Patients as data traders

There is a flourishing lucrative global trade in health data. Over 200 companies trade in EHRs.7 QIVIA is a $20 billion US-based data-mining firm that operates in more than 100 countries, compiling health dossiers on more than half a billion patients, drawing from doctors’ records, prescriptions, insurance claims, lab tests and more.8 Some commentators are concerned that patients are potentially exploited and unfairly excluded from the benefits of the new data economy. This concern drives the development of platforms to let patients participate as traders of health data.

For example, founders of the co-operative Savvy[5] argue that connecting patients with the medical industry is a lucrative market, and patients should not be excluded from buying and selling in this market.

Whenever a patient is seen by a doctor, or enters their information into a medical app or platform, they’re providing the health community an invaluable resource: their data. But they’re not getting compensated for it.9

Blockchain technology (best known for its use in cryptocurrency) is now being touted as a tool to allow individuals to establish a self-sovereign ‘data’ identity, where they could control the sharing and use of their personal data, including health data.[6] This is viewed by advocates as a method of ‘democratising data and putting ownership back into the hands of users’.10

The exploitation claim here rests on the supposition that patients currently receive insufficient, or no benefit—patients are characterised as naively giving their data away for free (or more perniciously, having their clinical data stolen). Artist Jennifer Lyn Morone has argued that citizens are in a state of ‘data slavery’11 ; and the data-sharing partnership between the National Health Service (NHS) and Google’s DeepMind (see box 2) has been characterised as the NHS naively ‘gifting’ patients’ data to Google.12

The suggestion is that allowing patients to sell their data would resolve the unfairness (on the presumption that the market would set a fair price). However in the vast majority of cases patients have already benefited, at least with respect to clinical data. The collaborative process of clinical data construction is primarily designed to provide a clinical benefit to patients. Clinical data are created to inform and guide appropriate patient care. The use of data for research is a secondary purpose. So the implication that patients are exploited because they do not benefit directly from the secondary use of clinical data for research is not compelling.[7]

Implicit in the exploitation argument is the assumption that patients would want to benefit financially from their clinical data. In general, this is not supported by empirical research, which consistently shows that patients are uncomfortable with the commercialisation of clinical health data, in particular businesses accessing public administrative data sets for profit.13 14

Problems with a private property interpretation

Aside from the problems with the exploitation argument, there are several other reasons why the idea of private ownership of clinical data is flawed.

First, popular debate, as outlined earlier, seems to imply that ownership confers a, clear, indisputable legal right of control. But this is not the case. The reality of property law is much messier than this. Property rights consist of a bundle of different rights regarding access to and use of any property in question. In property law, several people may have interests in one piece of property and different rules will apply to priority conflicts between those interests. Important bodies of law relating to the collection, distribution, access and use of health (or sensitive/personal) information include: privacy, data protection, human research, anti-discrimination and intellectual property. Therefore, in any given situation, a plethora of statutes, regulations, codes and case law may apply to the competing claims to clinical data.15 In some common law jurisdictions, some judges have ruled that it is inappropriate to treat confidential information (including clinical records) as property.16 17 Other judges have agreed but concluded that, while the information may not be property, the rights to access and use may be proprietorial.18 Such an approach belies any simple notion that ‘ownership’ of clinical data is an easy solution to disputes.

Second, even if we ignore the earlier arguments and decided to treat clinical data as privately owned, the data would still be subject to the state’s power to acquire and use property without permission. For example, many jurisdictions allow the state to seize property without consent for public projects, so long as fair compensation is provided. Even if patients were deemed to have property rights over their data, these resources could plausibly be used in public health activities without their permission as a legitimate exercise of the state’s police power.19 Use of clinical data for socially valuable research may be considered sufficient grounds to acquire and use patient data without consent.[8] For example, five US states have recognised patients’ ownership of genetic information, but two of these have implemented systems that allow unconsented use of this information in research.20

Put simply, no single party owns clinical data. Several actors have claims on it—the patient, the genetic relatives of the patient, the health professionals who create the data and the states that provide for the services and infrastructure to create and store the data. The notion of a simple right of private property is essentially a legal nonsense.

To be fair, property law itself may well be sufficiently nuanced, versatile and sophisticated to recognise competing interests and claims in property.21 In law, a private property model rarely confers the full bundle of rights to access and use property to a single owner. I am rejecting here the simplistic populist notion of private property, namely that patients’ could or should have unilateral power to control their clinical data.

Co-creation of clinical data

What are the grounds on which a patient might claim to be an owner of clinical data? One approach is to consider ownership as a form of Lockean natural right that arises when an agent mixes their labour with resources.22 23 This idea is broadly reflected in intellectual property laws, which protect original works of authorship or invention.23 Data scientists have argued ‘Data provided by humans can thus be seen as a form of labour which powers AI (emphasis added)’11; see also other works.24 25

But is it inaccurate to suggest that patients solely provide the labour that generates clinical data. Instead data are co-constructed through a collaborative process involving the patient and the clinician, with support from other professionals within the health system. Patients rely on health professionals to extract, interpret, process, describe, classify and store health information. Patients, even those who are medically qualified, require clinicians and health scientists to help construct their medical history, create radiology images, test blood samples and conduct gene sequencing. For example, if the patient writes a diary entry about their upset stomach, this writing belongs to the patient. But when a patient and doctor co-construct a medical history, this will look substantially different to the diary entry and that difference is a result of the intellectual work done by the doctor. The patient contributes the ‘raw material’ which is transformed into clinical data by the actions of medical staff.⁹

Not only does the raw material (patient description, physical samples) look significantly different from the final product (medical record); but substantial value has been added in the process. The clinical material desired for secondary research—EHRs, pathology slides, tissue samples—is co-constructed through a collaborative process involving the patient, the clinician and scientists working across the health system. Given these inputs, patients lack a compelling claim to a form of exclusive, private ownership. This conclusion demonstrates the error of conceiving of clinical data as the patient’s property.

Given these reasons for avoiding an interpretation of ‘ownership’ as an individual property claim, how else might we interpret the rhetoric of ‘ownership’?

Non-property relationships with data

There are relationships, other than property, that can justifiably employ ownership language—rather than the data belonging to the patient, the data are about the patient. Here the emphasis is on the special relationship the patient has with the data as the subject to which the data refer. By analogy, in referring to ‘my’ children, I do not mean that they belong to me as property; rather I mean to call attention to the special relationship I have to them. This broader interpretation is preferable to ‘property’ because it seems to better capture patients’ concerns about being disconnected from their clinical data and points to more fruitful solutions than turning patients into data traders.

Clinical data ‘about me’ deserve protection because it has social meaning and therefore power. How the data are used can affect the health, personal and social well-being of the patient. Data about collectives, such as specific patient or demographic groups, or indigenous peoples, can affect the well-being of those groups. As a result of this relationship, the data subject(s) have legitimate interests in secondary use of the data.

Well-established legal and ethical obligations regarding patient confidentiality are evidence of a non-property relationship between patients and their data. Obligations of confidentiality might seem to lend credence to the idea that patients own their information as property, because the use or sharing of the information without consent looks like a type of misappropriation (theft). But the obligations of confidentiality do not arise because I have shared ‘my property’ with a health provider; instead confidentiality requirements support the importance of protecting data ‘about me’ because of the relationship between the data, my well-being and the value of the trusting relationship I share with my health professionals. Critically, this covers information I have directly provided, but also information from other sources—information in my medical history originally disclosed by my parents, or (potentially) the results of a genetic test carried out on a family member.

Consider the public engagement research cited earlier—Your DNA, Your Say. This looks like a straightforward property claim. But interestingly, when explaining the importance of the study, the researchers do not rely on property claims such as ‘the DNA belongs to the patient’. Instead, they refer to citizens’ interests with respect to the mainstreaming of genomic technologies in healthcare: ‘Empirical studies on attitudes, values and beliefs are incredibly valuable; they offer a voice from those who are, or will be, directly affected’.34 Here the patients are characterised as passive, they are the object on which the technology acts; and by virtue of this impact they have legitimate interests.

One further advantage of a broader relationship interpretation of ownership is that it provides a flexible framework for acknowledging multiple relationships with the data. ‘My’ child has multiple relationships—to me, the rest of her immediate family, extended family, different communities and social groups. So too, clinical data exist in multiple relationship—they tell a story about an individual patient, but also often about the family, various different communities (patient, demographic, geographic, ethnic and cultural) and about different diseases, prognoses and treatments (see figure 1). Benkler’s work on commons-based peer production in a networked environment provides a useful example of how different interests can be accommodated within a complex system: there need not be one single data owner.35 Thus the idea of ownership has normative value when it is used to draw attention to the rich and complex bundle of interests that we have in data that tells a story about us and our relationships to others.

Disconnection

On this reading, calls for patient ownership reflect the anxiety that arises from the severing of the relationship between patients and their data. Secondary uses for research may be (and often are) outside the patients’ expectations of data use and there is a lack of transparency in the data ecosystem making it hard, even for interested patients, to understand how their data are shared, linked, repurposed and re-used. Mittelstadt and Floridi argue that the ‘The emerging picture is of data subjects in a disempowered state, faced with seemingly insurmountable barriers to understanding who holds what data about them, being used for which purposes’.36 Several high profile cases demonstrate patients’ or users’ surprise at the way their health or clinical data are monitored, accessed and used (see Box 2). These surprises breed distrust and motivate calls for new tools to control and protect data.

As I have argued, the solution is not necessarily to focus on private property, monetarise patient records and encourage patients to become data traders. Instead, we should look to flexible models that reconnect patients to their data—thereby re-establishing the relationship between the patient and the data. The key features of this approach could be improved transparency, flexible consent models and patient and population involvement. Transparency is a necessary platform for public engagement and should be prioritised across the clinical data ecosystem. Then there are reconnection solutions that can work on the level of the individual patient such as dynamic consent.37 There are also models to empower collectives, based on co-governance and stewardship.33 38 For example, in New Zealand, health research conducted in District Health Boards must undergo Māori research review.39 In Australia, collective consent is sought for genetic research with indigenous communities.40 Future work in data ethics should look beyond narrow conceptions of private property to address data harms, and instead should explore broader models of patient engagement and collective governance of secondary research.