From Netflix’s The Social Dilemma and scandals like Facebook’s Cambridge Analytica partnership, there’s no shortage of media warnings against user data collection. The news is flooded with stories covering the way companies collect, store, and sell our data as we shop, play, and socialize online. Most of these narratives underscore the ways companies profit from these data, such as increasing user engagement or selling the information to third-party advertisers. However, if these data are used for social good while the collectors take extensive privacy protection measures, the benefits of this practice can outweigh the risks.

One such example of “social good” is improving individual and population health outcomes by leveraging biomedical data and cutting-edge data science techniques. Researchers, biotech companies, and health systems are collaborating to access, aggregate, and analyze the plethora of information stored in electronic medical records. One example, Truveta, recently announced plans to combine patient data from fourteen of the largest United States health systems.

While Truveta’s goal of better understanding and mitigating health disparities is well-intentioned, aggregation on such a large scale has understandably led to data privacy, security, and access concerns. The counter made by Truveta’s leadership echo those of other biotech professionals, academic researchers, and primary care providers: these data can save lives. While it comes with its technological and ethical challenges, increasing accessibility of protected health information (PHI) can alleviate public health outcomes and empower patients to take ownership of their health.

PHI and Public Health

“Most people don’t realize the value and potential of wearables and the Internet of Things (IoT),” says Clark Seninger, a project manager at Stanford’s Center for Digital Health. While devices like the Apple Watch and FitBit collect huge amounts of data, Seninger explains that the industry has yet to use this information to devise a solution at scale. Integrating personalized medicine with medical research is a fairly new practice, and most large-scale biomedical research continues to be done using antiquated electronic health data systems. One might think that institutional health data is more comprehensive and better organized than the metrics our wearables collect. However, researchers in academia and industry alike have disparate and limited access to PHI, a difficulty that’s exacerbated by the torturous task of navigating the electronic medical records they do have access to.

Despite the challenges, some organizations have successfully used aggregated electronic health data to help patients and clinicians alike. For example, Komodo Health uses aggregated insurance claims data to illuminate nationwide distributions of conditions like Rheumatoid Arthritis, Schizophrenia and Bipolar disorder. This is useful for researchers to determine which social determinants of health and other population-level factors are correlated with a certain disease. Scientists use these epidemiological findings to inform treatment development and testing. Komodo’s clinical development process connects prospective participants with possible clinical trials of interest. Without a sizable and diverse sample, trials can’t effectively assess the safety and validity of treatments. Once treatments are approved, many patients, especially those navigating rare diseases, can experience trouble connecting with a specialized clinician. Komodo has leveraged big data to connect individuals with local, state-wide, or national specialists, demonstrating that PHI is key in public health, research, and clinical progress.

While sharing PHI can improve health outcomes, patients are understandably wary of risks associated with granting large organizations access to their de-identified data. Rock Health’s 2020 Digital Consumer Adoption Report notes that about 90% of survey respondents were not willing to share their health information with tech companies, compared to the 72% that were willing to share these data with their physician. While it’s relatively clear that sharing these metrics with primary care providers is in a patient’s best interest, private companies’ incentives are harder to navigate. A good patient-provider connection is built on interpersonal trust, and the same can’t be said for our relationships with tech companies—whether they be small biotech start-ups or tech giants like Google and Facebook.

Vanessa Ridley from the University of California, San Francisco (UCSF) explains that the public holds relatively high trust in doctors and academic medicine. It’s risky for an institution like UCSF to give an external organization access to patient data, she maintains, especially considering the cyber-attacks academic institutions like the University of California often face. Data breaches targeting private companies can impact universities as well. “Even if the breach happens outside of UCSF, patients still might lose trust in our institution by association,” Ridley explains. It can be especially difficult to win back that trust considering how little we patients know when it comes to the use and distribution of our data.

A lot of ground-breaking research would be impossible without PHI access, so it’s crucial for patients to feel comfortable sharing their data. Comfort and trust begin with knowledge and understanding. ”Most people are unaware of how much data is recorded and who owns it,” maintains Seninger. For example, we don’t explicitly consent every time our de-identified health information is used in clinical research. While explicit, informed consent is often necessary to clear the institutional review board (IRB) requirements, researchers usually don’t need to obtain individual permission to use de-identified PHI in their studies, Ridley explains, if they can prove that informed consent is impractical.

Amidst these privacy concerns, it is important to know the commitments to privacy made by private-sector researchers and academics alike, beyond official IRB documentation. Dr Tabby Khan, Komodo’s Medical Director, mentions that a cornerstone of Komodo’s policy is keeping confidential data they don’t have explicit permission to share. “Say there’s a CT scan that would really support the research you’re doing,” she ventures, “if the patient doesn’t want to share the image, you have to respect that.” The way patients, providers, and researchers alike navigate these ethical issues is through interdisciplinary teamwork. Collaborating with pharmaceutical companies, patient advocacy groups, and healthcare professionals deepened Khan’s understanding of these stakeholders’ concerns. “It’s led me to have a positive outlook on how we can use technology to improve health equity, access to care, and support for rare diseases and conditions.”

Your health information and you

Researchers aren’t the only ones who have increased access to our data—patients now have more access to our health information than ever before. The ONC Cures Act passed on April 5, 2021, maintains that “patients can electronically access all of their electronic health information (EHI) at no cost.” While patients face no legal barriers to our medical information, the Act- like all federal legislation- is relatively vague and open to interpretation. It’s also difficult for federal policies to account for access and usage barriers on state, local, and institutional scales. Thus, it is up to those in charge to ensure that the policy is enacted responsibly and ethically.

Various ethical and logistical challenges complicate patients’ access to their own health information. For example, if physicians know we’re reading their notes, it can change the way they document patients’ health. This doesn’t have to be a bad thing, explains Deborah Wachenheim, who works with OpenNotes, an organization that helps providers increase the transparency and accessibility of their patients’ visit notes. Wachenheim explains that this can begin conversations regarding how we discuss heavily stigmatized health topics. “How we tell patients’ stories impacts how other caregivers and providers think about patients before even meeting them,” she adds. Wachenheim and her colleagues at OpenNotes believe their work will lead to better patient-provider relationships, increased opportunity for clarification and engagement, and patient ownership of their health narratives. Overall, access to visit notes can be a great opportunity for patients to partner with clinicians to manage their health.

While patients in the United States theoretically have access to our electronic health information, there are inequities and disparities in practice. Differences in digital health access range from structural barriers to lack of awareness regarding available options. Though the pandemic caused many patients to switch to telemedicine, Rock Health’s 2020 Digital Consumer Adoption Report found, the uptick was mostly in those who were already more likely to adopt digital health alternatives: younger, higher-income, and highly educated groups. Those that were less comfortable or informed often did not realize the benefit of these technologies, regardless of how creative or efficient these solutions were. These findings parallel those of Dr. Courtney Lyles, who researches how health information technology can improve patient-provider communication and alleviate health disparities. “Technology will only reach and be useful to those who are interested and ready,” she explains.

As part of a digital health incubator, Lyles has seen many interesting privately developed tools that don’t meet basic accessibility concerns, such as lack of audio-visual cues, reading level, and digital skills. Even something seemingly ubiquitous like smartphone use presents accessibility challenges. “Lots of patients aren’t huge app users—little things like accessing the Google Play store and email verification matters,” she explains. These challenges overlap with historical barriers such as lower English literacy levels and user interface-related challenges.

Some researchers and organizations are alleviating these disparities and easing patients’ health information access. While research tends to focus on developing efficient, cutting-edge tools, Lyles also works on what she calls the “wraparound”: implementation that helps people use the tool. The “wraparound” helps ensure that when measures like the Cures Act are passed, information is accessible—not just available. Lyles explains that multimedia features to support comprehension and navigation have been successful in other settings. “We’ve thought through the functionality, but we haven’t leveraged it to be personalized,” she says, maintaining that it’s important to meet patients where they’re at to deliver content most effectively.

In addition to researchers working on accessibility, organizations such as the American Health Information Management Association (AHIMA) help patients and providers meet their goals of reducing costs, protecting privacy, and achieving better health outcomes. AHIMA’s Julie Pursley, RHIA, CHDA, MSHI, FAHIMA, tells me that her organization is a bridge between technology and the people. “Technology will change the way we do business,” she explains, “but people have control over the policies and processes, coupled with the ability to leverage technology.” While it can be difficult for patients to choose the right technology, understand security and privacy policies, and know what’s covered under HIPAA, health information professionals can help. “If you have trouble accessing health information, deciding who to share it with, or understanding where it goes, contact a health information professional,” Pursley says. “We are and continue to be a valuable resource for patients.”

Where do we go from here?

Understanding and navigating the ever-changing landscape of health data transparency and accessibility is difficult. However, there are key ideas that researchers, medical professionals, and patients should focus on to solve these challenges. For private-sector and academic researchers, empowering users and patients to take ownership of their data means leveraging ethics policies and cutting-edge technology to mitigate privacy and accessibility issues. “Progress needs to be made within an ethical framework,” Khan explains. “You have to respect patients—at the end of the day we know that patients matter, and we have to protect their information as best we can.” Additionally, accessibility—technological or otherwise—should be incorporated into the design process as early as possible. Lyles asserts that ”we should think about accessibility and engagement as a value-add rather than a hindrance.” As Khan and Lyles have demonstrated in their work, empowering patients through health tech rests on participatory, inclusive co-creation.

Though status-quo health information access is still difficult, it’s better than it used to be. Medical notes were historically created by providers for providers—and nobody else, maintains Wachenheim. This changed with the passage of the Cures Act: as of April 5, 2021, patients have the legal right to request our complete health information. Additionally, a myriad of applications and technologies allow us to track various health metrics without ever setting foot into a doctor’s office.

It’s not only an increase in data access that the public is experiencing we’re also seeing a rise in the desire to learn about health and medicine. “Health is much more a part of the mainstream media conversation since COVID-19,” explains Seninger. “People are now more aware of topics like epidemiology and related technologies in this space.” Public health research among the general population undoubtedly increased because people believed they had a strong personal stake in the matter. Like the COVID-19 pandemic, health data privacy is something that affects us all—and we should act like it by self-advocating for patients’ rights. “People should ask more questions about what’s happening with their data,” says Ridley. “The conversation has shifted to giving people access to their information, but the next step is asking what this information is and where it’s going.” While privacy is an important concern, it’s also important to remember that in the right hands, PHI can be used by health systems, researchers, and industry partners to take care of our communities. Rather than thinking about the issue as binary between the individual right to privacy and the collective obligation we may feel, we can re-think about the issue as being data “stewards” rather than data “owners.” Data stewardship rests on the idea that no matter who we are—patients, researchers, clinicians, or otherwise— we have an obligation to take care of data and discuss how to best use it.

Navigating the health data and technology landscape can be challenging, scary, and overwhelming for patients. Biomedical data can be used to improve our well-being and uplift the health of entire populations. Khan maintains that we shouldn’t be afraid of data in the healthcare space. “We want to reduce the burden of disease by distilling all of this information in a way that can improve patient outcomes,” she explains “and we want patients to know that there are a lot of safeguards to protect identifying information.” It’s not just companies and universities that can use data to advocate for better health outcomes; researchers are beginning to recognize the importance of citizen science and participatory research. “We need to involve the community a lot more in these conversations—and research in general,” explains Lyles, who is involved in participatory research herself. As patients, we need to contribute to the conversation and promote self-advocacy in addition to learning more about what medical ethics looks like in academia, medicine, and industry. We should view health data stewardship as a co-creative process: working with professionals is the best way to alleviate our qualms about privacy and leverage our information to improve public health.

Navya Pothamsetty has a Master’s in Public Health from the University of California in epidemiology and biostatistics.