A Policy and Practice Review of Consumer Protections and Their Application to Hospital-Sourced Data Aggregation and Analytics by Third-Party Companies

Abstract

The Office of the National Coordinator for Health Information Technology estimates that 96% of all U.S. hospitals use a basic electronic health record, but only 62% are able to exchange health information with outside providers. Barriers to information exchange across EHR systems challenge data aggregation and analysis that hospitals need to evaluate healthcare quality and safety. A growing number of hospital systems are partnering with third-party companies to provide these services. In exchange, companies reserve the rights to sell the aggregated data and analyses produced therefrom, often without the knowledge of patients from whom the data were sourced. Such partnerships fall in a regulatory grey area and raise new ethical questions about whether health, consumer, or health and consumer privacy protections apply. The current opinion probes this question in the context of consumer privacy reform in California. It analyzes protections for health information recently expanded under the California Consumer Privacy Act (“CA Privacy Act”) in 2020 and compares them to protections outlined in the Health Information Portability and Accountability Act (“Federal Privacy Rule”). Four perspectives are considered in this ethical analysis: 1) standards of data deidentification; 2) rights of patients and consumers in relation to their health information; 3) entities covered by the CA Privacy Act; 4) scope and complementarity of federal and state regulations. The opinion concludes that the CCPA is limited in its application when health information is processed by a third-party data aggregation company that is contractually designated as a business associate; when health information is deidentified; and when hospital data are sourced from publicly owned and operated hospitals. Lastly, the opinion offers practical recommendations for facilitating parity between state and federal health data privacy laws and for how a more equitable distribution of informational risks and benefits from the sale of aggregated hospital data could be fostered and presents ways both for-profit and nonprofit hospitals can sustain patient trust when negotiating partnerships with third-party data aggregation companies.

Moving Beyond Simple Risk Prediction: Segmenting Patient Populations Using Consumer Data

“…Despite the important opportunity that the consumer marketing data brings to healthcare, major concerns still exist about privacy of consumers. Linking consumer marketing data to EHRs and/or insurance claims data may increase informational risk (i.e., HIPAA violations), if strict data deidentification standards are not in place and/or data protections are applied inconsistently across various entities which collect, share and use the data (42). As such, any use cases of consumer data must be HIPAA compliant to ensure protection of "individually identifiable health information" (i.e., protected health information) (43).…”

The Promise and Peril of Big Data in Driving Consumer Engagement

“…As businesses collect and store vast amounts of consumer data, they must ensure that they are complying with relevant regulations and protecting consumer privacy. This can be particularly challenging in industries such as healthcare and finance, where sensitive personal information is often collected and analyzed (Gkintoni et al, 2021c;Rahimzadeh, 2021). Any data breaches or unauthorized access to consumer data can result in significant reputational and financial damage for the business, as well as legal liabilities (Sarigiannidis et al, 2021).…”