Rights in Health Data
Total Page：16
File Type：pdf, Size：1020Kb
Rights in Health Data Yochai Benkler, William Fisher, and Kurt Walters January 2021 Version 3.1 Introduction .................................................................................................................................... 3 I. Business Initiatives ..................................................................................................................... 5 “Sloan Kettering’s Cozy Deal with Start-Up Ignites a New Uproar” ................................................ 5 “Hu-manity Wants to Create a Health Data Marketplace with Help from Blockchain” ................ 9 “GlaxoSmithKline strikes $300 million deal with 23andMe for genetics-driven drug research” . 10 “Google’s ‘Project Nightingale’ Gathers Personal Health Data on Millions of Americans” ......... 11 II. Laws ......................................................................................................................................... 14 A. United States ................................................................................................................................. 14 1. General Principles ........................................................................................................................................... 14 Greenberg v. Miami Children’s Hosp. Research Inst., Inc. ........................................................................... 14 Note on Patent Protection for DNA Sequences ............................................................................................. 24 2. The HIPAA Framework ................................................................................................................................. 25 3. State Systems .................................................................................................................................................. 28 New Hampshire ............................................................................................................................................. 28 Colorado ......................................................................................................................................................... 30 Indiana ........................................................................................................................................................... 33 B. European Union ................................................................................................................................ 34 III. Reform Proposals ................................................................................................................... 36 Property, Privacy, and the Pursuit of Interconnected Electronic Medical Records ....................... 36 Much Ado About Data Ownership ...................................................................................................... 41 1 Report to the President—Big Data and Privacy: A Technological Perspective .............................. 45 “President Weighs in on Data from Genes” ....................................................................................... 46 The President Says Patients Should Own Their Genetic Data. He’s Wrong ................................... 47 Oregon Senate Bill 703 .......................................................................................................................... 49 2 Introduction “Health data,” as we will use the term, refers to information about a person’s body relevant to that person’s health. Types include medical records; test results; information concerning medications, treatments, and the results thereof; genetic information; vital statistics; and demographic information.1 In recent years, the potential uses of such data have grown rapidly. Three developments have contributed to this trend. First, the technologies for gathering information of these sorts have improved. For example, genetic testing has become increasingly feasible and affordable, and growing numbers of people (at least in developed countries) now wear devices that monitor their vital signs. Second, the percentage of hospitals and health-care professionals who store information in electronic rather than paper form has increased sharply. In the United States, for example, usage of electronic health records grew from one in ten doctors in 2009 to nine in ten in 2018, spurred by federal incentivizing of the practice.2 Third, software that facilitates “mining” aggregations of that data has become increasingly sophisticated. The net result is that health data are now being harnessed in myriad ways. They include: • Diagnosis. Already algorithms developed using machine learning and large databases of test results have proven to be at least as accurate as trained pathologists in detecting tumors.3 • Treatment. For instance, analysis of data on patients’ responses to drugs are enabling identification of hitherto unknown adverse interactions between drugs, which in turn prompts physicians and pharmacies to avoid prescribing them in combination.4 Another example: several companies are now at work analyzing databases concerning multiple aspects of cancer patients and their treatment histories to create increasingly personalized treatment plans for future patients. 1 Cf. Jorge Contreras, The False Promise of Health Data Ownership, 94 N.Y.U. L. Rev. 624, 626 n.2 (2019) (using the term, “individual health information” in a similar sense). 2 Stanford Med., White Paper: The Future of Electronic Health Records 2 (2018), http://med.stanford.edu/content/ dam/sm/ehr/documents/EHR-White-Paper.pdf. 3 See Yun Liu et al., Detecting Cancer Metastases on Gigapixel Pathology Images, ArXiv (2017), https://arxiv.org/abs/1703.02442. 4 One of the most ambitious of these initiatives is FDA’s Sentinel System. Launched in 2008, it aspires to improve safety monitoring of FDA-approved treatments. Its priorities for the five years from 2019–23 center on “innovations emerging from new data science disciplines, such as natural language processing and machine learning,” and “expand[ing] its access to and use of electronic health records.” U.S. Food & Drug Admin., Sentinel System: Five- Year Strategy A1 (2019), https://www.fda.gov/media/120333/download. In fact, much of what the Sentinel System does is aggregate and analyze patient data: “Within a privacy preserving ‘distributed data system,’ the Sentinel Initiative applies data science to patient data derived from health insurance companies, healthcare systems and academic institutions (with electronic health record systems). Sentinel allows the FDA to better understand post- market safety issues and inform regulatory decisions to improve patient safety.” Murray Aitken et al., IQVIA Inst. for Human Data Sci., Advancing Human Data Science 21 (2019), https://www.iqvia.com/-/media/iqvia/pdfs/institute- reports/advancing-human-data-science.pdf. 3 • Reducing Medical Costs. For example, hospitals assess trends in bed use when considering how to allocate physical space.5 • Curbing Infectious Diseases. Several companies have drawn upon multiple sources of data to predict and thus block the transmission pathways that drive the COVID-19 pandemic.6 • Insurance and Advertising. Companies selling health insurance and medical treatments have an obvious economic interest in data concerning the health of their potential customers. Such companies typically disavow using data for these purposes, but some consumers and public-interest organizations are skeptical.7 The profits or savings associated with these various uses have given rise to a growing global market for health data. Estimates of the size of that market vary, but it surely now exceeds $20 billion per year.8 As these uses of health data have multiplied, controversies concerning who should have what rights to control or profit from them have become more common. This module considers how the law has resolved such controversies and how it could do so better. Part I describes four recent business initiatives that implicate in different ways these issues. Part II summarizes the legal rules that currently govern uses of health data in the United States and the European Union. Part III contains some proposals for reforming those rules. As you read these materials, try to answer the following questions: 1) In what ways can we expect that health data will be used in the future? 2) Which of the existing or potential uses of health data are socially beneficial? 3) To what extent should a person be entitled to prevent uses of data derived from his, her, or their body? 4) To what extent should a person be entitled to share in the revenue generated by uses of data derived from his, her, or their body? 5) To what extent should health-care providers be entitled to control or profit from uses of the information generated through the services they provide? 6) What does or should “privacy” entail in this new environment? 5 See Shaun A. Langley et al., A Methodology for ProJecting Hospital Bed Need: A Michigan Case Study, 5 Source Code for Biology & Med., no. 4, 2010, at 1, 1, https://www.ncbi.nlm.nih.gov/pmc/articles/PMC2861647/. 6 See, for example, Jessica Kent, Machine Learning Tools Predict Impact of Quarantine on COVID-19, HealthITAnalytics (Apr. 22, 2020), https://healthitanalytics.com/news/machine-learning-tools-predict-impact-of- quarantine-on-covid-19; Christine Wei-Li Lee, UCLA Machine Learning Model is Helping CDC Predict Spread of COVID-19, UCLA Newsroom (May 18, 2020), https://newsroom.ucla.edu/releases/machine-learning-model-cdc- covid19;