Author Affiliation: Suffolk University Law School, Boston, Massachusetts.
The allocation of $19 billion by the US Congress to promote the adoption of electronic medical records makes feasible the collection of aggregate patient data that could vastly improve patient safety, public health monitoring, and medical knowledge. The US Food and Drug Administration could ascertain the percentage of patients who experienced adverse reactions from a specific drug, then warn physicians or take other action. Researchers could learn how patients respond to alternative therapies and assess their relative effectiveness and safety. They could study populations and variables not present in clinical trials and compare medical facilities and health care systems. It is no surprise that Academy Health advocated “development and dissemination of secondary health data as a public good.”1
Yet today, organizations with medical, prescription, and billing records treat patient data as if those data were their private property. Doing so precludes forming comprehensive databases required for the mentioned uses, and limits access to data, perversely restricting many other beneficial public and private uses. Currently, organizations that possess patient data sell them (stripped of identifiers so the data are anonymous) to medical information organizations, who resell the data to end users.2 IMS Health, the largest medical information organization, operates in more than 100 countries and earned more than $2 billion selling medical data in 2006.3 Medical information organizations foresee an expanding market for data-related products and services.
Patients and the public have a strong claim to access aggregate patient data. Patients supply the information. Data are collected because patients and the public finance medical care through fees, insurance premiums, and taxes. Private parties should not profit to the detriment of patients and the public by restricting their access to the data. Core values of medical professionalism—the promotion of patients' interests, medical knowledge, and public health—also support public ownership. Federal law should require reporting certain patient data—anonymized to protect patient confidentiality—to a federal agency for public use. That would allow collective benefits not otherwise available and spur private development of valuable data-related services.
In most states, the law treats patient medical records as physical property that physicians and hospitals own, but allows patients and insurers access to records.4 Privacy laws restrict hospitals and insurers from disclosing confidential patient information, but it does not preclude its use in other ways. However, the law has not granted physicians or hospitals exclusive rights to patient data.5
Electronic records create new issues because it is easy to transfer data from records. Some organizations sell patient data and try to restrict data use to those who purchase data from them or those to whom they grant access. So far the law has not precluded others from using the data. In short, property rights in patient data are unclear.
There are strong grounds to hold that such data are not intellectual property. Today, the law recognizes that private ownership of information inappropriately restricts public use. Although the 1790 US Copyright Act granted copyright for compilations of information, the 1976 Copyright Act only granted copyright for original selection of data. In 1991, the US Supreme Court held that only compilations of information involving creativity can be copyrighted.6 Aggregate patient data represent information that courts are unlikely to deem involve creativity. There is no precedent for copyrighting patient data in the United States or the European Union.
As a result, some lawyers advise clients to arrange patient data in new formats to obtain copyright protection in their database.5 Some firms use technology that restricts data use to those individuals with permission. Data sellers typically draft contracts that limit purchasers from disseminating data without authorization. If legislation does not create an alternative framework, courts might enforce these contracts and thereby limit the use of patient data.
However, there is precedent for ensuring public access to certain medical data. The law requires physicians to report certain communicable diseases and other medical information relevant to public health and safety to public authorities. Medicare requires hospitals to report cost data, uses those data to determine reimbursement, and makes that information public. Several New England states make all payer databases available for analysis. California requires its hospitals to report patient discharge data and makes the data available for a small fee.
The Heritage Foundation and others committed to unregulated markets advocate private ownership of patient data.7 They maintain that public authorities should have to purchase patient data from firms. During the most recent Bush administration, the National Coordinator for Health Information Technology promoted private data markets. The American Medical Informatics Association maintains that insurance companies, health data exchanges, health data banks, and patients should develop voluntary guidelines for data stewardship and data sharing.8 However, such guidelines would reflect the interests of data sellers rather than the public.
In 2007, the Agency for Healthcare Research and Quality proposed creation of a National Health Care Data Stewardship Entity to set standards for sharing and aggregating data on quality and efficiency. Three private organizations (The National Commission on Quality Assurance, the National Quality Forum, and the Joint Commission) proposed that they operate the entity, determine data ownership rights, and charge for their work. They emphasized that data contributors will “want to maintain a competitive advantage, based on the value of their data.”9
The economic benefits that usually support private over public ownership do not exist here. Private ownership is unnecessary to ensure production of data because the data already exist. Physicians, hospitals, and insurers record patient data to perform their work, comply with the law, or receive payment. They will continue to record patient data whether or not they can sell the data.
Furthermore, patient data appear to be an example of private ownership that preclude downstream inventions and benefits for individual owners and society. When numerous parties own building blocks for innovations, sometimes the cost of combining them can be prohibitively expensive, creating a situation that economists call the tragedy of the anti-commons.10 Andrews11 has shown that patenting genetic sequences monopolizes raw material needed for research, creating such tragedies. For example, Athena Neuroscience Inc patented apolipoprotein E, an Alzheimer disease–related gene. Myriad Genetics received a European patent covering breast cancer diagnoses that compares the patient's BRCA1 gene with its patented BRCA1 sequence. Researchers searching for treatments of these diseases need permission from patent owners to use their gene sequence.
Similarly, private ownership of patient data would fracture comprehensive population data, precluding its most valuable public uses. If patients have exclusive property rights to their medical data, the cost of collecting population data will be prohibitive. Granting ownership of patient data to physicians, hospitals, or insurers would allow larger databases, but still fracture population data and impose exorbitant aggregation costs. Unlike private firms that seek data for targeted uses, governmental oversight and public health monitoring require comprehensive data. Public authorities will lack sufficient funds to purchase comprehensive data. Moreover, even if government has ample funds, some owners will withhold data to reduce liability risk, negative publicity, or to protect their market share.
Patient data have value mainly for services and analysis derived from them, but development of these services are restricted by private data ownership. Data owners can tie the sale of their services to their data, thereby creating a monopoly in data analysis and services. Such monopolies disappear when government authorities make data public. Then, multiple individuals and organizations can use the data for their own use or compete to produce data analysis and data services.
Commercial firms use medical data to expand their markets and compete with rivals. As such, they often restrict public access to data. In 2006, when Partners Healthcare planned to commercialize its patient data, it opposed Massachusetts plans to amass and make data available.12
Data from clinical trials provide a more troubling example. Pharmaceutical firms conduct trials to demonstrate drugs are safe and effective to receive Food and Drug Administration marketing approval. They oppose competitors using their data in applications to market generic versions of their drugs. The 1994 treaty, Trade-Related Aspects of Intellectual Property, restricted generic manufacturers' use of clinical trial data of other firms. Rewarding firms that invest in research can justify delay in marketing generic drugs. But keeping research data secret also may suppress information about health risks.
Some pharmaceutical firms have suppressed research data that reveal health risks by publishing partial data, thereby distorting the results. The International Committee of Medical Journal Editors believed that not publishing the full data was inimical to good science and medicine. Its members agreed in 2005 not to publish studies based on clinical trials that were not publicly registered. In 2007, Congress required that clinical trial sponsors register trials with the National Library of Medicine, which makes the information public.13 Yet disclosure restrictions remain, the tension between commercial and public interests persists, and some argue that all research data should be public.
It is essential to ensure the privacy and security of individual patient information. However, private ownership does not offer greater protection than public ownership. The 2003 Health Insurance Portability and Accountability Act amendment allows covered entities to share patient data with health care–related businesses, and to share data that do not reveal the individual patient's identity.14 Today, for-profit firms sell data with little oversight.
Moreover, public ownership allows greater controls over the negative use of patient data than regulation of privately owned data. The US Constitution's Fifth Amendment prohibits the state from taking property without compensating owners. As a result, courts often do not allow government regulation that restricts certain economic uses of private property without their compensating owners, a limit on the government's ability to regulate.
Federal policy makers should require all hospitals to report the same data that California already requires to the Department of Health and Human Services or a public authority created for this purpose. Other medical institutions (ambulatory care surgery centers, rehabilitation facilities, nursing homes, and community health centers) should be required to report similar data, and clinicians should report drug prescribing and dispensing data, data collected for billing, quality information, and certain other data from patient records. Physicians and medical facilities should submit the same information to Department of Health and Human Services as they do to third-party payers when seeking payment. The aggregated data should be reported and made public in a way that allows analysis of patient care by hospital, physician, diagnosis, procedure, therapy, and drugs prescribed.
Public ownership of patient data can protect patient privacy and spur its beneficial private uses, while also developing its use for public health and safety, which is not possible if patient data are private property. Physicians should advocate for such policies to further core medical values.
Corresponding Author: Marc A. Rodwin, JD, PhD, Suffolk University Law School, 120 Tremont St, Boston, MA 02140 (firstname.lastname@example.org).
Financial Disclosures: None reported.
Rodwin MA. The Case for Public Ownership of Patient Data. JAMA. 2009;302(1):86-88. doi:10.1001/jama.2009.965