By I. Glenn Cohen
As has been well reported in the media, there is a controversy brewing over nonprofit hospital chain Ascension sharing millions of patient records with Google for their project codenamed “Nightingale.” (very Batman, if you ask me!) Most of the discussion so far, and the answers have not yet become pellucid, concerns whether the hospital and Google complied with HIPAA.
This is important, don’t get me wrong, but it is important that conversation not ignore a more important question: Is the existing HIPAA regime adequate to do what we want it to do in an era of big data? As Michelle Mello and I argued in JAMA in August concerning a lawsuit relating to the sharing of medical records between the University of Chicago and Google, these stories expose a “US health data regulatory regime that is showing its age.” In particular, the reliance on patient authorization (especially more blanket front door versions) that have often been the basis for justifying data sharing are not an ethically sufficient way forward. Patients “are rarely given the information and opportunity to ask questions needed to give meaningful informed consent to future uses of their data. Even if those problems could be overcome, it is asking a great deal of patients to imagine and assess how their information may be used and what the risk of reidentification maybe.” Moreover, what happens when the risks and benefits change over time but the authorization remains in place?
We instead recommend seeing authorization as merely one of several possible “governance technologies” and we recommend looking at different approaches. One important one more downstream (at the time of a particular use rather than at the time of collection) and group rather than individual based. We explain how such patient data use committees that have real meaningful patient input can operate.
While the media focuses on whether Google and Ascension have complied with the law, we must also ask the more important question: is that current law working or should it be reformed?
