Designing health outcomes through patient data ownership

A patient's health data is more than the sum of information in their electronic health record. Primary health care is evolving with comprehensive determinants of health and systems medicine models, yet electronic health data remain mostly fragmented and siloed. All data is health data, with an estimated 80%–90% of modifiable contributors to health happening outside the clinical setting.1 Patient-Generated Health Data (or PGHD) is “health-related data created and recorded by or from patients outside of the clinical setting.”2 Clinical data, modifiable contributors, and PGHD, together, build a rich picture of health data. Combined, they become the true picture of an individual's health.3, 4 This picture includes personal circumstances and choices, apps and wearables that log movement, adverse childhood events, zip code of residence, diet, education, salary, dental records, medical device information, stress level, medical conditions, social history, and more. All these data combine to become a true picture of an individual's health.4, 5 This comprehensive picture of one's health data remains broken, however, with fragmented health data existing across siloed systems. These data are in pieces, made of two sides. One side contains health bytes such as biometric measurements, exam notes, or demographic data. The other side is location data—where that health information is documented and stored by different companies. Be it a phone app, office visit or wearable technology, each piece of health data is stored where it's collected (a digital health record, of sorts), by the collector. These collectors are further divided into two groups, Health Insurance Portability And Accountability Act (HIPAA)-covered health entities, and “other.” HIPAA-covered entities include hospitals, clinical environments, and their business associates. “Other” include most PGHD and nonclinical data from wearables and health apps. These data are sometimes referred to as indirect health data1 and fall outside HIPAA protections. As such, these entities are not subject to the same interoperability expectations or access for point-of-care decision-making, regardless of their utility. With data scattered across each facility and provider visit, each app and wearable, every purchase and data log, it is impossible to see the full picture of an individual's health. Electronic Health Information Exchanges (HIEs) are intended to aggregate HIPAA-covered patient data between healthcare systems, to inform decisions at point-of-care. For example, this data may provide information to prevent medication errors, or access vital dental or medical device information at point-of-care. For patients in large urban centers with well-integrated health systems, these exchanges can provide life-saving information to providers. However, facilities with proprietary EMRs aren't designed to communicate with outside record systems—including most telehealth services. Rates of interoperability, HIE participation, and information access vary widely at the point-of-care. This variance depends on location, with vast disparities between urban and rural, and system owned versus independent hospitals.5 And as noted previously, nonclinical data (even cardiac data from a smartwatch) is never incorporated into HIEs, even if a patient wishes otherwise. Health data can build health equity. PGHD-centered research studies could pave the way to addressing skin tone bias in wound care by creating databases of surgical site photos as they heal.6 Research agendas designed with the integration of PGHD may allow us to scale health equity innovations by virtually bringing large research projects to populations historically underrepresented due to systems-level barriers.7 Population health programs designed with interoperability and equity in mind may then provide real-time access to patient health data in a meaningful, actionable format. Real-time access to medical data improves outcomes. While efforts to improve interoperability and modernize health data systems are being made,8, 9 fax and mail are still responsible for most record transfers.10 But again, this is only 20% of all modifiable health information. How much might outcomes improve by shifting to a systems and determinants-focused health data model? How would outcomes change if we designed the system to harness the power of health data both for critical care moments and to identify determinants for upstream screening? How might outcomes change if patients owned their health data? Neither patients nor providers control health data when and how it's needed. Why? Because patients don't own it. State laws require providers to keep medical records for all patients. These laws are different for each state, but either explicitly11 or implicitly12 recognize the health care provider as the owner of the medical record. One crowbar to bend law toward patients controlling their data is using a Patient Data Use Agreement (PDUA) that assigns data ownership to the patient (and co-ownership of data with providers and patients when health data is generated together by both parties).13 For nonclinical health data from outside the purview of HIPAA, ownership is determined by the business-dictated terms and conditions users (or patients) agree to. This landscape is further complicated by the status of “data” under property law, which isn't viewed as wholly “ownable.”14 And since federal, state, and local laws don't view people as the owners of their personal health data, both healthcare and service providers—such as Amazon and Google—treat data as under their ownership15—and data is lucrative. American companies alone spent over $19 billion in 2018 acquiring and analyzing consumer data, according to the Interactive Advertising Bureau.16 In the health data market, deidentified medical records sell for up to $1000 each, while patients have no knowledge of their data being sold.17 While companies buy, sell, and use health data to make money, there is no transparency into who is using it, what they're using it for, and whether or not they're profiting from it. Electronic health records make it easy to build aggregate healthcare datasets that can be used to build scientific and medical knowledge and improve public health, but without transparency and access to individual aggregated data, patients have no say in if, why or how their information is being used.18 Mirchev et al stated, “The issue of ownership of patient information in the context of big data is poorly researched; it is not addressed consistently and in its integrity, and there is no consensus on policy decisions and the necessary legal regulations. Future research should investigate the issue of ownership as a core research question and not as a minor fragment among other topics.”19 Recent publications have called for clear definitions of each health data type,1 specific regulatory models for consent with each data type20, 21 and potential patient compensation models.15 When companies own and control patient data, insights generated are privatized for competitive advantage. The data and insights aren't passed on to patients to benefit the individual or public good. Inau et al suggests using the FAIR principles (findable, accessible, interoperable and reusable) to guide health data stewardship practices in the research realm.22 These guiding principles paired with Snowden's Framework For Digital Healthcare Transformation23 seem companion pieces to guide future models of patient engagement and health data stewardship practices. With buildout for a nationwide Unique Patient Identifier (UPI),24 dispersed data across systems may be tagged and aggregated for each individual. Once UPIs are in place, curated longitudinal health data records for every citizen may be built, and with these records in hand, patient participation in the health data marketplace and control over their health data becomes truly feasible. Patient participation in the health data marketplace is a difficult model to build, but allocating compensation to individuals for the use of their data is possible.19 Unique Patient Identifier Health Data Repository Data Manager Nationwide Health Information Exchange A Unique Patient Identifier will provide citizens with a tag for each piece of their data. Once tagged, data will be aggregated for each patient in their own account in the secure Health Data Repository, the home for health data storage. Within this home, a Data Manager will collect, curate, and maintain health data for each patient. Patients may then use the Data Manager to control their health information. With the Data Manager, patients and clinicians alike may access health records and build models of health over time to identify patterns and inform treatment plans. This knowledge arms patients with advanced opportunities for health literacy, the power to make informed decisions and take control of their health story, to learn how to best provide self care and manage healthcare costs. With complete, accurate, and constantly updated access to longitudinal lifetime health data, patients will have a whole picture of their health, habits, choices, and risks. Trusted data at ready access can answer questions, provide insights, identify patterns, and guide data-driven communication with services and providers. Owning a copy of personal health data does not change property law or the status of medical record requirements. But within the scope of an agreement with a data manager, individuals have the ability to acquire all the known data relevant to their health; creating a new complete record, and source of truth about their health and wellness. The vision we have for the future is one that benefits society, individuals, and builds health equity for all. We believe that health equity will be furthered by the expansion of health literacy inherent to personalized medicine. The digital transformation of healthcare has empowered our populations with burgeoning tools to self-manage their healthcare. While there continue to be gaps in the literature, future studies must focus on health data engagement in regard to health literacy, self-determination, self-management of health and wellness, and the impact of health data engagement on health outcomes. In our vision of the future, patients own or co-own every health data point about themselves. Health data generated about the patient by a provider is co-owned by both parties. Research and innovation are supported, and that patients have the right to possess, share, sell, or destroy health data they generate. In this vision, use of patient health data shall be consented in advance by the patient, other than use required by law. When patients own their data, they control access to it. Owning the complete picture of one's health data allows individuals to decide how to use it, who can see it and for how long. They may choose to share or withhold some or all of their information with providers, family members, caretakers, researchers, or marketers. Our vision is a future with concrete, enforceable health data rights. Rights to secure health data storage, health data collection and maintenance by a data manager; the right to share or restrict data, to know who has this data, and to know how it's being used. The right to remove data, sell data, the right to health data education, access to longitudinal lifetime health data, and the benefits that come from controlling one's health and self-care. Data ownership provides the keys to how health data is used outside medical appointments, to further research, innovation and better healthcare for all, and the keys needed to care for individuals and their loved ones. These are matters of health equity and self-determination, empowering patients with the data they need to take initiative in their health literacy and personal health journey. Data ownership unlocks the path to achieving health and wellness potential. Juhan Sonin has an academic appointment at MIT (Mechanical Engineering Department), owns a $2MM/year healthcare design studio (goinvo.com), and does not actively participate in healthcare/healthIT investing. The remaining authors declare no conflict of interest. Please note: The publisher is not responsible for the content or functionality of any supporting information supplied by the authors. Any queries (other than missing content) should be directed to the corresponding author for the article.

Fetched live from OpenAlex and de-inverted. Abstracts are not stored in this database: the inverted indexes are 8.6 GB of the frame’s 9.3 GB of text, and the host has 13 GB free.