The Washington PostDemocracy Dies in Darkness

Who owns your medical data? Most likely not you.

Glass organ samples. Consent forms for a test or operation usually say all data belong to the doctor or institution performing it. (iStock)

Do you think you own your own medical data? Your hospital and doctor records, lab and radiology tests, genetic information, even the actual tissue removed during a biopsy or other surgical procedure? Well, you don’t.

It’s a good bet that the fine print of the consent form you signed before your latest test or operation said that all the data or tissue samples belong to the doctor or institution performing it. They can study it, sell it or do whatever they want with it, without notifying or compensating you, although the data must be depersonalized in their best effort to make sure you are anonymous.

I’ve signed a number of those forms myself, and I’ll admit I’ve never thought about it until recently, when I read that Memorial Sloan Kettering Cancer Center had been criticized for licensing patients’ personal data to a for-profit artificial intelligence start-up in which the hospital holds an equity stake.

With that news, my ears perked up. My sister, late mother and I have all been patients at Memorial Sloan Kettering and — with some tissue samples in this game. So I was keenly interested in the dual questions of privacy and ownership.

Frankly, I was both exhilarated and confounded to learn that the hospital had signed a partnership deal with the start-up Paige.AI that gave the company exclusive access to the center’s 25 million slides of patient tissues in the name of cancer research: Exhilarated by the promise of quicker and more accurate cancer diagnoses as a result of the digitization and sharing of the hospital’s tissue slides. Confounded because this partnership limits access to that data to one commercial partner instead of sharing it with other researchers worldwide whose efforts might also help find cures.

Make no mistake, this is big business. In 2017, the legal buying, selling and trading of our personal medical data totaled $14 billion. (Memorial Sloan Kettering’s partnership with Paige.AI is just a drop in this big bucket). Patient health data is routinely sold or licensed to research companies such as Paige.AI, as well as to medical data brokers who pool the data — from doctor and hospital records, to insurance claims and prescriptions — which has significant value. For instance, pharmaceutical companies pay a premium for this data to more precisely target their online ads.

This is all perfectly legal, and courts have upheld it even if you didn’t quite know what you were agreeing to.

As a cancer survivor, I know the importance of advancing medical science, fast. When I was diagnosed with testicular cancer in 1984, the 10-year survival rate was greater than 90 percent. Had I been diagnosed a decade or so earlier, I’d probably be dead now. What happened in the interim? Researchers had developed a new chemotherapy cocktail that changed the treatment of, and prognosis for, my cancer. As a beneficiary of that lifesaving research, I say, Hallelujah! I also say thank you to the doctors and staff at Memorial Sloan Kettering who cured me.

But I had paid only cursory attention to the consent form I was given before treatment, mostly because I was crazy-scared. In 2013, my mother was similarly hyper-focused on the dangers and benefits of her proposed lung cancer surgery, and neither she (nor I, her advocate) read the form closely. Neither of us considered what might become of her tissues and organs, and we would have been shocked if anyone had told us she’d agreed for them to be sold or licensed for research.

But we had. Memorial’s current surgical consent form, which is typical, includes this sentence: “[T]he hospital has my permission to use [my] tissues and organs in any way that advances medical science, including the development of biomedical products in which I claim no financial interest.”

Had Mom been asked directly for permission, I’m certain she would have said yes, especially knowing it would aid research. Likewise, I’d sign away if I saw that it might help develop more accurate diagnoses or new lifesaving therapies. But looking at that onerous consent language, all I can think is, “Wow — we really should have read those consent forms more closely.” And, “That was not the right time to be trying to make sense of such important information.”

Our data is meant to be stripped of all personally identifying characteristics — name, Social Security number and addresses. But Adam Tanner, author of “Our Bodies, Our Data: How Companies Make Billions Selling Our Medical Records,” writes that “as data-mining technology becomes ubiquitous, it also makes it easier to learn a previously anonymous identity.”

If anything, the law is clear. Jodi Daniel, a lawyer specializing in digital health and health information policy, explained to me that patients do not own their medical records in 49 out of 50 states. (The exception is New Hampshire, where patients and providers both can claim ownership.)

The Health Insurance Portability and Accountability Act, a 1996 federal law that protects health privacy, takes no position on ownership, which wasn’t contemplated back in the 1990s. Daniel, who helped write that law, says it was written before “we were thinking about the value and use of data they way we do today.”

Of course, the value of biodata has been well-known to researchers for decades. Witness the story of Henrietta Lacks, whose “immortal” cell line — the first-ever tumor cells to reproduce indefinitely — gave researchers around the world data that led to new vaccines, new cancer treatments, even in vitro fertilization. In 1951, Lacks was not offered even the most cursory opportunity to consent, but neither she nor her heirs were legally entitled to compensation for the advancements her cells made possible.

Patients are regularly asked to sign what are called “blanket” consent forms, which means agreeing to all the terms. Health advocates say that you can strike clauses that you don’t agree with, but that isn’t looked upon kindly by hospitals such as Memorial Sloan Kettering.

When I asked Roger Wilson, the chair of Memorial Sloan Kettering’s Institutional Review Board and the director of operating room operations, about this, he said that “operationally [it] is problematic, because individuals might say, ‘Well, you can use this part but you can’t use that part,’ ” which he fears “introduces the potential for error.”

Jennifer Miller, an assistant professor at the Yale School of Medicine and a founder of Bioethics International, doesn’t think blanket consents are ethical, especially “when someone is likely sick and potentially vulnerable.”

“Why are we forcing sick patients to think about data ownership issues right before they get surgery?” she said. “What are the opt-out options? Can the patient cross out that section and then sign?

Now that we’re beginning to think about our health data as personal property, there’s the question about whether patients should be compensated for their data or tissue samples. Steven Joffe, chief of medical ethics at the University of Pennsylvania Perelman School of Medicine, says he thinks the value of individual data is negligible — the real value comes from aggregating information from large numbers of patients.

“So you could say, ‘If there’s value generated, let’s distribute across all of the 10,000 people who contributed their samples,’ ” Joffe says, “but then you end up with tiny amounts, and it just doesn’t make sense to return 45 cents to each individual.” As for the Henrietta Lacks case, Joffe explained that was a rare situation where one person’s sample generated substantial value.

In an era in which ownership of our data — from our credit scores to our social media posts to our phone numbers — is being hotly debated, it would seem that ownership of our own bodies needs to be fully explored.

One tech start-up,, sees ownership of medical data as a basic human right. Its app, called #My31 (the United Nations has declared 30 universal human rights), will allow users to decide how their medical data may or may not be used. Users can choose whether they’re willing to lease or share their data; what kind of medical data, if any, they want to make available (medications, test results); and whether they’d like to be paid or interested in donating their data for research purposes.

Richie Etwaru, co-founder and chief executive, argues that doctors and hospitals should be required to check and abide by the consent decisions patients have saved in the app. As Etwaru told me, “we have an opportunity to have income from our data.” At the very least, he says, patients should be aware of that, which Etwaru calls a fundamental “human right.”

What I know is this: The next time I have surgery, I will ask for the consent form well ahead of time and take the time to read and understand it, in consultation with my doctor. I will strike out provisions I don’t agree to, knowing I can’t be denied treatment on that basis.

If Memorial Sloan Kettering or any other hospital wants to use my personal data for scientific research, I will give it to them as my gift — I know the value of that research. But as my mother taught me: Don’t take advantage of those under duress.

How a ‘kindness contagion’ is improving my life

How to deal with a scary diagnosis and uncertainty

Can the ‘immortal cells’ of Henrietta Lacks sue for their own rights?