What Do We Mean by Sharing of Patient Data? DaSH: A Data Sharing Hierarchy of Privacy and Ethical Challenges

Abstract

Background Clinical data sharing is common and necessary for patient care, research, public health, and innovation. However, the term “data sharing” is often ambiguous in its many facets and complexities—each of which involves ethical, legal, and social issues. To our knowledge, there is no extant hierarchy of data sharing that assesses these issues.

Objective This study aimed to develop a hierarchy explicating the risks and ethical complexities of data sharing with a particular focus on patient data privacy.

Methods We surveyed the available peer-reviewed and gray literature and with our combined extensive experience in bioethics and medical informatics, created this hierarchy.

Results We present six ways on how data are shared and provide a tiered Data Sharing Hierarchy (DaSH) of risks, showing increasing threats to patients' privacy, clinicians, and organizations as one progresses up the hierarchy from data sharing for direct patient care, public health and safety, scientific research, commercial purposes, complex combinations of the preceding efforts, and among networked third parties. We offer recommendations to enhance the benefits of data sharing while mitigating risks and protecting patients' interests by improving consenting; developing better policies and procedures; clarifying, simplifying, and updating regulations to include all health-related data regardless of source; expanding the scope of bioethics for information technology; and increasing ongoing monitoring and research.

Conclusion Data sharing, while essential for patient care, is increasingly complex, opaque, and perhaps perilous for patients, clinicians, and health care institutions. Risks increase with advances in technology and with more encompassing patient data from wearables and artificial intelligence database mining. Data sharing places responsibilities on all parties: patients, clinicians, researchers, educators, risk managers, attorneys, informaticists, bioethicists, institutions, and policymakers.

Keywords

health data sharing - ethical, legal and social issues - common rule - privacy - clinical and research data management - consent - HIPAA

Background and Significance

Sharing patients' medical data for treatment and research is beneficial for patient health and health care, essential research, improved public health, and developing new products, treatments, and services. However, in investigating the benefits, ethics, processes, and risks of data sharing, we discovered the term “data sharing” has a range of meanings and interpretations, potentially leading to harmful or unethical actions.

Several different regulations govern patient record privacy protections in the United States. The U.S. Health Insurance Portability and Accountability Act (HIPAA)[1] privacy and security rules, combined with effective cybersecurity, are intended to protect patients from misuse of their clinical data while also providing data to patients, their clinicians, and payers. HIPAA stipulates that data may be de-identified by removing 18 identifiers, for example, name and birth date, collectively known as personal health information (PHI). However, public agencies such as the U.S. Centers for Medicare and Medicaid Services, health care providers such as hospitals or pharmacies, and state agencies are not required to de-identify data for clinical purposes.[2] States and governmental health services (e.g., the military, Indian Health Service) vary regarding data protection and what data can be shared (e.g., alcohol and drug abuse, HIV, and mental health). Genetic data are particularly sensitive, as they are unique, and therefore impossible to de-identify. The Genetic Information Nondiscrimination Act (GINA) protects individuals against employment discrimination on the basis of their genetic information. However, it does allow employers to “request, require, or purchase genetic information” under six specific circumstances, including “commercially and publicly available” sources.[3] GINA defines genetic information as PHI and the HIPAA Omnibus Rule protects such information under the Privacy Rule.[4] Data concerning children and other vulnerable populations, student health data, and data that are considered especially sensitive (e.g., mental health, sexually transmitted diseases) are also covered by separate regulations and may require additional privacy protections when sharing.

States share and sell large volumes of hospital discharge data, as do insurance companies and pharmacies, which may erode patient trust and privacy.[5] [6] There are privacy threats even with de-identified or aggregated data. Pharmacies' medication data have sufficient patient-identifiable content that meets legal requirements for de-identification, which nevertheless can be used to identify individual patients.[5] Also, machine learning has advanced rapidly, making true de-identification increasingly insecure.[7] [8] [9] Legal scholars, privacy advocates, bioethicists, and informaticians, citing privacy and consenting concerns, have called for revising HIPAA and data privacy regulations, and made varied proposals for doing so.[2]

We explore ways in which data are shared and examine the ethical ramifications involving PHI exposure. To our knowledge, data sharing is usually thought of for patient care, public health, and research.[10] We present a six-tier hierarchy of multiple kinds of data sharing and consider the nuances of each. Privacy is an exemplar of potential conflicts among data sharing, organizational operations, and patients' interests. We review consent processes and the commercialization of PHI at different tiers. We generally limit discussion to data sharing within the U.S. regulatory environment.

We conclude with recommendations for data sharing to improve health care, enhance privacy, and facilitate ethical behavior. We hope our hierarchy and recommendations will help organizations enact more informed data sharing policies, mitigate possible patient harms, and reduce organizational liabilities. Our ordering of data sharing reflects these goals, even though there is some overlap, and our ranking is open to interpretation. We hope, too, that others will refine the hierarchy based on their experiences and emerging considerations.

Data Sharing: Tiers and Risks Hierarchy

DaSH, our Data Sharing Hierarchy, organizes data sharing by purpose, U.S. regulatory status, risks, and ethical considerations. We derived the tiers from our analysis of the current literature; our combined experiences in health care informatics and studies of ethical, legal, and social issues; and from ongoing research on data sharing practices.[10] In each tier, data originate with patients in increasingly less obvious ways (e.g., biometric apps, blood tests with many metrics). We arrange the tiers from low ethical risk to more fraught categories, reflecting, in part, different meanings of “data sharing” and increasing distance between patient and data. In addition to categorizing different kinds of data sharing, the six tiers reflect a hierarchy of risks and challenges.

The first tier encompasses primary uses of data essential to patient care. Sharing medical information for direct patient care includes data interchange and communication between patients and clinicians as well as family and caregivers, and is permissible for purposes involved in paying for care. Privacy safeguards are in place and enforceable under the HIPAA, Omnibus Rule and GINA Breach of confidentiality is possible but is low risk.

Secondary sharing (tiers 2–6) includes data shared with organizations not directly involved with patient care, such as research organizations, pharmaceutical firms, social media, device vendors, and commercial data aggregators. Thus, in tiers 2 to 6, we attempt to clarify different kinds of secondary data sharing and related concerns. [Table 1] lists examples of data sharing arrangements in each tier, the purposes they serve, and privacy protections. As data sharing becomes more complex, as reflected in our hierarchy from one-to-one communication to public agencies, researchers, and more parties, the risks to patients' privacy increase. We discuss each tier and related privacy, ethical, legal, and social implications.

Table 1 The Data Sharing Hierarchy of data sharing, showing types of data shared, and privacy and legal risks

Data Sharing Hierarchy
Type of data sharing	Purpose	Regulatory protections
Tier 1: Data sharing for direct patient care (a primary use of patient data)
Clinician-to-clinician	To provide patient records for patient changing clinicians or obtaining consultation	Yes, HIPAA and state laws
Within EHR/same organization	Direct patient care	Yes, HIPAA and state laws
Between health care organizations and/or health information exchanges	Direct patient care	Yes, HIPAA
With insurance companies	Payment	Yes, via treatment, payment, and operations HIPAA exclusions
Clinician-to-patient	• Sharing data as required by 21st Century Cures Act • Communication with patient • Appointments • Prescriptions • Referrals	Yes, HIPAA and state laws
Patient-to-clinician	• Communication with clinician • Appointment requests • Prescription requests • Patient generated data (e.g., blood sugar results, heart rates)	Yes, HIPAA and state laws
Tier 2: Data sharing for public health and safety (where all tiers below are secondary uses)
Between health care organization and governmental registries and agencies	Data collection for public health initiatives and public safety	Yes, HIPAA if BAA and DUA in place Some public health registries require full identification for contact tracing
Tier 3: Data sharing for research
Quality analysis (often only within an institution)	Data analytics for quality improvement	State laws
Scientific and clinical research	Knowledge discovery	Yes, the Common Rule, and HIPAA if BAA and DUA are in place
Data aggregation of de-identified data for scientific and clinical research purposes only	Knowledge discovery with the goal of creating new technologies, treatments, or products	Yes, the Common Rule and HIPAA if BAA and DUA are in place
Tier 4: Data sharing for commercial purposes
Research	New knowledge discovery	Yes, the Common Rule, GINA, and HIPAA if BAA and DUA are in place
Quality improvement projects (often only within an institution)	Discovery of patterns, best practice guidelines	Generally protected by the Common Rule. If shared, then HIPAA de-identification exception allows sharing
Commercial data aggregation for	a) studies for safety, efficacy, outcomes of specific drugs	Yes, the Common Rule, GINA, and HIPAA
	b) new studies for possible additional clinical uses for specific drugs
	c) market studies of drug use
	d) targeting prescribing physicians for sales visits
	e) sell data to others	Uncertain HIPAA de-identification exception likely relied upon
	f) develop ML/AI for new knowledge discovery (compare tier 3) with intent to create products for sale (including back to the data source/originator)	Laws, regulations, and guidelines currently in their infancy
Process and analyze data for public health trends (compare tier 2)	Trending data of patients with various conditions at different time periods	No, unless data derived using HIPAA exception
Store and analyze individual patient data for specific reasons (e.g., suicide risk)	Dataset to be sold to or by social media, smartphone application, or similar companies to monitor for risk	No, HIPAA does not apply to these venues[23]; and GINA specifically excludes data given voluntarily[3]
Data sales from one commercial collecting entity to another	Varied, for example, targeted advertising, data aggregation, product development	Depends on end-user click-through agreement between user and collecting entity
Tier 5: Complex combinations of data sharing for commercial purposes		Problematic, even if de-identified
Data aggregators that sell data to others	a) Government programs to purchase ML/AI algorithms for public health or other purposes	Laws, regulations, and guidelines currently in their infancy
	b) Private companies to purchase ML/AI algorithms for public health or other purposes	Laws, regulations, and guidelines currently in their infancy
	c) For profit non-health care (e.g., news organizations, Facebook, TikTok) to purchase ML/AI algorithms for public health or other purposes	Laws, regulations, and guidelines currently in their infancy
Tier 6: Data sharing with networked third parties		Problematic, and complex legal arrangements
Networks or cooperative researchers (e.g., oncology groups)	Networks studying diseases, treatments, or cost reduction strategies	HIPAA, GINA
Industrial consortia	Develop new drugs, treatments, and algorithms	High risk if data derived from outside HIPAA-covered entities
Government agencies	Interagency data sharing	Usually exempted from the Common Rule, but not from HIPAA
International	Public health, for example, World Health Organization	Questionable application of U.S. laws internationally; GDPR
Social media and commercial interests	Marketing and advertising that is not covered by HIPAA	No, HIPAA does not apply to these venues[23]; and GINA specifically excludes data given voluntarily[3]

Abbreviations: AI, artificial intelligence; BAA, business associate agreement; DaSH, Data Sharing Hierarchy; DUA, data use agreement; EHR, electronic health record; GDPR, General Data Protection Regulation; GINA, Genetic Information Nondiscrimination Act; HIPAA, Health Insurance Portability and Accountability Act; ML, machine learning.

Tier 1: Data Sharing for Direct Patient Care

Medical personnel and institutions share patient-level data needed for direct patient care. To facilitate their availability when a patient is treated in different places, the recent 21st Century Cures Act requires that data be more readily sharable and thus more easily integrated into patient records. Patient records are widely protected both legally and by long-standing confidentiality norms.[5] Tier 1 data sharing is generally uncontroversial.

Long-standing confidentiality norms, reinforced by law, help protect privacy rights. Known breaches of patient record systems or violations of confidentiality are punishable legally and professionally. HIPAA requires that patients agree to data release if those data are not de-identified as per regulations unless a business associate agreement (BAA) and/or a data use agreement (DUA) are in place. Patients allow or refuse to share records with other organizations as a standard part of medical services' HIPAA statements and informed consent for treatment.[2] [11] [12] [13] The process is usually pro forma but is ethically suspect because it can be coercive, that is, refusal to consent can imply no treatment, even for gravely ill patients. Further, individual patients do not have the right to sue for damages, as HIPAA solely permits patients to report suspected problems to the Office of Civil Rights.[14]

Other issues arise from patients' ability to access records. Children's records are an example: states' laws determine when parents' unlimited access to an adolescent's health record ends, and how much information an adolescent (or adult) can access. This includes permission for the children's access to their mother's sensitive medical condition (e.g., HIV status), which becomes part of the child's record at birth. Additional considerations pertain to potentially stigmatizing data, such as mental health status, and whether patients should be able to block data release.

Tier 2: Data Sharing for Public Health and Safety

Explicit patient authorization is required to release non-de-identified data, except for purposes such as public health or law enforcement.[2] Reporting laws vary by nation and state regarding communicable diseases and other data but in general these include patient-specific data for public health agencies. The U.S. government requires reporting of patient-level health data to protect the common good, for example, public health. Although these data are critical to health care, they are not directly part of the clinician–patient relationship, as in tier 1. These data help trace disease outbreaks and track contacts. Other data that support public health include birth and death records, controlled substance use and abuse, gunshot and other traumatic injuries and deaths, cancer statistics, rates of some specific diseases and infections, and animal bites to monitor for rabies and other enzootic diseases. Law enforcement and national security agencies, too, may use health data for policing, criminal investigations, and controlling illegal activities. While sharing such data can and should be used in the public interest, some uses are controversial, as discussed subsequently. Much of these data are not de-identified, thereby facilitating sensitive data aggregation and privacy risks. Some of these practices are controversial and may prevent people from seeking care.[15]

Tier 3: Data Sharing for Research

Scientific and medical research depends on patient data: clinical studies, drug trials, epidemiological modeling, algorithm creation, and practice guideline development. Data may be shared among researchers at the originating or cooperating organizations or with government agencies responsible for research oversight. Some of these data necessarily are patient level, while some are aggregated. Researchers must be aware that sharing data involves a moderate risk of confidentiality breach, especially when sharing data with entities not covered under HIPAA.

The Revised U.S. Common Rule (45 CFR 46)[16] regulates privacy for data collected for medical research that involves human subjects. Protections are similar to HIPAA-protected clinical data shared with researchers, research sponsors, and others involved in data analysis. The agreements limit disclosures by third parties to act as if they were part of the originating health care organization. There should be restrictions in the BAAs and DUAs to govern further sharing or selling of the data to parties not part of the original contracts. Data sent to the U.S. Food and Drug Administration for clinical trials or adverse event reporting is an exception, even though it may be identifiable. This may contribute to some patients' reluctance to enter clinical trials.[17] [18]

Data collected for scientific research require explicit patient consent prior to release if the patient is identifiable.[2] However, the possibility of re-identifying HIPAA-compliant de-identified data raises further issues of consent and risks to patient data privacy.[19] Public awareness of these risks generated a strong backlash, with some calling for prohibitions against re-identifications.[20] [21]

Tier 4: Data Sharing for Commercial Purposes

The public appears not as enthusiastic about sharing patient-level data with businesses that monetize the data by generating marketable products.[22] The business uses include the creation of new drugs or commercial clinical decision support (CDS) algorithms. Moreover, when the CDS may be sold back to institutions contributing to those data, assumptions of consent, privacy, or even institutional control become dubious. Such data use may well violate the bioethical principle of justice by not compensating those who created or own the original data.

HIPAA and the Common Rule generally do not regulate nonhealth care enterprises.[23] Instead, end-user agreements signed by patients govern the data sharing, generally by clicking through to accept opaque policies users likely neither read nor understood.[23] The Federal Trade Commission enforces compliance with these agreements.[2] The degree of protection and enforcement varies. Voluntary sharing perhaps implies consent, at least for the purpose the patient intends, but we classify these often-opaque data sharing arrangements as highly risky.

Many complex arrangements among health care entities, patients, and commercial enterprises become more fraught when the intent is commodification of the data. Patients may want to know when data are used for others' profit or for purposes they find repugnant.[5] Patients who allow the sharing of data at their origin rarely profit from the subsequent sharing or sales. However, many patients often are both unaware and uninformed about these possibilities, making informed consent impossible for data sharing with unforeseen parties.[15] [17] [18] [24] [25] [26]

Nevertheless, individuals directly provide sensitive medical data to commercial entities voluntarily, such as ancestry and genetics websites, exercise monitoring devices, smartphone apps, and wearables. In addition to these kinds of health apps, people report personal information to social media, including information about their health, diet, and exercise, that are widely used by commercial entities.[23] These types of services use data for their own purposes, including selling them to other parties, thereby raising several ethical and legal issues. For example, Facebook's Meta allegedly used PHI scraped from hospital websites for sales to advertisers.[27] [28]

Tier 5: Complex Combinations of Data Sharing for Commercial Purposes

Whether profit is the original intent of sharing clinical data, health systems, employee health management systems, and government agencies often share data with data aggregators who combine information from many sources and sell those data to multiple parties. Multiparty contracts are seldom, if ever, apparent to patients, which increases legal, ethical, and moral concerns. As these various entities commodify data, downstream audits of data provenance and security become impossible to trace, privacy is impossible to guarantee, and consent is probably meaningless. Further, it makes correcting errors patients perceive in their records difficult to correct in downstream uses.[14] [29]

As explained above, patient-generated data, even patient-identifiable clinical information to monitor a patient's conditions and relevant environments, do not enjoy HIPAA protections when collected via health applications for mobile devices (mHealth).[23] This exception holds even if the data are incorporated into a patient's record. Indeed, some data appear in a medical record without patients' knowledge, such as through police, probation, social services, or education records; or from military, immigration, Indian, and veterans' health services[23]; or they are transferred automatically (sometimes without explicit consent), for example, between obstetric and newborns' records. Other information derives from social media postings, contact and geolocation tracking, ubiquitous sensors, and cars (e.g., to detect sleeping or speeding). Here we cannot assume consent, as patients have little choice and awareness of these practices. Even if they did, obtaining consent at each step in a chain of data transmissions would be difficult. With so much data seamlessly collected by many enterprises, many patients say they prefer to know when their data will be shared.

Tier 6: Data Sharing with Networked Third Parties

So far, we distinguished data flow from one organization to another, even if the data are then used in ways later unknown to the organization originally providing the data, let alone to the patients. In contrast, tier 6 reflects intentional many-to-many data sharing, as occurs among organizations in research networks, hospital associations, industrial consortia, government agencies, and combinations of these. The ethical and legal issues are more complicated than those for the lower tiers and amplified when information crosses jurisdictional boundaries governed by different regulations, professional or international agreements, and practices. These complications are the reason for this separate tier despite the difficulty of ranking and assessing such a variety of combinations.

Multiparty arrangements complicate privacy, consent, and data ownership. Even in seemingly simpler circumstances, patients rarely understand who owns the data about them. Especially when multiple parties are involved, as in tiers 5 and 6, determining ownership, which regulations (if any) apply, and how to enforce them becomes difficult even for experts. Dataset ownership is often a legal tangle, involving whether, which, and in what combinations data are controlled by patients, by collecting organizations or vendors, or by other parties.[5] Some health care organizations have reserved rights over such data to protect themselves from these issues. But some vendors sell data back to originating organizations, risking putting patients, health care organizations, and vendors at odds over data ownership. Another significant issue is whether organizations not involved in health care, such as news and social media outlets, should be allowed to have these data[30] but that is beyond this paper's purview.

Discussion

Many patients are understandably concerned about data privacy. Some may avoid care or withhold crucial clinical information for fear that it will be disclosed in ways that may harm or embarrass them.[18] [24] [26] “Data sharing” sounds good, but, as this hierarchy reflects, “data sharing” has at least six different meanings, all with vexing issues of privacy, expectations of the data's uses, and often insufficient explanations to patients, clinicians, and health care administrators—and mostly everyone else.

Our hierarchy seeks to explicate the ways data are shared and the concomitant risks to patients and organizations. Therapeutic relationships rely on widely accepted necessary confidentiality expectations between patients and clinicians.[5] However, most individuals have little idea what data are and are not protected, and have little opportunity to consent meaningfully to their data's release. Neither HIPAA nor the Common Rule protect de-identified data, which may be re-identified by combining data sources or machine learning methods.

The complexities concerning data sharing and privacy require transparency so patients know when and with whom such sharing is likely or possible.[2] [23] [31] Transparent and explicit disclosure of data sharing arrangements may help to ameliorate patients' fears.[23] [32] Moreover, data sharing practices require explainability, interpretability, concern for privacy protections, and consent where possible. We borrow these principles from those promoted for trustworthy artificial intelligence,[33] [34] [35] [36] [37] and those informing many data privacy laws and recommendations by professional organizations.[2] [7] [38] [39] [40] [41]

Sharing patient data beyond that needed for direct care offers myriad advantages to society, from improved treatments to scientific research to the creation of new products and techniques that may benefit millions of patients or generate beneficial and lucrative products. At the same time, sharing data offers opportunities for abuse and exploitation. Negative consequences of health data releases are legion, even without malicious intent, such as the inadvertent revelation about psychiatric treatments, obstetric/gynecological procedures, or a political candidate's cancer. The Supreme Court decision in Dobbs[41] resulted in state laws encouraging legal action against any who aid or treat those seeking abortions. This resulted in medical data releases in violation of HIPAA protections.[1] Similarly, state laws prohibiting transgender care led to governments' efforts to obtain medical records of those seeking or receiving such care.[42]

We have attempted to present some potential harms from medical data sharing. In our recommendations ([Table 2]), we offer some ways to protect patients and enhance the benefits of sharing. The higher the tier, the greater the degree of scrutiny needed by health care organizations and regulatory authorities to mitigate data sharing risks and potential harms to individuals and organizations.

Table 2 Recommendations for improved data sharing arrangements

R1: Make the consent process noncoercive and understandable. Patients experience opaque, time-consuming, and frustrating hurdles when granting access permissions and when obtaining their records. Consenting should be relevant, noncoercive, well-informed, convenient, and fully transparent.[40] [44] Standardize consent forms to be at a sixth-grade reading level and include clear lists or a table of what records will be released and to whom, and what records will not be. Treating regulatory privacy protections as organizational checkoffs is an ethical suspect.

R2: Make procedures for revoking permissions to share personal data clear and readily available. Inform patients if revoking data sharing is impossible or near impossible post hoc. Similarly, patients deserve to know if their data may be shared or used in ways not foreseen in the original consent document, and to afford them the opportunity to withdraw consent. At the very least, they should receive notification that it may not be feasible to withdraw consent for sharing their data when they are aggregated anonymously.

R3: Update and extend privacy protections. Not all data sharing is subject to HIPAA or the Common Rule health data protection. Even when they are, the regulations often are insufficient. Despite laudable updates, regulations need to be further updated and simplified to increase clarity while accounting for new developments in at least these three respects.[2] R3.1: Update HIPAA, GINA, and the Common Rule to reflect the abilities of new technology and methods for re-identification. Make it harder for individual patients to be identified from data and allow patients to sue to redress harms. Expand rules for de-identification that prevent and prohibit re-identification. Expand applicability of HIPAA to include third parties who obtain identifiable personal health information, or when those data can be re-identified. R3.2: Nearly all data are now potentially health data although neither HIPAA nor the Common Rule covers nonclinically sourced data.[31] Protections need to reflect this reality. Maintain strict adherence to privacy principles when using shared datasets, including full anonymization and use of “hiding in plain sight” ambiguation. R3.3: Clarify ownership and responsibilities. Commercial entities should be held accountable for overly broad, unenforced, or essentially meaningless consenting and data policies.[2] More is needed to develop desirable legal constraints to control commercial arrangements so they are fair to patients and organizations while enhancing public health, research, innovation, and privacy.

R4: Increase and amplify public information efforts to enhance people's awareness of data sharing's risks and benefits. Clinicians, researchers, and others should welcome the opportunity to inform the public about the uses of medical data.[40]

R5: Expand bioethics areas of interest to include information technology. Require research ethics and HIPAA training for health care staff, IRBs, etc. Often, current health care ethics certification programs focus on Belmont and Helsinki provisions.[44] They need to expand to include the ethical, legal, and social issues involving IT, AI, and databases.[45]

R6: Monitor medical research to periodically evaluate data sharing policies and procedures to incorporate new questions and considerations as they develop. Multidisciplinary perspectives and research methods can help ensure that diverse approaches and concerns are included in the analyses and the possible development of new outcome measures.[45]

Abbreviations: AI, artificial intelligence; GINA, Genetic Information Nondiscrimination Act; HIPAA, Health Insurance Portability and Accountability Act.

Our nine recommendations ([Table 2]) seek to enhance both patient information protection and to reduce the likelihood of clinicians and organizations facing liabilities. These recommendations reflect efforts to promote reasonable privacy, enhance innovation, improve consenting, and develop better policies and regulations for all health-related data regardless of source. Such actions also include expanding the scope of bioethics for information technology and increasing ongoing monitoring and research.[45]

Some of these recommendations require legislative and regulatory changes. These are necessary to reflect the current state of medical care, and the technological advancements, especially in the fields of genetics, de-identification, and cybersecurity (including the risks of ransomware). We do not feel these recommendations are either impractical or unattainable. Some may perceive these recommendations as increasing regulatory burdens, or even stifling rapid technological advancement, but we view them as protecting patients' privacy as the paramount concern.

Conclusion

Our analysis and recommendations draw on studies of patients' understanding of the consent process and improvement of consent wording,[43] and of health care organizations' data sharing practices and policies,[10] though more empirical research is needed. There are, of course, many more issues already apparent than we have enumerated. New ones will emerge with advances in technology, with better information about data sharing practices, and with new insights about the ethics of these advances. It is too early to predict all the implications of the recent aforementioned disclosures regarding Facebook, or the full extent of the Dobbs decision on possible conflicts between states with varying laws and HIPAA privacy stipulations. This is especially precarious to long-held privacy expectations. Patient advocacy groups, ethicists, and privacy scholars can help to identify and act on these and other risks.

Clinical Relevance Statement

Widespread data sharing practices place responsibilities on all parties: patients, clinicians, researchers, educators, administrators, risk managers, legal experts, informaticists, bioethicists, and policymakers. Emerging concerns generated by new technologies and laws may require new policies. It behooves us all to periodically examine the DaSH hierarchy and change it in response to evolving legal and political environments. This requires frequent monitoring, multidisciplinary research, and public discussion. We hope our hierarchy will spur additional dialogue, regulatory improvements, and more secure processes to benefit patients, health care, and society.

Multiple-Choice Questions

1. The authors express various concerns about data sharing beyond that needed for direct patient care. Which of the following is their greatest concern?

   • HIPAA de-identification exception

   • Risks of re-identification

   • Unauthorized access to PHI

   • Privacy loss beyond HIPAA

   Correct answer: d. The authors do express concerns about the adequacy of the HIPAA de-identification exception (option a.), that is, de-identified data, lacking PHI, are not covered by HIPAA, especially as this appears to be inadequate to prevent re-identification (option b.). Indeed, their recommendations include updates to the HIPAA rules (e.g., see recommendation 3.1). These indeed risk unauthorized access to PHI but that is already illegal (option c.). Privacy loss outside of HIPAA protections, such as via data brokers and other noncovered entities that have access to protected health information is their major concern.

2. The authors propose several recommendations to protect patients' interests. Which recommendation most directly assists patients in their understanding of the risks of sharing their data and may be the most achievable?

   • Improve the consent and withdrawal of consent procedures

   • Improve/Extend/Update/Enhance protections for all health-related data

   • Constrain commercial data sharing arrangements to hold entities accountable

   • Develop new bioethics principles as technology expands

   Correct answer: a. It most directly impacts patients and is less onerous than the other options. The authors advocate for all of the above; however, at least in the United States, option b. requires regulatory revisions at the federal level, option c. requires new laws by Congress, and option d. requires the development of bioethics principles, all of which are broad-based, not specifically impacting patients' understanding of sharing their data.

Conflict of Interest

None declared.

Acknowledgments

The authors gratefully acknowledge the contributions of our colleagues Brian Jackson, Victoria Nichols-Johnson, Anthony Solomonides, Paul DeMuro, and Larry Ozeran for their work related to data sharing. Authors would like to thank Joel L. Telles who read an early version of the manuscript and made many helpful suggestions.

Protection of Human and Animal Subjects

Neither human nor animal subjects were included in the project. Review by an Institutional Review Board was not required.

• References

• 1 U.S. Department of Health & Human Services. Uses and Disclosures for Treatment, Payment, and Health Care Operations: 45 CFR 164.506. 2003 . Accessed July 30, 2024 at: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/disclosures-treatment-payment-health-care-operations/index.html
• 2 Kaplan B. PHI Protection under HIPAA: An Overall Analysis. In: LGPD na Saúde (LGPD Applicable to Health). Editora Revista dos Tribunais (Thomsom Reuters); 2021: 61-88 . Accessed July 30, 2024 at: http://ssrn.com/author=2307861
• 3 U.S. Equal Employment Opportunity Commission. Fact Sheet: Genetic Information Nondiscrimination Act. EEOC Headquarters; 2014. . Accessed July 30, 2024 at: https://www.eeoc.gov/laws/guidance/fact-sheet-genetic-information-nondiscrimination-act
• 4 Adler S. What did the HIPAA Omnibus Rule Mandate? The HIPAA Journal. January 12, 2024. Accessed May 21, 2024 at: https://www.hipaajournal.com/what-did-the-hipaa-omnibus-rule-mandate/
• 5 Kaplan B. Selling health data: de-identification, privacy, and speech. Camb Q Healthc Ethics 2015; 24 (03) 256-271
• 6 Kaplan B. How should health data be used?. Camb Q Healthc Ethics 2016; 25 (02) 312-329
• 7 Kushida CA, Nichols DA, Jadrnicek R, Miller R, Walsh JK, Griffin K. Strategies for de-identification and anonymization of electronic health record data for use in multicenter research studies. Med Care 2012; 50 (suppl): S82-S101
• 8 Walters KM, Jojic A, Pfaff ER. et al. Supporting research, protecting data: one institution's approach to clinical data warehouse governance. J Am Med Inform Assoc 2022; 29: 707-712
• 9 Benitez K, Malin B. Evaluating re-identification risks with respect to the HIPAA privacy rule. J Am Med Inform Assoc 2010; 17 (02) 169-177
• 10 Jackson BR, Schreiber R, Koppel R. et al. Variation in Data Sharing Practices and Privacy Gaps in US Hospitals and Health Systems. American Medical Informatics Association Annual Symposium, Session 84, New Orleans, LA, November 2023. Accessed August 16, 2024 at: SSRN: https://ssrn.com/abstract=4544350
• 11 Walker J, Koppel R. For Healthcare Cybersecurity the Whole is Weaker Than the Sum of the Parts. The Health Care Blog. 2016 . Accessed August 16, 2024 at: https://thehealthcareblog.com/blog/2016/09/23/for-healthcare-cybersecurity-the-whole-is-weaker-than-the-sum-of-the-parts/
• 12 Koppel R, Thimbleby H. Lessons From the 100 Nation Ransomware Attack. The Health Care Blog. 2017 . Accessed August 16, 2024 at: https://thehealthcareblog.com/blog/2017/05/14/lessons-from-the-100-nation-ransomware-attack/
• 13 Subbian V, Solomonides A, Clarkson M. et al. Ethics and informatics in the age of COVID-19: challenges and recommendations for public health organization and public policy. J Am Med Inform Assoc 2021; 28 (01) 184-189
• 14 Sanyer O, Butler JM, Fortenberry K, Webb-Allen T, Ose D. Information sharing via electronic health records in team-based care: the patient perspective. Fam Pract 2021; 38 (04) 468-472
• 15 Anthony D, Stablein T, Carian EK. Big brother in the Information Age: concerns about government information gathering over time. IEEE Secur Priv 2015; 13 (04) 12-19
• 16 U.S. Department of Health & Human Services. HHS.gov. 45 CFR 46. Accessed August 16, 2024 at: https://www.hhs.gov/ohrp/regulations-and-policy/regulations/45-cfr-46/index.html
• 17 Anthony DL, Campos-Castillo C. Do Health Care Users Think Electronic Health Records are Important for Themselves and Their Providers? Exploring Group Differences in a National Survey. In: 2013 IEEE International Conference on Healthcare Informatics. Philadelphia, PA: IEEE; 2013: 141-146
• 18 Campos-Castillo C, Anthony DL. The double-edged sword of electronic health records: implications for patient disclosure. J Am Med Inform Assoc 2015; 22 (e1): e130-e140
• 19 Fussell S. Google's Totally Creepy, Totally Legal Health-Data Harvesting. The Atlantic. 2019 . Accessed August 16, 2024 at: https://www.theatlantic.com/technology/archive/2019/11/google-project-nightingale-all-your-health-data/601999/
• 20 Cohen JK. Google, Ascension data partnership sparks federal probe. Modern Healthcare. 2019 . Accessed March 14, 2022 at: https://www.modernhealthcare.com/information-technology/google-ascension-data-partnership-sparks-federal-probe
• 21 Cross B. Health secrets for sale: Interview with Dr. Deborah Peel. CBS Austin; 2016. . Accessed August 16, 2024 at: https://cbsaustin.com/news/local/health-secrets-for-sale
• 22 Winkler EC, Jungkunz M, Thorogood A, Lotz V, Schickhardt C. Patient data for commercial companies? An ethical framework for sharing patients' data with for-profit companies for research. J Med Ethics 2023 ;jme-2022–108781
• 23 Ozeran L, Solomonides A, Schreiber R. Privacy versus convenience: a historical perspective, analysis of risks, and an informatics call to action. Appl Clin Inform 2021; 12 (02) 274-284
• 24 Anthony DL, Campos-Castillo C. A looming digital divide? Group differences in the perceived importance of electronic health records. Inf Commun Soc 2015; 18 (07) 1-15
• 25 Anthony DL, Stablein T. Privacy in practice: professional discourse about information control in health care. J Health Organ Manag 2016; 30 (02) 207-226
• 26 Campos-Castillo C, Anthony D. Situated trust in a physician: patient health characteristics and trust in physician confidentiality. Sociol Quart 2019; 60 (04) 1-24
• 27 Orrick WH. Doe v. Meta Platforms, Inc. Casetext; 2023 . Accessed July 30, 2024 at: https://casetext.com/case/doe-v-meta-platforms-inc-2
• 28 Feathers T, Fondrie-Teitler S, Waller A, Mattu S, Chan A. Pixel Hunt: Facebook Is Receiving Sensitive Medical Information from Hospital Websites. The Markup. 2022 . Accessed August 16, 2024 at: https://themarkup.org/pixel-hunt/2022/06/16/facebook-is-receiving-sensitive-medical-information-from-hospital-websites
• 29 Kim J, Kim H, Bell E. et al. Patient perspectives about decisions to share medical data and biospecimens for research. JAMA Netw Open 2019; 2 (08) e199550
• 30 Siwicki B. Privacy & Security Perspectives: Interoperability, Prospects for HIPAA Refresh, More. Healthcare IT News. 2020 . Accessed February 22, 2022 at: https://www.healthcareitnews.com/news/privacy-security-perspectives-interoperability-prospects-hipaa-refresh-more
• 31 Kaplan B. Seeing through health information technology: the need for transparency in software, algorithms, data privacy, and regulation. J Law Biosci 2020; 7 (01) lsaa062
• 32 Liyanage H, Liaw ST, Di Iorio CT. et al. Contribution of the Primary Health Care Informatics Working Group. Building a privacy, ethics, and data access framework for real world computerised medical record system data: a Delphi study. Yearb Med Inform 2016; [phone]
• 33 Ryan M, Stahl BC. Artificial intelligence ethics guidelines for developers and users: clarifying their content and normative implications. J Inf Commun Ethics Soc 2021; 19 (01) 61-86
• 34 Hagendorff T. The ethics of AI ethics: an evaluation of guidelines. Minds Mach 2020; 30 (01) 99-120
• 35 Jobin A, Ienca M, Vayena E. The global landscape of AI ethics guidelines. Nat Mach Intell 2019; 1 (09) 389-399
• 36 Schröder C, Yavorsky S, O'Donovan DAI. Update: EU High-Level Expert Group Publishes Requirements for Trustworthy AI and European Commission Unveils Plans for AI Regulation. Orrick, Herrington & Sutcliffe LLP. Accessed August 16, 2024 at: https://www.jdsupra.com/legalnews/ai-update-eu-high-level-expert-group-73340/
• 37 Solomonides AE, Koski E, Atabaki SM. et al. Defining AMIA's artificial intelligence principles. J Am Med Inform Assoc 2022; 29 (04) 585-591
• 38 Anonymous.. Guide to the General Data Protection Regulation (GDPR).. Accessed August 16, 2024. at: https://ico.org.uk/media/for-organisations/guide-to-the-general-data-protection-regulation-gdpr-1-0.pdf
• 39 GDPR.EU. What is GDPR, the EU's new data protection law?. Accessed August 16, 2024 at: https://gdpr.eu/what-is-gdpr/
• 40 Rockwern B, Johnson D, Snyder Sulmasy L. Medical Informatics Committee and Ethics, Professionalism and Human Rights Committee of the American College of Physicians. Health Information Privacy, Protection, and Use in the Expanding Digital Health Ecosystem: A Position Paper of the American College of Physicians. Ann Intern Med 2021; 174 (07) 994-998
• 41 Supreme Court of the Unites States. DOBBS, STATE HEALTH OFFICER OF THE MISSISSIPPI DEPARTMENT OF HEALTH, ET AL. v. JACKSON WOMEN'S HEALTH ORGANIZATION ET AL. 597 U.S. 2021. Accessed August 16, 2024 at: https://www.supremecourt.gov/opinions/21pdf/19-1392_6j37.pdf
• 42 Brown M, Puente K. Vanderbilt turns over transgender patient records to state in attorney general probe. The Tennessean. 2023 . Accessed July 30, 2024 at: https://www.tennessean.com/story/news/health/2023/06/20/vanderbilt-university-m-turns-over-transgender-patient-medical-records-to-tennessee-attorney-general/70338356007/
• 43 Chevrier R, Foufi V, Gaudet-Blavignac C, Robert A, Lovis C. Use and understanding of anonymization and de-identification in the biomedical literature: scoping review. J Med Internet Res 2019; 21 (05) e13484
• 44 Lin GT, Mitchell MB, Hammack-Aviran C, Gao Y, Liu D, Langerman A. Content and readability of US Procedure consent forms. JAMA Intern Med 2024; 184 (02) 214-216
• 45 Kaplan B. Ethics, guidelines, standards, and policy: telemedicine, COVID-19, and broadening the ethical scope. Camb Q Healthc Ethics 2022; 31 (01) 105-118 . Accessed August 16, 2024 at: https://www.cambridge.org/core/product/identifier/S0963180121000852/type/journal_article

Publication History

Received: 29 March 2024

Accepted: 24 July 2024

Accepted Manuscript online:
25 July 2024

Article published online:
16 October 2024