What’s Special about Health Data?—International Principles

All countries recognize confidentiality as a patient’s right^{Footnote 2} that is good for individual patients and clinicians, and for society as a whole.^{Footnote 3} Intimacies are revealed in the interest of good healthcare, so clinicians’ professional and fiduciary duties include a duty of confidentiality. Therefore, health information is given special protection internationally, though specific ways of achieving it differ. Lifestyle choices, reproductive abilities, and stigmatizing conditions are considered highly sensitive. But what is included in these categories differs with cultural background, from place to place, and from time to time. What is considered very private, embarrassing, stigmatizing, or grounds for discrimination varies among individuals and groups.^{Footnote 4} Countries, likewise, vary in what personal information is treated as needing restricted collection, use, and disclosure.^{Footnote 5,Footnote 6} They also balance privacy and other considerations differently; thus privacy protection is more lax in some places than in others. In India, for example, the judiciary considers privacy on a case-by-case basis, as an exception to the rule that permits government interference in private life. Unlike in Europe and the United States, public interest, welfare, and safety take precedence over individual rights, liberty, and autonomy.^{Footnote 7}

Yet, as discussed subsequently, even if individual clinicians scrupulously meet the professional obligation of confidentiality, confidentiality can be compromised by legal requirements to collect, document, and disseminate personal health information, especially when maintained in computer databases that can be combined easily with other sources of information about the person.^{Footnote 8} What patients reveal for the purpose of healthcare may then be used in ways they never intended. Privacy practices have not caught up to these trends.

Two Court Cases

Two court cases provide occasion for thinking about the ethical implications of data sale and secondary use in light of international principles of health data privacy and protection. Each case involves selling prescription data for pharmaceutical marketing. In both the United States and the United Kingdom, data aggregators successfully challenged restrictions on such data use and sale.

The 2011 U.S. Supreme Court case Sorrell v. IMS Health Inc. et al. ^{Footnote 50} was decided on free speech grounds. Although the legalities involve unique features of U.S. constitutional law, a similar case in the U.K. in 2000, R v. Department of Health, Ex Parte Source Informatics Ltd.,^{Footnote 51} points to the international nature of the ethical issues. That case was decided on the grounds that selling anonymized (de-identified) data did not violate pharmacists’ duty of confidentiality.

The decision in each case runs counter to public expectations of health data confidentiality. The public is hardly aware that aggregating and selling prescription and other health data are an international enterprise. Thus, the Sorrell and Source cases raise more general global concerns of privacy and data protection, on the one hand, and appropriate use and secondary use of data for data mining, marketing, research, public health, and healthcare, on the other. Elsewhere I address data de-identification, prescription and other health data aggregation and sale, and issues more specific to these two cases.^{Footnote 52} This article explores other ethical issues related to the cases—the benefits and harms of data sale; the trade-offs among privacy, individual health, and public health; and the need for transparency—so ethical dimensions of responsible and ethical health data collection and use can be assessed.

Who Benefits?

Clinical data include data that patients are required to provide to receive care. In both the Sorrell and Source cases, prescription data was aggregated and sold. Patients, prescribers, and pharmacies are required by law to collect information related to prescribing. Data aggregators perform a valuable service in collecting, cleaning, and combining these and other data into useful resources, though the value does not accrue directly to those who are the original source of the data. Data aggregators should be compensated for the value added, but the sources deserve some benefit as well. Currently, they primarily bear costs, both financially and in privacy.

The combination of required disclosure of personal data and the ease with which data can be collected and disseminated is not unique to pharmacies. It is a cost of healthcare to collect and store patient records, a cost passed on to patients and payers, whether private or governmental. The organizations providing these data obtain it from those legally required to provide it—from individuals who pay directly, or indirectly through their private or public insurers, for its collection and maintenance. These individuals gain little direct benefit from the aggregation and sale of data about them, and they may be harmed by it. It mostly occurs without their knowledge or permission. Even in light of arguments that patients should be required as a condition of treatment to allow data about them to be used for research—a requirement counter to professional norms to provide care—it seems improper to require either patients or clinicians to disclose data they would otherwise choose to keep private so that others may financially profit from them, whether or not the data are de-identified.

Secondary use and big data analytics also are affected by the costs of collecting, storing, and organizing data, as well as by the costs of meeting regulatory requirements. To reduce costs, health data processing is outsourced from countries with stronger privacy protections to countries with weaker ones, despite its sensitive nature and consequent privacy risks.^{Footnote 53} Also to reduce costs, U.S. marketing organizations oppose opt-in consenting on the grounds that it would increase the cost of doing business.^{Footnote 54}

But costs must be paid somehow. Both the Source and Sorrell cases were fought to protect the commercial value of health information. One way of recovering costs is by selling these data. Though some sources provide some data sets at little or no cost to researchers, cost could make it easier for pharmaceutical companies and other commercial enterprises than for researchers to access data.^{Footnote 55,Footnote 56} Some fear that the trend toward treating data as private property could make it more difficult to develop comprehensive databases crucial for public health and research.^{Footnote 57}

Research, trade, and innovation, as well as the globalized healthcare industry, provide considerable public benefit. There are ethical as well as economic costs to privileging privacy, but economic value may not be more important than privacy or other considerations. Law and common ethical practice prevent releasing medical information without a patient’s permission, but U.S. law does not prevent selling or transferring rights to records.^{Footnote 58} Data that can be sold, can be sold and replicated anywhere and, once sold, may be used for good or ill. Tracing the chain of data sales and use is difficult, making transparency and consent nearly impossible the further data are transferred from the original source.

Health Data Uses: Big Data, Data Mining, Research, and Biosurveillance

Electronic health records and health information networks provide a wealth of data for public health, health outcome improvements, and research. Data could be used for a range of beneficial purposes, from outcomes and comparative effectiveness research to designing clinical trials and monitoring drug safety. The benefits of these data for public health, marketing, research, drug development, identifying adverse effects, and biosurveillance; for reducing costs and overprescribing; and for regulating devices and software all are intertwined with privacy concerns. For some of these purposes, it is crucial to be able to identify individuals and link together an individual’s records, so a requirement for de-identification may further impair research.

However, there also could be harms. Patients may withhold sensitive information if they fear it will be used against them, even though it may be useful for other purposes. Studies based on analyzing large data sets could be compromised if individual prescribers or patients withhold information or their consent for data use.^{Footnote 59}

Privacy advocates, researchers, and public health officials can be at odds over how to achieve benefits while protecting privacy; their disagreements may stem from different values and historical legacies. For example, the U.K.’s National Health Service (NHS), Royal College of Physicians, and the Wellcome Trust led a coalition of leading medical research organizations opposed to the proposed European General Data Protection Regulation, which, unlike the Data Protection Directive it would replace, would bind all 28 member countries. The proposal was acceptable to most EU nations; the European Parliament approved the committee report in full in 2014.^{Footnote 60}

The regulation affects any organization that gathers, processes, and stores data, whether operating within the EU, doing business with organizations within the EU, or storing data in EU-member countries. As of this writing, most organizations were not ready for compliance. Research organizations were among those concerned about its impact. It is especially relevant here that the regulation defined personal data as any information about an individual, whether it relates to his or her private, professional, or public life; and thus such data includes medical information. Much of these personal data—a name, a photo, an email address, bank details, posts on social networking websites, or a computer’s IP address^{Footnote 61}—too, are part of medical records. The original proposed regulation, therefore, increased health data protection and would have made illegal the NHS mass database of citizens’ health information, which could provide a valuable resource for improving care.^{Footnote 62,Footnote 63,Footnote 64} Opposition from the NHS and other research organizations contributed to changes put forward by the EU justice ministers in March 2015 to improve data sharing across healthcare services. They also tabled amendments regarding how to manage such special forms of data as health and genetic data, and when patient consent is needed.^{Footnote 65} The European Parliament, the Council, and the Commission agreed on the new regulation late in 2015 and it is expected to be adopted by the European Parliament at the beginning of 2016.^{Footnote 66}

This NHS database also provokes privacy concerns while providing financial benefit, as the NHS sells the data.^{Footnote 67} Individuals can opt out of the new care.gov database, which was to contain, for the first time, records from primary care (GP) practices. Privacy concerns delayed including those GP records.^{Footnote 68} Although other rules allow greater third-party access to other NHS databases,^{Footnote 69} insurers, pharmaceutical companies, and other private commercial enterprises will receive “pseudoanonymized” records that the NHS claims “will not contain information that identifies you,” but that instead include NHS numbers, birth dates, postcodes, and ethnicity and gender information.^{Footnote 70} The database was created, according to the NHS England website, to improve NHS services,^{Footnote 71} and to “drive economic growth by making England the default location for world-class health services research.”^{Footnote 72}

In the United States, too, researchers and bioethicists recognize that privacy protections can impede research and healthcare quality improvement, with calls from such influential agencies as the Institute of Medicine to change the HIPAA Privacy Rule to allow for information-based research—that is, research using medical records or stored biological samples.^{Footnote 73}

Some innovative approaches to meeting privacy, research, and commercial needs for data sharing include the new international Open Humans Network, which “attempts to break down health data silos through an online portal that will connect participants willing to share data about themselves publicly with researchers who are interested in using that public data and contributing their analyses and insight to it,”^{Footnote 74} and businesses based on similar ideas, such as PatientsLikeMe. Using the data people post, PatientsLikeMe produces publishable material on patient outcomes and comparative effectiveness, which is valuable for effectiveness research. Epidemiologic trends also can be identified through social media postings.^{Footnote 75,Footnote 76,Footnote 77} Those engaging in this social networking presumably feel it is beneficial to them. Even so, it would be better if they were aware of what is done with their data, instead of being surprised if they have not read subscription agreements carefully enough to know that PatientsLikeMe sells data to pharmaceutical and other companies and that sites such as Facebook are not private places.^{Footnote 78,Footnote 79}

Who Sells and Uses Data? One Man’s Bread is Another Man’s Poison

As is evident from the multiplicity of uses, health data are valuable. Internationally, the idea of “liberating” data for secondary use is recognized as beneficial for individual and public benefit, research, entrepreneurship, and policy. Though transborder data flow is regulated by international agreements, such as the EU Data Protection Directive, presumably health data could be sold worldwide, to anyone, for any purpose. Balancing this with privacy concerns is fraught.^{Footnote 80} Strong privacy protection, such as the rights-centric approach of the European Court of Human Rights, could adversely affect the globalized healthcare industry, and innovation and trade.^{Footnote 81,Footnote 82,Footnote 83,Footnote 84}

Entire patient records are among the many possible sources of data for which there is a lucrative market, for laudable as well as unsavory purposes. Incidents of medical identity theft increased by more than 20 percent in 2014 compared to 2013.^{Footnote 85} In the active black market in identifiable medical record information, health information is more valuable than U.S. Social Security numbers for identity theft.^{Footnote 86,Footnote 87} Though prices vary, such information sells for about ten times more than credit card numbers (which typically sell for no more than a few U.S. dollars) because it can be monetized by getting treatment paid for via identity theft or to extort money from hacked corporations.^{Footnote 88,Footnote 89}

Electronic records also make it possible for computer or software vendors, intermediaries, or newly created organizations to bundle and sell rights and data,^{Footnote 90} a practice useful for research, policy, marketing, and business. In the United States, there is an exhaustive list of organizations that can use and legally sell health information,^{Footnote 91} some for purposes patients and clinicians would not anticipate. Data sold by both U.S. state and federal agencies can be linked to individuals by using publicly available information, even if some of the data are de-identified.^{Footnote 92,Footnote 93}

Some may consider what is done with these data as harmful to some of the individuals who have provided the data and, at the same time, as beneficial to other individuals, depending on what the data reveal. This combination of benefits and harms is evident in a variety of examples in which one’s records affect one’s services and costs. In the United States, where private medical insurance is the norm, private insurers use prescription and other claims data to deny insurance, charge differential premiums, or exclude some conditions.^{Footnote 94} Businesses often check the MIB (Medical Information Bureau) for job applicants’ underwriting data.^{Footnote 95} Aggregators purchase and combine data from the states as well as from pharmacies.^{Footnote 96} Credit agencies are the most frequent buyers of multistate health profiles, though IMS Health also purchases data from the states.^{Footnote 97} Government fusion centers, designed to promote data sharing among federal agencies and state and local governments, combine data from multiple sources—including health record information—for law enforcement, immigration control, and homeland security.^{Footnote 98,Footnote 99}

Organizations, too, may benefit financially while providing social benefit through data sales. The American Medical Association and the U.S. Centers for Medicare and Medicaid sell provider data, whereas state Health Information Exchanges (HIEs) sell secondary data.^{Footnote 100,Footnote 101,Footnote 102} The U.K.’s National Health Service, too, sells data.^{Footnote 103} Insurance companies or health information technology vendors might aggregate and sell provider-identified data on performance and quality measures, the number of procedures performed, U.S. meaningful use criteria, data security breaches, and other useful compilations. Cash-strapped community health organizations, state Regional Extension Centers (RECs), county hospitals, the U.S. Veterans Administration, the Indian Health Service, the Joint Commission, or hospital associations also could sell data for similarly beneficent purposes. Hospitals routinely sell birth records.^{Footnote 104}

Genetic data are also double-edged. Such data are needed for research, personalized medicine, and biobanking but also can make individuals and communities vulnerable. For example, in 2000, Iceland’s parliament sold exclusive rights to all the genetic and genealogical data from each of its 275,000 citizens to the U.S. company deCODE Genetics. Soon thereafter, deCODE signed a $200 million contract with Hoffman LaRoche to search for several common human genetic diseases. Iceland had an opt-out policy, and the data were encrypted to de-identify individuals. Nevertheless, the Icelandic Supreme Court later ruled that creating the database was unconstitutional because it did not adequately protect personal privacy.^{Footnote 105}

Clearly, provider or patient information is valuable. Hospitals could purchase data about competitors, providers could identify populations for treatment, researchers could conduct studies involving healthcare and public health practices, and government agencies could identify and influence health trends. If such sales were restricted, some fear, the data would not be collected or maintained at all, which could compromise research and new drug development.^{Footnote 106,Footnote 107} The Iceland genetic database sale, for example, led to identification of genes linked to disease,^{Footnote 108,Footnote 109} though capitalizing on these kinds of discoveries was limited to the company with exclusive rights to this gene discovery. DeCODE’s 2009 bankruptcy and the consequent database ownership change from a scientific research company to Saga Investments LLC, and the subsequent sale of the database in 2012 to biotech pioneer Amgen, again raised questions about data privacy and use.^{Footnote 110,Footnote 111}

Countries as different as Canada, Estonia, Sweden, Singapore, and the Kingdom of Tonga have developed various models for protecting privacy and differing policies regarding commercial involvement and rights to samples for gene banks, all with the goal of improving the public health of the studied population, and, in some cases, to generate revenue for national healthcare budgets. Though all these policies are intended to maintain confidentiality, all of the data uses require personal identifiers so as to link individuals’ records from genetic, medical, genealogical, and lifestyle databases. International controversy over such databases, therefore, centers around confidentiality, consent, to what extent commercial interests should influence policy, and whether commercial ownership facilitates or impedes research,^{Footnote 112,Footnote 113,Footnote 114} all of which are concerns related to collecting and selling healthcare data in general.

As a way of raising additional considerations, I pose possibilities that might occur were there unrestricted selling of health data. Abortion opponents presumably could buy aggregated prescription information for medications that cause abortions, or animal rights activists could buy information about researchers’ animal or veterinary medicine purchases. Depending on who buys it and their purpose, such information could threaten or protect researchers’, clinicians’, and patients’ safety and might have adverse effects on research and clinical practice or might open new avenues. Physicians, patients, hospitals, and so on, in one country may be targeted for marketing by commercial ventures or medical tourism facilities in another. Some may welcome learning of such opportunities, whereas others may feel harassed or violated. Individuals in one country may experience salutary or salacious effects from having (identified or possibly re-identified) data available elsewhere. But without transparency, there is little chance of gaining individual consent or, on both individual and societal levels, assessing harm or benefit.

Ownership, Commodification, and De-Contextualization

The right to sell data is muddied by lack of clarity over the legalities of data ownership. Law in and outside the United States does not address health data ownership clearly; it is not clear who the owner should be, or whether ownership is better than current or alternative approaches.^{Footnote 115,Footnote 116} It also is not clear where those who sell data analytics services obtain the data, or how they might use them.^{Footnote 117} Well-known electronic health record vendors have sold de-identified copies of their patient databases to pharmaceutical companies, medical device makers, and health services researchers.^{Footnote 118} Vendor contracts are unusual in that some vendors lay claim to patient record data, whereas businesses and financial institutions typically do not give up their data to their software vendors.^{Footnote 119} Regardless of whether the data themselves or the means of access to them are owned by electronic health records vendors, some academic medical centers pay to get data from their own patients’ records. Vendors often consider their contracts intellectual property and do not reveal these and other contract provisions, a practice the American Medical Informatics Association considers unethical.^{Footnote 120}

If health data are property, presumably, whoever owns the data can sell them. Some advocate clearly defined property rights in medical information, giving patients the right to monetize their access and control rights, as a way for individuals to control and benefit from what happens to data about them.^{Footnote 121} Others argue against property rights in patient data and advocate instead for public ownership akin to a data commons so that data from multiple sources can be de-identified and combined population-wide for public benefit.^{Footnote 122} Commodifying medical information strikes still others as anathema to professional values and the special relationship between doctor and patient. Privacy is valued because it facilitates ideals of personhood involving autonomy, individuality, respect, dignity, and worth as a human being.^{Footnote 123} Therefore, the idea of selling personal health data also disturbs those who think the practice commodifies the self and sullies ideas of personhood.^{Footnote 124,Footnote 125} Compromising of personhood is compounded because data in databases necessarily are de-contextualized. De-identification is an attempt to remove any connection with the person, but even identifiable health record data typically do not include all information a person may consider central to the self.