Who Owns Patient Data in Clinical Research?

Charlotte J. Haug, MD, PhD, MSc, International Correspondent, New England Journal of Medicine; Senior Scientist, SINTEF Techology and Society; Adjunct Affiliate, Stanford Health Policy; Oslo, Norway;
Email: charlottejohanne@gmail.com

Q: Many people are coming to believe that active patient participation will be a key to more rapid movement forward in cancer research. Data sharing can help. But who owns the data? And what rights and responsibilities are thus conferred? Your recent NEJM article provides helpful background. Can you help us better understand?

A: Exchange of data between patients and doctors is essential for the practice of medicine – and patient data are essential for medical research and progress.
Traditionally, doctors collected patients’ health information (typically the medical history, laboratory tests, drugs prescribed, outcome of treatment, etc.) and sometimes shared that information, in confidence, with colleagues to seek advice and advance science. The medical record was the physician’s property, and still is in many countries and legislations. But do physicians own the patient data?
In clinical research, patient data from many sources must be collected and analyzed. Researchers must have explicit and informed consent from participating patients to do this, but when they have such consent they are free to use the trial data any way they wish. This is true even for commercial purposes – the norm for drug trials. But do researchers own the patient data?
Until quite recently the question of who owns patient data collected in clinical practice and clinical trials has not been discussed very much, mostly because it hasn’t been very important. Medical records and research results were analyzed and archived on paper. It was difficult, if not impossible, to reuse those data for anything else. Claiming ownership had no real value.
Internet, digitalization of medical records and datasets, and the vast increase in data-storage and data-processing power (especially over the last decade) has changed that. Since it is now possible to combine and reanalyze huge datasets quickly in totally new ways to create useful information about diseases and treatments, it is important to clarify who owns the data in order to clarify who can give permission to share and use data in ways beyond the original intent.
So far, the discussion about data sharing and data ownership has largely taken place between clinical trialists (who spend years collecting, curating, and analyzing data from clinical trials) and data scientists (who would like to add value to those data by reanalyzing and reusing them in novel ways). Both sides claim to have the patient’s and the public’s best interests at heart. But not many have asked patients what those interests are.
At a NEJM conference earlier this year, patients were asked this question. It turns out most of them want to share their data and to share them quickly, especially to ensure that other patients know about possible side effects. But they also want some control over how the data are shared. For example, they would be more hesitant to participate if commercial or other interests were involved. Which is unfortunately the case in most clinical trials. Something many of the patients didn’t seem to be aware of.
But the new “digital patients” also don’t want to be passive observers and sources of research data. They want to use the power of the Internet to engage in their own care, interact with clinicians and fellow patients, create new knowledge, and suggest new ways of delivering health care. They believe in sharing data and experiences to help themselves and fellow patients.
Patients want their data used responsibly and to take part in generating and curating the data. So perhaps the question needs to be rephrased: Who should control how data are distributed and used by others? The patients themselves? Doctors and researchers? Research institutions or governments?
Laws vary from country to country. In the United States, for example, absent specific language to the contrary in informed consent documents, research participants don’t have to give specific permission for their deidentified data to be used by other researchers. Europe is moving in the opposite direction — requiring explicit consent for reuse of data or data sharing and allowing patients to withdraw their consent at any time.
Perhaps the solution to the data-sharing and privacy struggle lies in shifting data ownership and control to individual patients everywhere.
Charlotte Haug’s contact info is included in the author affiliations at the top of this page.
Copyright: This is an open-access article distributed under the terms of the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original author and source are credited.