INSIGHT: Former HHS Official Says Health Data Must be Portable, But Don’t Forget the Consumer

Health information is among the most sensitive and valuable data about us, yet more and more health information is outside federal privacy law protection, and companies have few or no limitations on how this data can be used or shared.

The Department of Health and Human Services (HHS) is preparing to release new regulations to promote interoperability and patient access to data, and more companies than ever before are collecting and using data to power advanced data analytics, artificial intelligence, and machine learning to improve health care treatment and customer service. Federal policies and private sector practices should protect individuals’ interests as all stakeholders consider appropriate use of health data.

Eighteen years ago, the HIPAA Privacy and Security Rules aimed to address many concerns around “protected health information” (PHI) in health care settings that were just starting to embrace electronic data. The Privacy Rule required covered entities and their business associates to limit the use and disclosure of PHI, and to provide patients with certain rights, including access to their own information.

HIPAA does not address the handling of PHI by other entities, typically referred to as “non-covered entities,” including many new consumer health technology companies (and even some healthcare providers who don’t accept insurance). Limited protections exist for data held by these entities under current state and federal law.

Challenges

As the health care industry changes rapidly and the federal government pushes toward increased interoperability and greater patient access to data, it is important to balance data portability and consumer protections.

With an estimated 86.7 million U.S. consumers owning wearable devices by 2019, patients are generating billions of data points that provide insight into their health. Yet many of these companies are not subject to existing privacy protections under HIPAA.

While many non-covered entities are transparent about their data uses, their long and detailed privacy policies are not read or understood by most consumers. HHS tried to address this issue by publishing a Model Privacy Notice to provide a simple, user-centered design approach for communicating complex privacy information. In 2016, HHS released a report concluding that significant gaps in regulatory oversight exist between covered and non-covered entities. Some of these challenges include:

• Individuals may not understand when data about their health is protected by law, and when it is not. It is often unclear to both companies and consumers whether HIPAA applies to certain health data and if so, what HIPAA protection means.
• Cybersecurity may be a greater issue as data is collected by Internet of Things (IoT) devices. As more IoT devices generate and store health data, new security risks may emerge, with limited requirements to mitigate these risks.
• Individuals may have limited data rights outside the HIPAA context. Individual rights under HIPAA, including the right of access and amendment of data, do not carry over to data held by non-covered entities, leaving individuals with variable control over data held by these entities under state laws.
• Inconsistent protections may limit health innovation. Data holders covered by HIPAA may be less willing to share data with non-covered entities that are not subject to the same protections. Sorting out this regulatory complexity can take significant time and resources, creating a barrier to entry for smaller startups.
• HIPAA coverage may drive unanticipated market decisions. Companies that have difficulty accessing data to develop new products and services may look for creative solutions, including acquisitions and joint ventures designed solely to enable access to health data.

The Path Forward

Innovators are increasingly acquiring large quantities of health information to power machine learning to make new health care products and services. These health datasets are a target for those who wish to make money off of the data and for those that see an opportunity to threaten national security. Health care data is too fluid, and too valuable, to protect only when it resides with a particular data holder. Reasonable baseline privacy protections for all health information will engender greater trust in the health technology sector.

Different approaches to address these gaps include:

• Extend HIPAA to all health data. This is fraught with problems because HIPAA was not intended for all types of data holders.
• Create new privacy rules and carve out HIPAA protected entities or data. This would increase consumer protection; different rules would need to be harmonized.
• Impose consequences on certain uses of data. There can be legal prohibitions on certain uses of identifiable data, such as discrimination in employment, or re-identifying de-identified data.
• Keep the status quo and let the market decide. This puts the burden on the individual, who may not be in the best position to protect their data. Individuals may not understand how to protect their data and patients may not be in a position to freely refuse a particular service or application and have limited or nonexistent bargaining power.

The first three options require legislative action.

Best Practices

In the meantime, baseline privacy and security best practices for any entity that holds identifiable health data may be helpful. For example:

• Transparency: Be open about data practices, including engaging, plain language, user-centered approach to describe data collection, use and disclosures, and privacy and security practices.
• Effective consent: Take timely, user-friendly steps to alert individuals to privacy policy changes or notify/obtain permission when a consumer action may trigger additional data sharing.
• Security: Adopt established industry practices for security protections, such as multi-factor authentication and encryption of data at rest and in transit.
• Consent for particular uses/disclosures: Secure an individuals’ express consent after clear disclosure of company’s financial interest before selling individuals’ health data to third parties.
• No discrimination: Do not use health data to discriminate against an individual.

Many of these concepts have their roots in existing federal laws or the Fair Information Practices Principles. They could help build trust and they would not prevent innovation. Industry established policies can guide industry action or be relied upon or referenced by policy-makers.

Author Information

Jodi G. Daniel is a partner in Crowell & Moring’s Health Care Group in Washington, D.C., and a director at C&M International (CMI), an international policy and regulatory affairs consulting firm affiliated with Crowell & Moring. She leads the firm’s Digital Health Practice and was formerly the founding director of the Office of Policy in the Office of the National Coordinator for Health Information Technology at HHS.