Who owns health data anyway?

Data driven technologies have revolutionised the management of diabetes allowing people to take a greater role in their care; however, use of such systems creates tremendous quantities of data. We have become accustomed to the sharing of data within the health care professional relationship. For example, someone with type 1 diabetes who experiences hypoglycaemia may explore their glucose profile with their diabetes specialist team. This is acceptable to both parties as there is an implicit trust underpinned by confidentiality and a shared goal. What happens when a third party with their own business interest is introduced to that relationship? Who owns that data? There is an increasingly insistent call for people to take control of ‘their’ data framed as the right of ownership with quotes such as ‘Who owns the data owns the future’ becoming well-worn clichés where the alternatives include the risk of exploitation by ‘surveillance capitalism’.1 Health data is far more than that held in clinical records with collective health data being greater than the sum of its parts. All data can be seen as health data with an estimated 80–90% generated outside of the clinical setting.2 From grocery shopping to sleep habits, walking speed to typing speed, patient-generated health data (PGHD) combines all factors that can reflect an individual's health. Despite the concept of personal ownership of one's data coming into the public awareness following the Cambridge Analytica scandal,3 there has been a proliferation and ubiquity in data intensive software generating PGHD such as health and wellness apps, heart rate wrist monitors and nutrition programmes. This ‘self- tracking’ is marketed as a means to gain self-awareness and improved wellbeing.4 It has been shown that motion data from a smartphone can predict behaviour and mental state of the user,5 so how much more might the tremendous volume of data from continuous glucose monitoring, bolus advisors and insulin requirements in a hybrid closed-loop system predict? Cross reference this with an online calendar, geolocation, spending patterns, sleep and menstrual cycle and you gain an in-depth understanding into someone's life beyond the remit of their diabetes care. Ensuring that the collection, use and access of these data meets the expectations of the public is essential to maintain the professional relationship.6 From the perspective of UK law, health data does not have an extensive system of specific rules like those that govern intellectual property. Arguably, even if this were developed, the advantages of a property framework to govern health information may be limited. The monetary value of one person's data points is likely to be insignificant as value lies in collective data from a population. It is also unclear whether legal ownership would provide patients access to the data economy. Perhaps more pertinently from a health perspective is whether legal ownership of health data would enhance self-care and how it might impact interactions with health care professionals. Would this encourage or hinder data-driven innovation? Specialists in medical law argue that a better approach may be to rely less, not more, on individual property.7 Legislation may protect the individual from exploitation but could this create additional barriers to using that data in way that is meaningful for individuals? Despite patients not being considered owners of their health data, the Data Protection Act 2018 requires consent when personal information is shared online.8 The constant reminder of this whenever a new web page is accessed has increased public awareness and controversy. As the world's largest publicly funded health service, a particular strength of the NHS is that it is one of the largest single resources of patient data globally.9 Within this large resource lies immense value that has interested medtech industries. The partnership between Google DeepMind™ and the Royal Free London NHS Foundation Trust involved the trust-wide transfer of identifiable patient records, without explicit consent, for the purpose of developing a clinical alert app for kidney injury.10 There is a very urgent need to review how companies may gain access to NHS data and the ownership of outputs developed from NHS held data records. It is not only the tech industry that has experienced controversy with health data privacy. NHS England initiatives have been fraught with public concerns around privacy. The King's Fund report on interoperability within integrated care systems (ICS) has demonstrated the negative consequences from the first launch of the national GP data for planning and research initiative where the collection of GP data for secondary use was updated. The initiative has been paused but ICS leaders believe the public concern generated about data privacy has compromised the acceptability of shared care records.11 The 2013 NHS England care.data initiative linked data from every patient contact with an NHS provider to plan and design services. This was subsequently paused in 2016 due to a failure to adequately address the public's concerns about health data privacy.12 Over the last decade there has been a steady increase in the number of studies exploring public attitudes or acceptability of secondary uses of data. Surprisingly, the British public are generally unconcerned about where their data goes13 perhaps due to the convenience of services their data buy. Where concern is raised there is discrepancy with behaviours; for example, use of store loyalty cards is high despite the rich dataset collected by the retailers. However, when it comes to health data the consistent theme is fear the information can be traced back to the individual and lead to discrimination or exploitation.14 The Wellcome Trust carried out extensive work on public opinion about commercial access of health data and found that in general the public have said they do not want their health records being shared with private companies due to the perception that the industry is solely motivated by profit. ‘It's a one-way mirror; they know everything about you, but we don’t know what they are doing with that.’15 Some participants felt private sector involvement suggested a wider agenda of the NHS being privatised. Greater knowledge, subject exposure, educational attainment, awareness of data usage and social grade have been associated with acceptance of commercial access.15 Specifically, when workshops discussed that third parties are subject to the data protection legislation and their business interests include developing, maintaining and supporting their products which can benefit the population there was greater acceptance. When no benefit to personal or public health is perceived, commercial access is considered unacceptable, with insurance and marketing seen as the most detrimental to individuals.15 A systematic review of 25 qualitative studies examining public attitudes towards the sharing or linkage of health data found widespread support for the use of data in research; however, a number of conditions were identified to gain public acceptance.16 Across all of the workshops, participants expressed the belief that the effective use of data should be able to deliver wider, positive social outcomes for people and communities, beyond the benefits delivered to individuals and service providers.17 Safeguards ensuring that it is for the public good, optional, non-exploitative and reciprocal were suggested. Transparency of access is an unexpected example of unacceptable usage where clinical trials are not published or are non-data sharing, as this violates the assumptions by participants that the research will contribute to medical knowledge. Although confidentiality is protected, consent discussions and forms rarely disclose investigators’ intentions regarding the sharing of de-identified data or publication of trial results.18 The recent O’Shaughnessy report into UK commercial clinical trials was commissioned due to the near halving of patients recruited in the NHS over the last five years, resulting in a total direct cost in the region of £360 million. A failure to take advantage of the NHS's considerable data assets was highlighted along with the need to invest in health data infrastructure. Decentralised clinical trial opportunity as a result of collaboration between digital platforms and pharmaceutical companies was emphasised as an innovative approach. Data can be collected from the comfort of participants’ homes, reduce the need to travel and enable a more diverse patient group.19 Arguably, research in type 1 diabetes is ideally suited to this model as partnerships between patients, digital platforms and clinicians are already embedded in routine practice. The analysis of real-world evidence from the CamAPS FX™ hybrid closed-loop system used this decentralised approach. Over 1800 users of the system consented for use of their data in the analysis where the endpoints were glucose metrics routinely collected by the app. Data from this large cohort increase confidence of real-world efficacy in line with reported randomised controlled trial data.20 The national desire for the UK to become a tech superpower21 follows the commitment of up to £200 million in 2022 to improve access to health data for research by investing in data infrastructure.19 The current data strategy from the Department of Health and Social Care ‘Data Saves Lives’ has seven key principles: improving trust; using data to improve care; inform national decision makers; research with industry partners; empowering innovators while ensuring fair terms from data partnerships; give the public a bigger say in how data are used; and improving public access to their own data.22 This implies that health data is considered a collective resource for the benefit of society by policy makers. Although privacy and anonymity are central, the concept of personal ownership of data does not appear to be a priority. There is a thirst to use health data for the common social good from the top of government to those generating the data. However, given the privacy concerns with previous national policies, it is crucial that the opinions of people with diabetes are actively sought and addressed. In summary, health data is analogous to nuclear waste: valuable if it can be processed in well-managed, high-security facilities, but dangerous if improperly handled or, worse, allowed to leak out into the environment.23 There are no conflicts of interest declared. References are available in Practical Diabetes online at: https://wchh.onlinelibrary.wiley.com.