Noosheen Hashemi is founder and CEO of January AI.

GETTY

The health tech sector is expanding rapidly, having received an infusion of capital at the start of the pandemic that is proving to be a new status quo. The outlook is promising for what continued digitization and technological innovation can bring when it comes to healthcare.

And one of the most exciting things happening in the health tech space doesn’t require the design of new technologies or the development of new therapies; rather, it’s a smarter and more efficient way of leveraging what we already have: healthcare data.

I’ve argued the benefits of individuals owning their own healthcare data in the past, and the points in favor are clear, from increased privacy to greater consumer choice. The larger question, then, is how such a paradigm can be implemented.

How will health data be protected?

The Interoperability and Patient Access Final Rule that went into effect in the summer of 2020 is a mandate, and the opportunity it presents is a gift, in my opinion. By ordering CMS-regulated insurers to make patient data accessible, it lays the groundwork for consumer data ownership, with built-in safeguards to privacy and security like API guidelines and best practices. These include the importance of following both CMS and FTC regulations around app-building, which will require collaboration among legacy healthcare, newer health tech and other tech stakeholders.

As healthcare data-sharing stands now, it’s simply not up to the challenge (registration required). Many health apps and EHRs are currently vulnerable to hacking. What’s more, they’re not all transparent about how consumer data is being collected and used. A lack of broad data security has also caused serious issues across many industries, leading the government to assert its goal of cracking down on cybercrime.

Data tools that are mobile-friendly and compatible with accessibility aids will be key. While the purpose-built APIs being introduced by some companies in response to the Final Rule are essential, a data democracy will go further in ensuring that everyone can access their data and do with it as they wish.

What are experts saying now?

Other crucial considerations, like those suggested by health tech co-founder Murali Kashaboina, include establishing individual business associate agreements with each vendor providing tech services as part of healthcare, with reinforced liability and indemnification and the use of biometric-reliant multi-factor authentication. Sensitive information must be securely encrypted at the data and transport layers, and there must be automatic encryption of any data stored on a device at the consumer or provider level.

Health tech companies that want to take advantage of the open healthcare data paradigm would do well to not only meet its requirements but exceed them. This means giving people the streamlined experience and breadth of choice they’ve come to expect from other sectors of consumer technology. Furthermore, this means giving them the option to not only own their data but also sell it back to the companies that are currently getting it for free.

Keeping healthcare data secure while also allowing for the sharing necessary to elevate care quality and patient choice is vital. Legislators and tech and healthcare professionals will have to work as a united front to be sure both the laws and the tech are secure. The U.S. is currently without an overarching data protection structure, and updated and comprehensive legislation, similar to the U.K.’s Data Protection Act of 2018, would be helpful. The key difference is that rather than consumers paying a fee to request their information, companies should be the ones paying for access.

As Cambridge Analytica whistleblower and co-founder of the Own Your Data Foundation Brittany Kaiser asserts, nothing should be by default — everything should be opt-in. This means companies will have to present compelling and clear reasons for why someone should allow them to collect their data, and people should still have ultimate ownership over the information.

How would this health data-sharing utopia work?

If everyone from big tech to employers and health insurance plans can collect and profit off of peoples' data, then they should be able to do the same. Organizations like Get My Health Data are working to help consumers understand and enact their rights around data ownership, but we can go further.

In order for data to be truly available, it’s essential that all people are afforded the same access. Organizations like the Own Your Data Foundation are pushing to raise awareness of the possibility of data ownership and lobby for legislation that can make it a reality.

As 23andMe CEO Anne Wojcicki points out, the idea that consumers shouldn’t have the right to say how their information should be stored and shared is insulting. Instead, I posit that consumers should be given the education and resources to make informed decisions about it.

Tech CEO and World Economic Forum Managing Board member Murat Sönmez suggests commercial apps looking to use the data could be certified by a third party; users could then opt in to each individual app’s terms and receive compensation. Not only would this create a fairer health data dynamic, but it would also give consumers a burst of income.

If someone wants to make their data available for use by those major companies currently profiting off of it for free, they should be able to sell it to them. It should be stored somewhere neutral and consumer-owned and meted out according to consumer choice. If someone wants to donate their data for research, they should be able to. And if they want to be able to fund causes they care about with the sale of their data — rather than watching it go into a company’s ad-buy coffers — that’s their prerogative.

Health data ownership is health equity.

Allowing people to take control over the provisioning of their health data means they can take a more active role in ensuring that their healthcare is tailored to their needs — and individualized healthcare is equitable healthcare. All of a consumer's data should be accessible to them, always.