues which, as Luhmann has observed, are largely ignored in more formal approaches to the study of interpersonal trust (Luhmann, 2000). We use our investigation of requirements for the eDiaMoND system to illuminate these issues. In looking at ‘trust in practice’ rather than ‘trust in theory’, our investigation sets out to follow up the implications of Luhmann’s observation. Our approach to trust shares some characteristics with work in the sociology of scientific knowledge (SSK), particularly in its focus on epistemological trust, which refers to the role of trust in the production and maintenance of valued knowledge (Shapin, 1994; Van House, 2002). For Shapin, trust is the basis on which ‘we credit others’ relations and take their accounts into our stock of knowledge about the world’ (1994, p. 8) Van House’s work on practices of trust in the sharing of data through digital libraries is particularly relevant in this respect. She argues that ‘networking allows information to cross social and technical boundaries that have provided the context of assessing its credibility and meaning, throwing into relief practices of trust’, (Van House, 2002, p. 100). The question of how to determine who and what is credible or trustworthy is given specific visibility and emphasis in the face of a technological intervention such as the eDiaMoND system. Related work in SSK provides a number of examples of the growth and development of trust that have certain implications for our consideration of trust within the breast screening centres. Both Price (1963) and Crane (1972) employ the term ‘invisible colleges’ in their studies of communication within and across disciplinary areas that are a means of sharing information within a disciplinary area. And in particular Zuccala’s (2005) notion of multifaceted communication and information exchange is cognate with the ways that trust is achieved within the context of breast screening work, and we will return to this issue below. Drawing upon this work, we explore clinicians’ work practices in relation to the potential of a Grid-enabled digital mammography system to support a set of clinical practices and research in breast care. We examine the ways in which trust is achieved in the BCU. We see how it depends, in part, on participants’ knowledge of their colleagues’ performance and how it forms part of the work practices through which artefacts are produced and decisions are made. Drawing on this understanding of the ways in which trust is produced and maintained in breast screening work, we discuss what impact a


377

system like eDiaMoND might have on relations of trust and thus, on the dependability of the work. That is, if breast screening work becomes a ‘virtual’ activity, such that the production of mammograms and their reading are no longer physically co-located, and reading itself involves distributed actors, what are the likely implications and how might they be addressed? Finally, we consider the implications for the deployment of Grid-based systems in healthcare environments and the success of the wider ambitions of e-Science. We begin our examination of trust in practice by looking at how data is shared within individual BCUs. 4. Sharing Data Within the BCU In this section, we focus on the administrative work practices that occur within individual BCUs and describe some of the processes through which data may be shared amongst different participants in order to support a clinical decision. The details of these practices are considered in the context of transforming the physical film to a digital artefact. The difference in mobility between digital and physical artefacts is of particular relevance to clinicians’ practices in quite specific ways. For example, it is common for junior members of the BCU administrative team to carry out mundane tasks with patient records such as booking appointments. The data they handle is personal and sensitive and thus must be treated in particular ways in order to conform to what is seen to be ethical. The work of manipulating physical artefacts, in this case patient records, provides a natural, locally visible account of itself; that is to say, there is a visible pattern to the activity of booking appointments that can be overseen by others in the domain. The ability to arrange the visibility of these accounts provides for a great deal of flexibility in the management of ethical concerns, for example, to give someone an unfamiliar task, yet arrange the environment to afford a greater degree of scrutiny, enables trust to develop between individuals in a flexible way. The introduction of systems for working with digital artefacts raises significant issues for this type of conduct, because the visibility – and hence accountability – of work is transformed. Interactions with the digital artefact on a computer system may be much harder to discriminate at the local level and a consequence may be that different organisational structures have to be put in place in order to manage such activities. Another aspect of current practice that plays a part in making work visible and accountable is the use of ‘tracking’ sheets (Coopmans, forthcoming). BCUs normally deal with mammograms in ‘batches’, whereby a batch usually represents half a day’s work of screening in any one mobile or static screening facility. A tracking sheet accompanies each batch on its way through the BCU, from the place where mammograms are developed and

378


married with a woman’s previous dossier to the ‘reading room’ to the administrative area where the results are recorded (and result letters generated). Administrative staff, radiographic assistants and radiologists all fill in and sign off part of the tracking sheet, which thus serves as a record of actions completed but is also vital to ensure that, at various stages of the process, the numbers add up and all mammograms are accounted for. If a case has gone missing, radiographic assistants can work out where things went wrong and who is responsible by comparing the tracking sheet with the clinic list that shows all the appointments for the day. Computer-based systems offer all kinds of possibilities for tracking and indeed, one of the promises of such systems is that the whereabouts of any individual set of mammograms can continuously be monitored. However, the structure of claiming responsibility and signing off some parts of the work will also need to be replicated in some way. To put this in a more general way, it is necessary to be sensitive to the dynamic nature of the BCU in respect of the ‘safety culture’ that is built around ‘open access’ to information (Hartswood and Procter, 2000). Although ‘practical ethical action’ may often be seen as mundane by those clinicians who work in such a way on a day-to-day basis, it represents a series of complex and situated practices which are of crucial importance for a requirements gathering exercise like the one for eDiaMoND, but are hard to capture in a formal, static access control matrix. By ‘practical ethical action’, we refer to the situated professional decisions made by BCU that some action is ethically appropriate in the context of their duty of care, and their legal and professional obligations. We seek to convey the idea that what constitutes appropriate conduct in the use of health care data depends upon the situated judgments of health care professionals. Adherence to the ‘rules’ governing conduct (as laid out in codes of practice, legislation and so on) is a practical problem – neither can the rules of conduct be made sufficiently detailed as to ensure every eventuality is covered, nor can all eventualities be guaranteed to afford their (the rules’) unambiguous application, or indeed, be free from conflicting obligations. Thus, it is incumbent on health care professionals to work out what is appropriate or ethical conduct in each contingently arising circumstance with which they have to deal. For example, a woman’s mammograms will be examined by readers at the BCU where they were taken and, in general, it is not considered ethical for mammograms to be shown to anyone outside of that environment. There are, however, exceptions: an unusual case may prompt a reader to show a mammogram to a visiting expert and this will be considered ethical. The reader thus demonstrates his or her professional autonomy in making situated judgements about the appropriateness of the involvement of a colleague that turn upon shared professional obligations to confidentiality, and judgements about the clinical interests of the patient. So, in deciding whether an


379

action is ethical or not one must consider, not just what data is being accessed, or who is accessing it, but why it is being accessed. It is the semantics of the operation that are important, that an action is ‘in the patient’s clinical interest’, or that those party to the action are eligible to be involved.

5. Sharing Data Across BCUs The eDiaMoND screening application is designed to facilitate the rapid movement of mammograms and patient related data between BCUs. This may be useful for transferring data from one BCU to another when a patient moves around the country. However, it also offers potential advantages to readers in their screening work. As stated previously, current practice is for each case to be read independently by two readers. During times of heavy workload, the eDiaMoND system could enable readers to send cases to colleagues in other BCUs to perform the second reading. Indeed, one of the more visionary possibilities would be remote, ‘distributed reading’, where the eDiaMoND system would manage the reading of batches of mammograms, allocating them to wherever there may be spare reading capacity. This would have the major benefit of maximising the use of scarce skills. In relation to distributed reading, our detailed analysis of the work of readers and of BCUs indicates that this may not be so easily achieved. A significant feature of reading as currently practiced is the way readers achieve and draw upon a ‘biographical familiarity’ with colleagues, procedures and the technologies employed in the production of mammograms in the centres in which they work (Hartswood et al., 2002, 2003a). By ‘biographical familiarity’, we mean the fine grained understandings that readers acquire over time that enable them to make sense of the artefacts and information they have at their disposal for making decisions. A rough distinction can be drawn between biographical familiarity with artefacts and processes on the one hand, and readers’ own performance and the performance of colleagues on the other. To illustrate the notion of biographical familiarity, these are discussed separately below.

5.1.

ARTEFACTS AND PROCESSES

The process of screening, from the production of mammograms to a screening decision being made, is a complex one, involving the application of several technologies and the concerted efforts of skilled staff. In this section, we discuss how the interpretation of mammograms turns in part on readers’ understandings of this process, firstly by giving a brief description of the process itself.

380


Blank films are loaded into a cassette that has a phosphor screen, which fluoresces when illuminated by X-rays to produce an image on the film. Sometimes this is done manually in a darkroom, but more often by using automated film loaders. A radiographer will ‘take’ the mammogram by loading the cassette into an X-ray set, positioning the women on the machine, applying compression to the breast and selecting an exposure setting. A considerable part of the radiographer’s skill lies in adjusting position, compression and exposure in order to cater for the wide variations in the physiology of the women screened to produce technically acceptable or ‘diagnostic’ mammograms. Typically, a BCU will have more than one X-ray set, as well as sets on each of the mobile screening units. These sets often differ in their manufacturer and model, and radiographers often express preferences for one over another. A BCU will typically use only one type of film at any one time, selected from a range of alternatives from different manufactures, and each having a ‘characteristic’ performance. Once a mammogram has been taken, it is then developed using a film processor. Skill is required to obtain an even performance from the processor over the course of a day’s processing, and between subsequent days screening after the processor has been idle overnight. Different screening centres may use different models of processor and developing chemistry, which again have their own performance characteristics. Mammograms may be fed into the processor individually (from cassettes) or as a batch from a cartridge of exposed films taken on a mobile unit. Once the mammograms have been developed, they are ‘marked up’ with labels indicating the screening round, and may be checked for technical quality. They are then married with the screening records, and mounted on viewers for reading in batches corresponding to contiguous screening sessions. Tests are routinely performed on X-ray sets and film processors to ensure that they are operating within quality assurance standards. Even so, particular combinations of film, processing chemistry and X-ray sets combine to produce films that have distinctive properties (contrast, brightness and so on) that are specific to the lifetime of that combination within any given centre. When mammograms are read, this is done in light of readers’ understandings of both the principles of mammogram production (how an image of a breast is produced on a film using X-rays) as well as the specific local practices within a BCU (for example, the actual X-ray sets, processing systems, film types and procedures used). In this way, readers are able to discriminate between appearances that are ‘artefacts’ of the screening process and those that are indicative of some change within the breast itself. The following example illustrates this point:5 In screening, current round films are examined alongside prior films to check for significant changes during the screening interval. At one centre studied, prior films from 2 screening intervals ago are mounted to further


381

accentuate any changes. In this centre, one reader was observed to retrieve the most recent previous films for a case where she had discovered a focal increase in density. She could detect no change between the more recent previous films and the current films, and concluded that the apparent increase in density was due to a ‘whiter film’. The reader’s understanding of the sorts of variations that can occur in mammogram production are sufficient to account for an observable increase in density between screening rounds. The specificity of a local combination of technologies and practices is particularly in evidence where a woman has moved between screening regions, and prior mammograms have been obtained from the original BCU, as the following two examples show. In these examples, two different readers commented on a two different case where the previous films originated from a different BCU: Example 1: ‘‘Films from different centres can be a problem, different compression and technique can mean films can look strikingly different’’. Example 2: ‘‘This looks like normal breast tissue shadowing but there is nothing resembling it on the previous films. The previous films are not from this screening centre – perhaps that’s why they look so different’’. Here, the reader orients to differences (between BCUs) owing to the practices associated with the taking of mammograms by the radiographer. It is interesting to note that it is common practice for radiographers to be identified as having taken a particular mammogram by an identification number on the film itself. The X-ray set and its location (whether from a static or which mobile unit) are similarly identified. In this way the ‘biography’ of the mammogram is partially transparent to the reader (who themselves would not have been party to the mammogram’s production) as part of the routine work of reading. It is also important to note that any sense attached to these identifiers can only easily be achieved within the BCU where they are produced, because the coding schemes have a locally understood relevance – knowing that a code refers to a mobile unit, or a radiographer, and knowing something about that mobile’s or radiographer’s performance. Also, it is only within the local BCU that many examples are actually seen of mammograms taken by a particular radiographer, or on a particular mobile, as a part of forming that sense. In the second example, the reader orients to the production of the mammograms from a different BCU as a source of the difference in appearance between the current and prior mammograms. This example is interesting because the reader was not satisfied that this explanation sufficiently accounted for the difference, and decided to recall the case for further investigation. Thus, while in some cases readers feel quite comfortable attributing a suspicious appearance to the specificities of

382


(or differences in) production, sometimes they do not, and we might speculate that without some reference as to what films from this BCU ‘normally’ look like, there may be some difficulty in making this judgement. One set of circumstances where readers routinely encounter films from another BCU occurs when they are participating in an experiment designed to measure reader performance, or, as in the case of the following example, to evaluate the performance of a decision-aid. It is commonplace in such experiments for readers to find fault with the technical quality of the presented films: ‘‘Now, this is technically er not really acceptable, obviously got a bit of the back of the breast missing, this is slightly blurred, you obviously didn’t get this film from [centre], this cannot be [centre] films’’. So again, although ‘technical acceptability’ is to an extent specified in quality control standards, how these are implemented in practice may vary between BCUs, leading to different ‘thresholds’ for judging mammograms to be diagnostically acceptable. In a similar way, there is some leeway in how processing chemistry and film combinations might be adjusted to meet local clinical aims, as one reader remarks: ‘‘It would be interesting to see how well we pick up lesions like that, now we’ve changed our technique recently, whereby we try and make the films blacker to penetrate the breast more’’. Here, the reader is orienting to how the production of mammograms has been manipulated within her BCU to produce particular characteristics in order to meet specific clinical goals. So not only may mammograms from particular BCUs have a characteristic appearance, but also that characteristic appearance can be purposefully contrived in response to (perhaps local) clinical goals and priorities. Thus readers’ biographical familiarity extends beyond a routine working understanding of the local production practices and technologies to include historical understandings of the reasons why those technologies and practices have been configured in particular ways to meet particular clinical goals.

5.2.

PERFORMANCE

Readers also exhibit a biographical familiarity, of both their own and their colleagues’ performance (Hartswood et al., 2002). By working together, readers come to know their own and each other’s strengths and weaknesses – in one BCU, a reader is referred to as ‘the calcium king’ because of his ability to detect calcifications; a member of another BCU is referred to as ‘Mrs Blobby’ because of her ability to detect lesions in dense areas. These


383

understandings are achieved diachronically as part of normal screening work: in assessment clinics, where further tests are conducted as part of the recall process, readers can see what their decisions amounted to in practice and double reading affords opportunities for readers to compare their decisions with those of their colleagues for the same set of cases. The collaborative practices underpinning double reading are worthy of particular note (see Hartswood et al., 2002, 2003a). In earlier studies, we observed that when readers annotate the screening form, they not only indicate suspicious lesions they have recalled, but also frequently mark benign, but noteworthy appearances – and sometimes furnish reasons why a recall might not be appropriate. Because the second reader typically marks their decision on the same screening form as the first reader, double reading is seldom strictly ‘blind’; that is, the first reader’s annotation is available to the second reader. The second reader may then also annotate the form, either in relation to something they themselves find noteworthy, or to give their opinion on the first reader’s candidate diagnosis. We have shown elsewhere (Hartswood et al., 2002) that use of annotations in this way provides a means for readers to continually re-establish their intersubjective understandings of where to maintain the recall threshold. In other words, the practice of double reading contributes to the emergence and maintenance of a shared sense about what sorts of presentations can appropriately be recalled. This is important because although BCUs strive to achieve a high cancer detection rate, they have at the same to maintain the recall rate at a level that does not overwhelm assessment clinics, or result in the recall of women unnecessarily. BCUs may operate a policy of ‘worst opinion recalls’ but, more commonly, disagreements between readers are arbitrated by a third reader, or by discussion. The use of annotations shows how local visibility arrangements provide for an informal mechanism for readers to manage the specificity of the BCU as a whole. The visibility of readers’ decisions also serves to alert readers to occasions where colleagues are not aligned with a local understanding about what constitutes an appropriately recallable presentation. To give an example, in one BCU studied, a reader had joined the BCU having previously worked elsewhere. This reader was seen by colleagues to recall too many instances of a particular feature; the reader was not formally rebuked for this but informally told that the BCU in which they were now working did not recall ‘that number’ of such features. In a sense, then, the reader was socialised into the ways of seeing at the BCU by being made aware of what was and was not an acceptable recall rate for the feature at hand. What it is to be a reader is a situated matter, and trust between readers turns upon a diachronically achieved biographical familiarity with colleagues’ performance which is, itself, dependant on the sorts of informal practices and visibility arrangements described above. These kinds of interactions serve to

384


socialise BCU members into ways of seeing that are constitutive of local priorities and constraints, enabling them to function cohesively as a team. 5.3.

TRUST AND BIOGRAPHICAL FAMILIARITY

Trust and biographical familiarity are intimately related. It is not so much that readers come to trust that with which they are familiar but, rather, their familiarity enables judgements to be made about the circumstances in which something (a decision, an artefact or some piece of information) might be more or less reliable (cf. Sacks, 1972; Goodwin, 1994). Thus biographical familiarity might be said to be a predicate for trust. Although there are formal guidelines for quality, which would, in principle, allow for professional judgement of any mammogram, our observations show that readers’ familiarity with other BCUs impacts significantly on their inclination to trust what is and can be seen. An example might be useful here: in one observation, a woman had returned to her local BCU after being screened in a clinic that was not a part of the NHSBSP. Readers noted that they would not have accepted the mammograms made by the non NHSBSP clinic (as is common policy) but, given that clinic’s procedure (which were known to the local BSU), the mammograms were expectably as they were and therefore acceptable. To know one’s colleagues (even if they work in other BCUs) and to know how mammograms are produced in that BCU as well as one’s own is, then, an important precondition for trustable reading to take place as the arrangements for reading are currently configured in the NHSBSP. Our analysis in this paper has focussed on the trust relations between colleagues and equipment within individual BCUs. It might be argued that because of this we privilege local considerations over the need for individual BCUs to function adequately within the context of the screening programme as a whole. Our account of how members of screening centres achieve intersubjective understandings as to what counts as recallable, or interpret films in the light of local configurations of equipment and processes, may inadvertently give the impression that local centres are somehow untethered and adrift, and able to make whatever decisions they like as long as they maintain an internal coherence. This perception might be heightened by our analytic indifference to the appropriateness or quality of locally instantiated practices, for example, centres contriving configurations that assist with the detection of particular sorts of lesions. There are a number of important points to be made in relation to these issues. Firstly, local practice is both disputable and disputed, and these disputations are the province of those working within the breast screening service, and not the sociologists who study them. Secondly, while change in procedure, or orientation of BCU members to particular goals may appear


385

arbitrary, this is in part an artefact of our glossing over the way that these decisions are made. When we report that different BCUs orient to different priorities and instantiate these with alternate configurations of equipment and practices, this does not mean to say that they are out of kilter with the wider aims, objectives and practices of the screening service as a whole. BCUs are constrained to work with the resources they have to hand – the skill and expertise of the readers, the equipment, finances and the screening population (to give a few examples) will be specific to individual BCUs. The ability of a BCU to meet the objectives of the screening service (in terms of complying with policy, providing care that accords with accepted best practice, and so on) depends on finding working local configurations of available resources, leading inevitably to heterogeneity in practice between units, but not necessarily to wide divergences in performance. A further complication lies with the character of the screening test itself, which does not provide a cut-anddried indication of cancers. Some cancers will inevitably be missed at screening and (often difficult) decisions have to be made as to how to strike a balance between recalling women unnecessarily while detecting as many cancers as possible. While readers generally orient to providing a service that maximises both sensitivity and specificity, it is also open to readers to organise practice in a way that privileges the detection of certain categories of cancers whilst maintaining the same detection rate overall. Thus, ‘better’ performance is not necessarily only about ‘more’, but also about ‘what’; and again, quite what counts as ‘better’ performance in this context is properly a matter for those in the screening programme who are routinely engaged in considering the various implications of their own practical arrangements. Finally, we would note that BCUs do not practice in isolation. There are a whole host of more or less formal practices and arrangements that serve to foster intersubjective understandings between those working in different BCUs and within the service as a whole. Although not the principle topic of this paper, it is worth providing an illustrative sketch here. The more formal practices include various service wide quality assurance mechanisms, such as performance targets, training, audits and guidelines, as well as ‘peer review’ of performance (including annual reviews of ‘interval cancers’)6 and a voluntary (though with near universal compliance) annual assessment of reader performance. In addition there are a variety of informal means by which intersubjective understandings are established between BCUs that are consonant with the idea of ‘invisible colleges’. While it may not be the case that all readers have worked with e´minences grise in the field,7 in a number of cases readers trained with or knew colleagues from other BCUs or the practices at other BCUs (and made suggestions as to changes in procedure or practice based upon this knowledge). Readers also subscribe to various journals and contribute to debates both as authors and within the BCU itself.8

386


Approached in its fullest sense, the notion of ‘invisible colleges’ illuminates the professional activities of readers and the ways that they make these available to each other within and across BCUs. Collegiate ties between centres are formed and propagated through acquaintances made during training, at professional and scientific meetings, through shared research interests, visits to other centres (that may have both formal and informal aspects) and where readers work at more than one centre, either concurrently or serially. So, while in this paper we have focussed on trust as turning (in part) on an local intersubjectivity achieved through biographical familiarity with the performance of colleagues and artefacts, we also acknowledge that this is done in ways that attend to and reflect wider understandings of the priorities and concerns of the screening service as a whole. 6. Sharing Data Across Disciplines The vision for eDiaMoND encompasses not only sharing data across BCUs but also – and resonating with the e-Science vision – sharing data across different scientific disciplines. Indeed, the vision affords the potential to make data available to a larger community, regardless of where the data was generated or produced. In the case of eDiaMoND, the availability of a national mammogram database would not only be useful for health care professionals but also of great value to epidemiologists investigating and identifying the contributing factors to breast cancer. However, our observations again suggest that the potential for sharing epidemiological data amongst different scientific researchers is fraught with difficulties linked to epidemiologists’ orientation to ethical concerns. These concerns also relate to practical matters of trust in relation to their working more at a distance from the context of production of data. Medical or epidemiological studies rely on the collection of a large volume of sensitive data from patients. Within their daily practices, epidemiologists orient strongly to ethical practices in the collection and management of their data. To conduct an epidemiological study in the UK, ethical approval must be secured from a research ethics committee to ensure that studies comply with relevant ethical and legal guidelines such as the Human Rights Act 1998 and Data Protection Act 1998. These research ethics committees require that scientific investigators provide a specific research protocol for approval to be granted. Investigators must summarise in their case precisely how they will gather and analyse data and demonstrate (a) how that information will be used and (b) how it will benefit patient care. Critically, researchers must also demonstrate that they have secured individual patient consent for their data to be used in the proposed studies. Once ethical approval has been secured and patient consent obtained, the research data can be collected and stored. However, this does not mean that this data can now be used for new


387

purposes or indeed any purposes that were not identified in the research protocol. In a very real way, then, epidemiologists must be seen to be accountable to research committees, society and individual patients for the studies they undertake. Currently, there is great concern within the NHS about safeguarding patient confidentiality in the use of patient data for research. Anonymising data is considered to provide a greater protection for the patient. Data held locally on a secure system and accessible by only one or two named people may not have to be anonymised. However, wider availability of the data set would increase the risk that the data are used for studies, which go beyond the purposes specified in the research protocol. Thus, sharing these data sets for use by a national or even global research community demands that the data be anonymised. Anonymisation is necessary and can be achieved in a number of ways, for example: (a) there should be no trace from the data to the patient’s name and (b) there should be no trace from the patient’s name to the data. The nature of epidemiological research is such that each study has its own set of requirements and each may potentially collect different sets of data. Some core data does exist but is not in itself an effective catalogue, as typically (in order to investigate particular risk factors for disease) other data such as family history may be needed. If this is not available, then the core data is rendered useless for epidemiological purposes. In addition, over time, new factors may be explored as potentially contributing to breast cancer. In these situations, investigators may then apply for permission to have the anonymisation of their data broken and recover the link back to the NHS number of the patient in order to gather the new relevant data. Owing to the evolving nature of their work, epidemiologists cannot specify a complete set of data requirements that hold from study to study. There may be a core set of fixed data, but each study will also have individual data requirements. This set of data is a resource that individual researchers may spend many years constructing. That work in itself is increasingly recognised as part of the process by particular scientific journals that may require the publication of data sets in recognised databases (Dweck, 2003; Moreau et al., 2003). For epidemiologists, given the organisational context in which scientific publications and funding prevail, the amount of work put into generating the data means that they will probably wish to have completed their studies before sharing those data sets with other researchers through a mechanism of global availability. These issues of gaining patient consent, anonymisation of data and securing medical approval have proved very challenging for the eDiaMoND project. Fundamentally, there is little need for the eDiaMoND prototype to produce clinically valid results in the same way that an epidemiological study should. However, in order to be a useful system for the NHSBSP, the project needs to

388


demonstrate awareness of these ethical issues and how they might be dealt with in future production systems. In order to demonstrate the use of ‘real’ data collected at the four BCUs involved in the collaboration, the project has had to secure approval, not only from local research ethics committees for each hospital concerned but also – as data will be shared across different clinical sites – from a UK multi-centre research ethics committee. It has also been important to understand how matters of patient consent may impact on the eDiaMoND system. In order for any data to be processed (by which is meant manipulating the data in any way such as, anonymisation, digitisation, or entering into a database), patient consent must be obtained. In certain circumstances, implied consent is sufficient. This applies in cases where women have received leaflets or letters stating that their data will be used for training or research. By attending the screening session and having received the leaflet, it is taken that they are agreeing to their data being used for these purposes. However, as the nature of the information for mammograms is very sensitive, an implied consent may not sufficient and informed consent must be sought. Informed consent attempts to identify what each patient allows clinicians, and consequently the eDiaMoND system, to do with their personal information. There are various ways personal information may be used in the context of eDiaMoND: it can be recorded on the database; it can be used only at the clinical site where the information was acquired; it can be transferred across sites if it can be seen to be of clinical benefit; finally, it may also be used for epidemiological or training purposes. For these reasons, it has been important for us to study and understand in detail the data requirements of all the different parties to the project: epidemiologists, readers, trainers and scientific investigators. How these different groups (aim to) access and use data – and how anonymisation procedures already function to structure some of that access and use – are crucial issues in light of developing a system that both protects individuals and enables effective delivery of health care as well as large-scale population based research. It has been a specific objective of eDiaMoND to work towards the development of a format for the storage and presentation of the information that is useful for future studies (Power et al., 2004). So, for example, clinicians will retain a record of the assigned identity and the link to the raw data. In this way, it will be possible to satisfy possible scenarios where women have initially agreed to the use of their data for training, but subsequently wish to remove their consent – as well as ask consent for the collection of additional data. 7. Discussion In determining requirements for the eDiaMoND system, we have had to engage in a very real way with issues of trust and ethics. Our investigations


389

suggest that requirements gathering processes for e-Science would benefit from a conceptualisation of ‘data’ that goes beyond the ‘commodity’ view of information. Too often, information is perceived as ‘a substance that is present in the world, that is transferable, and independent of its vehicle’, (Berg and Goorman, 1999, p. 52). An understanding of the contextual nature of data could inform the design of e-Science systems with an emphasis on data sharing. Berg and Goorman (1999) mention three ways in which medical information can be seen as intertwined with the context of its production. The first way is largely congruent with Garfinkel (1967) and the argument of Heath and Luff (1996) that incomplete medical records are usually perfectly adequate within the concrete practice of medical care: ‘data are always produced with a given purpose and their hardness and specificity is directly tailored to that purpose’ (Berg and Goorman, 1999, p. 53). Second, the meaning and status of medical data is not closed-off once they are captured in a patient record. Data remain dynamic in the sense that their re-articulation in evolving circumstances (both with regard to patient history and medical work routines) continually reshapes what they mean. It is however, the third way that interests us most for the purposes of this paper. This is the observation, attributed to Cicourel, that physicians and other health care workers, ‘typically assess the adequacy of medical information on the basis of the perceived credibility of the source’ (Cicourel, 1990, p. 222). In other words, healthcare workers develop a sense of the trustworthiness of the people (and machines) they work with and evaluate the meaning, status and quality of data in accordance. When considering how data may be shared across different BCUs, we have seen how dissociating the context of reading from the context of a mammogram’s production and distributed the work of reading open up new potentialities, whilst at the same time closing off others. Thus, while distributed reading affords greater flexibility in allocating resources within the NHSBSP, local and informal visibility arrangements, as well as biographical familiarity (with colleagues, technologies and processes) are disturbed. Recognising the latter as important in the maintenance of trust relations in screening practice raises important questions of how such relations can be established and maintained where reading is dislocated in this way. For distributed reading, the central questions are: first, how can a reader who lacks knowledge of the (local) conditions of a mammogram’s production read that mammogram confidently (i.e., in accordance with their sense of professional competence); second, how can a reader unknown to one be trusted to have read mammograms in an accountably acceptable manner? In both these questions there is a sense of distributed reading as being somehow ‘black boxed’ – that is, considered as independent of its social and organisational context – and not accountable in the manner described above. The

390


importance of this issue is heightened given that a remote reader’s decision will have an impact at a local level, i.e., on the assessment clinic at the BCU where the mammogram originated. Co-located readers can walk down the hall to ask a colleague what she meant by this annotation or why she had seen/missed this feature; with a distributed approach it becomes more problematic to do this. Of course, in theory, a reader could call another and ask the question, but in practice, the transformation of a very informal, non-threatening and ad hoc type of interaction into the specific reason for a telephone call may risk adding too much weight to it, and even if it does happen, how in such a situation are actions like pointing and selecting areas for attention accomplished? A response is that a technology like the Grid enables (virtual) meetings between readers and that this would be a suitable occasion to raise these issues. However, the issue is more complex in that what we might call the immediacy of collegiality enables answers to be obtained more rapidly (and perhaps less publicly) than in a Grid-enabled meeting. What, to borrow Rabinow’s (1986) terms we call ‘the micro-practices’ of, in this case, the BCU, i.e., talk between colleagues who meet by happenstance, is not straightforwardly accommodated by the Grid. Asking a passing colleague to have a look at a problematic mammogram is simple enough when the two of you are co-located, but distributed reading does not provide much happenstance congenial opportunities. It could be that there is a degree of formalisation involved in distributed reading that could lead to issues around trust becoming strained in some way. When a reader queries another’s annotation or omission in the course of a happenstance meeting, it is an issue that can resolved between the two; but when it is raised in a meeting or via a call specific to the issue, things change and become more formal. During these organised occasions, questions of clarification tend to acquire a different connotation, to do with professional competence. Obviously this is not inevitable, but it is something that we should consider in environments, which lack the affordances necessary for readers to ‘do’ informality. One approach to addressing the problem of context would be to neutralise it through seeking (or imposing) greater standardising of screening practices, thereby eliminating some of the variation between BCUs. For example, the wide-scale adoption of full-field digital imaging may remove the large variation that arises from the use of different film types and processing systems. Moreover, technologies such as eDiaMoND may themselves be a driver of standardisation, not only because of the overheads associated with providing local customisations, but also because both mammograms and decisions are treated as resources within the e-Science paradigm. For mammograms and decisions to be useful as resources (for example, for training or for epidemiological studies) it becomes important that they are produced in comparable ways. We might question, however, both how far standardisation is


391

desirable, and how far it might go to solving problems of trust. An argument can be made that a degree of variation in practice is necessary to support variations in populations, resources, skill mixes between different BCUs, as well as providing the elbow room for innovating practice. A further difficulty arises because agreements within BCUs about inter alia where to set recall thresholds, what counts as a technical recall, are intersubjectively achieved – they depend on the sorts of local visibility arrangements and opportunities for discussion afforded by co-location. Thus, while standardisation of artefacts used to record decisions (e.g., the screening form) may give the impression of uniformity of practice, their use and interpretation is tied intimately to local practices. In relation to standardising data, we might also consider providing translations between practices. This approach turns upon the use of technologies to translate between locally embedded practices. An example of such a technology is the SMF (Standard Mammogram Form) (Brady and Highnam, 1999), developed by one of the industrial partners on the eDiaMoND project. This technology is underpinned by a physics model of the X-ray process and can be used to transform mammograms such that they can appear as they would if they had been taken under different conditions. Thus, mammograms taken in one BCU can, using this technology, be presented in a way that conforms to the preferences, for example, for brightness and contrast that may prevail in another. There is a problem, of course, in treating such parameters as brightness and contrast merely as ‘preferences’, without considering how such ‘preferences’ are constitutive of local practices and priorities. For example, it may be that certain sorts of lesion are more apparent under certain conditions, and that those conditions are maintained in a BCU because detection of those sorts of lesions is a local priority. Another approach would be to consider how to use technology to support the trust relations in reading. Biographical familiarity and trust might be achieved through the establishing of interacting networks of readers working remotely with particular BCUs, perhaps using Grid technologies to support visibility arrangements. For example, a remote reader double reading with a local reader could, once reading has been completed, be given access to the decisions made on those cases by their double reading partner. Similarly, the remote reader could be given access to the review decisions for the cases that they had read and so see what their decisions came to. In addition to affording visibility arrangements, it might also be useful to support opportunities for informal communication between local and remote readers, providing opportunities for collaboratively establishing performance thresholds, as is evident currently in routine screening work. The key issue here is, as we noted earlier, that of providing mechanisms that avoid reifying what is usually informal communication, advice and so on.

392


Overall, the issue of data sharing revealed in investigations for eDiaMoND illustrates how, within e-Science, there may be a difficult balance to strike between acquiring information regarding science and health that is in the public interest and may improve healthcare and scientific discoveries in general, and protecting ordinary citizens from unscrupulous use of their personal data. If systems are designed too tightly, they may become rigid, inflexible and difficult to use at the practical level. On the other hand, if they are too loose, they become vulnerable to abuse (Ashcroft, 2003). It is here that the sort of trust relations predicated on biographical familiarity in respect of people, artefacts and processes touch upon clinicians ethical concerns. Users of a system may be unwilling to commit data to a system unless they can be assured that the data on the system will subsequently be handled ethically – they will have to be confident that the system is secure and that policies are appropriately enforced. The notion of informed consent is clearly an issue for the use of data throughout eDiaMoND. Levels of consent must be respected by all parts of the system, suggesting a need to have some semantic notion, or understanding of the reasons why a person may be accessing various elements of the information held in the database. We may need to flesh out these semantic categories further. It may also be the case that, for epidemiological studies, data access can always be treated in particular way. However, this is more technically problematic for practices of distributed reading where it may be more challenging to derive notions of clinical benefit. It may be argued that the e-Science vision of creating vast repositories of data for various scientific practices and research can be seen to represent a shift from the ability to control who has access to what data at a local level, to one that is centrally managed. This shift also implies that mechanisms for deciding who has access to data, who has responsibility, accountability and trust, lies now with different sets of people, i.e., system developers or administrators rather than, in the case of conventional practice, with clinicians. System developers have different concerns for making the system secure that may be at odds with getting the work done. They may, for example, orient to the risk of abuse or inadvertent disclosure more strongly than to the risks associated with data not being appropriately available (the former risk is one they will be more strongly be held accountable for, whereas the latter would be largely borne by the clinicians using the system). This study suggests that there is a strong necessity to consider not only trust as it applies to security in technical terms, but also the ways in which it is produced in collaborative work. The eDiaMoND requirements exercise has had to understand how and in what ways clinicians orient to trust and ethical concerns in their daily activities. This necessitated locating the ways in which open access to information enabled the work of screening to be achieved and stressing the


393

importance of this aspect of the work. Dealing with ethical issues is not solely a matter of securing ethical approval for the collection and storage of clinical data. How data is stored and represented, and how it is anonymised, has bearing on how it may be retrieved and used in clinical practice. Taking ethical concerns into account demands a sensitivity on the part of system designers to the practical ethical activities in which clinicians are observed to routinely engage and which may have direct bearing on the eventual design of the system. The ways in which these practices may evolve in the future also influences our understanding of the requirements for supporting clinicians’ work in the system. At present, NHS guidelines suggest supporting a form of ‘situated role based access’ in which a team based skills approach can be developed allowing one or two persons within the BCU to delegate skills on a needs basis. However, in order to support such flexible access control, authorisation mechanisms in Grid middleware need to be explored to understand the extent to which they can afford the co-existence of local and global policies. The Grid view of virtual organisations can be seen to sit above administrative domains. Consequently, users get a uniform policy regardless of where they happen to be. While this simplifies the management of Grid access privileges, it may constrain local level administrative domains in their ability to retain control over their resources. Currently, the development of a fine-grained model that allows both local and global control usable within e-Science applications is the focus of research in eDiaMoND (Power et al., 2005). It is most certainly the case that the larger bureaucratic issues of gaining ethical approval are a major part of the exercise of building the eDiaMoND system. But through our fieldwork, a different conception of ethical concerns has been revealed that has a more subtle impact on the requirements for e-Health and e-Science systems. From closer examination of anonymisation procedures and patient consent, perhaps contradictory visions emerge that are driving practice: in this case, good ethical practice versus the global sharing of data. How this contradiction is resolved in the UK will be played out through larger organisational procedures and processes such as, government and NHS. We have yet to imagine how global considerations of policy and what constitutes good ethical practice will impact on the vision of global sharing of data. At a local level, notions of ethics are embedded in working practices in multiple ways. Ethics and work practice are often tied together in various ways that may, for example, act as resource to allow certain work practices to occur or not. Or, indeed, to account for why people do the things they do. These activities are of immediate concern to requirements engineers. Future e-Health and e-Science systems may need to understand in detail the ways in which these practical ethical actions are embedded and distinguished in scientific work.

394


This is a different conception of ethics: not only a bureaucratic hurdle that must be jumped before development of a system can begin, nor one that can be dealt with in terms of policies or guidelines. Rather, it resides at the heart of the practical work that the clinicians do. These concerns inform the very actions clinicians have to take and are interweaved with trust in work practices and technology. Trust is woven into the fabric of everyday organisational work as part of the taken for granted moral order (Garfinkel, 1967). This raises questions as to how trust is accomplished in everyday work or specific practices around artefacts. We need also to question how trust can be viewed as a product of collaborative work on and through artefacts and incorporated in various recognisable ways into the record. 8. Conclusions A central issue for CSCW as applied to e-Science is the potential for, and, on occasions, apparent existence of, a disjuncture between the ability to share information and the need for secure and ethical processing of data. This does not mean that we should dispense with security, but that we have to re-think what it is to cope with these potential tensions in terms of practices, structures and artefacts. The idea of a ‘commons’ of information envisioned by e-Science is an admirable one, yet so is the stress on maintaining security of data (especially where it concerns identifiable persons): it seems to us that CSCW type concerns are uniquely suited to debates of this kind since they can populate a middle ground, posing questions and providing (situated) answers to such issues. Attending to the fine grain of work practice and artefact design can contribute to a nascent infrastructure that takes on issues on a case-by-case basis. The eDiaMoND project has raised many fundamental questions about the relationship between the work of breast screening and the technological capabilities that Grid computing might provide. For example, in distributed, collaborative working, the Grid can facilitate a sharing of expertise that is currently impossible. Creating this flow of knowledge and information could have a significant effect on the practices through which the skills of reading mammograms and understanding causes of breast cancer are developed and maintained. The grand vision of the e-Science Programme is to change the way in which Science is conducted. From this perspective, the Grid is not about trying to sustain an ever-upward trend in the power of scientific computing, but rather trying to enhance the very practices through which science is achieved. Given the complexity of the domains, the huge quantity of scientific information and necessary visualisation processes, and the need for tools and processes to support global collaboration, this most certainly is a new and challenging area for requirements engineering. e-Health, as a part of e-Science, has


395

correspondingly strong technological visions of what Grid computing can make possible. In eDiaMoND, such visions have not always been found to be entirely consistent with understandings of existing practices. However, the collaboration of our clinical partners and the detailed understanding of work practice we have gained has provided a firm foundation for addressing technological visions and respecifying them in ways that may make their accomplishment more achievable in the long term.

Acknowledgements The authors wish to thank other members of the eDiaMoND consortium for their input and comments on the work described in this paper, particularly the role of clinical our collaborators in determining the requirements for this project. The authors also wish to acknowledge the support provided by the funders of the eDiaMoND project: The UK Department of Trade and Industry, the EPSRC (ref no: GR/S20956/01) and IBM.

Notes 1. Analogous to the electricity supply, users plug into the Grid to draw on whatever computational, data resources, etc. they need without needing to think about where those resources come from. 2. See Hine (forthcoming), for an exploration of such tensions. 3. Most readers are also radiologists. For the sake of simplicity, however, we will use the more general term of reader. 4. Shared University Research. 5. The data presented in this section is taken from fieldwork conducted by MH in a prior comparative study of work practices in BCUs. For further details, see Hartswood (2000). 6. ‘Interval cancers’ are cancers that present symptomatically between screening rounds, and as such can sometimes represent a cancer that has been missed at screening. 7. In our observations there were certain texts and seminars that were oriented to as important. Readers frequently referred to Tabar and Dean (2001) and two readers taking part in a seminar held by Tabar were frequently asked to give an account of the seminar during the weeks after their return. 8. In one observed case, a reader brought in a newspaper article on the potential problems of breast screening and discussed this with colleagues. There was some debate as to the problems that the article might pose for the work of the screening centres and the public perception of the screening program in general. Readers variously suggested writing a response to the article or making an intervention in a journal, and how they should discuss the article with women attending the clinic if the topic was raised.

396


References Anderson, R. (1994): Representations and Requirements: The Value of Ethnography in Systems Design. Human–Computer Interaction, vol. 9, pp. 151–182. Ashcroft, R. (2003): Making Sense of the Guidelines on Sharing Personal Data. Presentation at Workshop on Ethical Issues in e-Science. All Hands Meeting 2003, Nottingham. Berg, M. and E. Goorman (1999): The Contextual Nature of Medical Information. International Journal of Medical Informatics, vol. 56, no. 1–3, pp. 51–60. Brady, M. and R. Highnam (1999): Mammographic Image Analysis. Dordrecht: Kluwer Academic Publishers. Boseley, S. (2004): Breast Cancer; The Relentless Rise. January 15th, The Guardian. Caldas, A. (2003): Are Newsgroups Extending ‘‘Invisible Colleges’’ into the Digital Infrastructure of Science?. Economics of Innovation and New Technology, vol. 12, no. 1, pp. 43–60. Cicourel, A. (1990): The Integration of Distributed Knowledge in Collaborative Medical Diagnosis. In J. Galegher, R. Kraut and C. Egido (eds.): Intellectual Teamwork: Social and Technological Foundations of Cooperative Work. New Jersey: Lawrence Erlbaum Associates. Coopmans, C. (forthcoming): Making Mammograms Mobile: Suggestions for a Sociology of Data Mobility. Information, Communication and Society. Crane, D. (1972): Invisible Colleges. Chicago: The University of Chicago Press. Dweck, R. (2003): Sifting Through Standards. March 10th, Bio IT World. Foster, I. and C. Kesselman (eds.) (2004): The Grid: Blueprint for a New Computing Infrastructure. San Francisco, CA: Morgan Kaufmann. Garfinkel, H. (1967): Studies in Ethnomethodology. Englewood Cliffs: Prentice-Hall. Geldman, A. (2002): NHS Staff: The Issue Explained. June 26th, The Guardian, http:// society.guardian.co.uk/NHSstaff/story/0,7991,460023,00.html. Giorgini, P., F. Massacci, J. Mylopoulos and N. Zannone (2004): Requirements Engineering Meets Trust Management: Model, Methodology, and Reasoning. Technical Report DIT04–016, Informatica e Telecomunicazioni, University of Trento. Goodwin, C. (1994): Professional Vision. American Anthropologist, vol. 96, pp. 606–33. Hartswood, M. and R. Procter (2000): Designing for Breakdowns and Repairs in Collaborative Work Settings. In B. Fields and P. Wright (eds.): Special Issue on Understanding Work and Designing Artefacts, International Journal of Human Computer Studies, vol. 53, no. 1, pp. 91–120. Hartswood, M., R. Procter, M. Rouncefield and R. Slack (2002): Performance Management in Breast Screening: A Case Study of Professional Vision and Ecologies of Practice. Journal of Cognition, Technology and Work, vol. 4, no. 2, pp. 91–102. Hartswood, M., R. Procter, M. Rouncefield and R. Slack (2003a): Cultures of Reading in Mammography. In D. Francis and S. Hester (eds.): Orders of Ordinary Action: Respecifying Sociological Knowledge. Aldershot: Ashgute Publishing. Hartswood, M., R. Procter, M. Rouncefield, R. Slack and J. Soutter (2003b): The Work of Reading Mammograms and the Implications for Computer-Aided Detection Systems. In Proceedings of the Seventh Medical Image Understanding and Analysis Conference. Sheffield, July, British Machine Vision Association, pp. 89–92. Hartswood, M., M. Jirotka, R. Procter, R. Slack, A. Voss and S. Lloyd (2005): Working IT out in e-Science: Experiences of Requirements Capture in Health Grid projects. In T. Solomnides, R. McClatchey, V. Breton, Y. Legre and S. Nørager (eds.): Proceedings of HealthGrid 2005. From Grid to Healthgrid. Amsterdam: IOS Press.


397

Heath, C.C. and P. Luff (1996): Documents and Professional Practice: ‘Bad’ Organisational Reasons For ‘Good’ Clinical Records. In Proceedings of the ACM Conference on Computer Supported Co-Operative Work. November, Boston: ACM Press. Heath, C.C., P. Luff and M. Sanchez Svensson (2003): Technology and Medical Practices. Sociology of Health and Illness, vol. 25, no. 3, pp. 73–96. Hinds, C. and C. Coopmans (2003): Screening Requirements (1) eDiaMoND. Technical Report. Hine, C. (ed.). New Infrastructures for Knowledge Production: Understanding e-Science. Idea Group, Hershey, PA (forthcoming). Hughes, J., V. King, T. Rodden and H. Andersen (1994): Moving out From the Control Room: Ethnography in System Design. In Proceedings of CSCW’94. Chapel Hill, NC: ACM Press. Jirotka, M. (2003). Screening Evaluation Report. eDiaMoND Technical Report. Jones, S., M. Wilikens, P. Morris and M. Masera (2000): Trust Requirements in e-Business. Communications of the ACM, vol. 43, no. 12, pp. 81–87. Luhmann, N. (2000): Familiarity, Confidence, Trust: Problems and Alternatives. In D. Gambetta (ed.): Trust: Making and Breaking Co-operative Relations. Electronic edition, Department of Sociology, University of Oxford, Chapter 6, pp. 94–107. http://www.sociology.ox.ac.uk/papers/luhmann94–107.pdf. Moreau, L. S. Miles, C. A. Goble, M. Greenwood, V. Dialini, M. Addis, N. Alpdemir, R. Cawley, O. De Roure, J. Ferris, R. Gaizauskas, K. Glover, C. Greenhalgh, P. Li, X. Liu, P. Lord, V. Radenkovich, A. Roberts, A. Robinson, T. Rodden, M. Senger, N. Sharman, R. Stevens, B. Warboys, P. Watson and C. Wroe (2003): On the Use of Agents in a BioInformatic Grid. In S. Lee, S. Sekuchi, S. Matsuoka and M. Sato (eds.): Proceedings of the Third IEEE/ACM Workshop on Agent Based Cluster and Grid Computing. Tokyo, Japan, pp. 653–661. Price, D. and J. de Solla (1963): Little Science, Big Science. Ithaca, NY: Columbia University Press. Power, D., E. Politou, M. Slaymaker, S. Harris and Simpson, A. (2004): A Relational Approach to the Capture of DICOM Files for Grid-enabled Medical Imaging Databases. To appear in ACM Symposium on Applied Computing, Special track on Computer Applications in Healthcare. Power, D., M. Slaymaker, E. Politou and A. Simpson (2005): A Secure Wrapper for OGSADAI. In Proceedings of the European Grid Conference, Amsterdam. Rabinow, P. (1986): Representations are Social Facts: Modernity and Post-modernity in Anthropology. In J. Clifford and G.E. Marcus (eds.): Writing Culture: The Politics and Poetics of Ethnography. Berkeley: University of California Press. Sacks, H. (1972): Notes on Police Assessment of Moral Character. In D. Sudnow (ed.): Studies in Social Interaction. New York: Free Press, pp. 280–293. Schneier, B. (2000): Secrets & Lies: Digital Security in a Networked World. New York: John Wiley & Sons. Shapin, S. (1994): A Social History of Truth: Civility and Science in Seventeenth Century England. Chicago: University of Chicago Press. Soutter, J., E. Anderson, J.C. Campos, M. Hartswood, L. Khoo, R. Procter, R. Slack, L. Smart, P. Taylor and L. Wilkinson (2003): The Role of Computer Based Training in Mammography. Royal College of Radiologists Breast Group Annual Scientific Meeting, November, Cardiff. Tabar, L. and P.B. Dean (2001): Teaching Atlas of Mammography. 3rd edn. Thieme Medical Publishers, ISBN 0865779627/3136408039. Taylor, J. (2001): Presentation given at UK e-Science Meeting. July, London.

398


Tryfonas, T., E. Kiountouzis and A. Poulymenakou (2001): Embedding Security Practices in Contemporary Information Systems Development Approaches. Information Management and Computer Security, vol. 9, pp. 183–197. Van House, N.A. (2002): Digital Libraries and Practices of Trust: Networked Biodiversity Information. Social Epistemology, vol. 16, no. 1, pp. 99–114. Voss, A., R. Slack, R. Procter, R. Williams, M. Hartswood and M. Rouncefield (2002): Dependability as Ordinary Action. In S. Anderson, S. Bologna and M. Felici (eds.): Proceedings of the International Conference on Computer Safety, Reliability and Security (Safecomp), Catania, September 10–13th. Lecture Notes in Computer Science vol. 2434, Springer-Verlag GmBh, pp. 32–43. Voss, A., R. Procter, R. Slack, M. Hartswood and M. Rouncefield (In press): Understanding and Supporting Dependability as Ordinary Action. In K. Clarke, G. Hardstone, M. Rouncefield and I. Sommerville (eds.): Trust in Technology: A Socio-Technical Systems Perspective. Dordrecht: Kluwer. Zuccala, A. (2005): Modeling the Invisible College. Journal of the American Society for Information Science and Technology, Maryland: Silver Spring.