David Babaian, JD

by David Babaian

Whose Data Is It Anyway?

The question of health data ownership is surprisingly complex, particularly when viewed through the prism of research.[1] An attempt to answer this question requires navigating a myriad of uncertain state laws with differing implications and a checkered federal floor of health privacy and aged human subjects research regulations. Settling on an answer is further complicated by the seemingly constant transfer of information throughout the clinical research enterprise—a situation only exacerbated by the hope of “big data” and transformative bioinformatics—and the numerous other rights or interests that may be present or asserted. The unartful interplay of existing paradigms and developing infrastructure must be reworked, but such changes are slow to come. For now, your only option is to survey the field and carefully work through all the different considerations in hope of finding an answer that is legally and ethically defensible.

Data as Property

An often-cited triumvirate of court cases seems to make plain that individuals do not retain ownership in biological specimens.[2] However, a few states have created an individual property right in genetic data. Four States—Colorado, Florida, Georgia, and Louisiana—have laws that establish individual ownership rights in genetic information.[3] One state—Alaska—created individual ownership rights in genetic information and samples.[4] Similarly, between 2011 and 2012, four additional states proposed laws that would have made genetic information an individual’s personal property.[5] These state laws governing ownership of genetic information have not been fully tested in court. While several well-known cases have indicated there is no “property right” in one’s specimens, new state laws that specifically provide individual ownership, particularly in genetic information, could lead to new disputes with as yet unknown consequences.

Data as a Commodity

Ownership of data is also multiple, as information and the conduit to fully utilize it resides with many stakeholders. The promise of big data and advanced analytics requires assimilation of dissimilar—though not necessarily divergent—interests in pursuit of the potential knowledge that may arise from aggregation. It is this aggregation that gives the resource its maximum value. Moreover, the market of compilers is segregated through proprietary impulses and commercial interests.

Data ownership is no longer binary—simply a matter of patient or provider, participant or investigator, etc. Generally, payers and providers control claims data; providers control clinical data; and pharmaceutical and biotechnology companies, academic institutions, and non-governmental organizations control research data. It is the sum of these data that are most useful. Then, again, the data itself is not particularly useful without the infrastructure to combine and sift through the miscellany. Thus, health information exchanges and interoperable Electronic Health Records (EHRs), layered above the various modes of original data creation and each with their own proprietary interest, are simultaneously further complicating and critical to the overall vision.[6]

There is ample evidence of struggles for control within the various spheres. In negotiating Clinical Trial Agreements, industry has increasingly sought significant inroads into the EHRs that providers predominantly control. So too have EHR vendors sought to dictate terms regarding the data within their systems. According to the Health Information & Law Project, New Hampshire is the only state in which the patient maintains the property interest in the information within his/her medical record, whereas twenty-one states affirmatively vest that property right in the provider or hospital.[7] The Health Insurance Portability and Accountability Act (HIPAA) provides patients with a right of access, among other rights, to medical records about them that were created or received while obtaining medical services.[8] However, this bundle of rights is not without limits; it does not include the ability to compel either receipt of the original record or destruction of the record.

Finally, while ownership may seem settled at one point in time, the person or entity might not own or control the data in perpetuity, as was the infamous case with deCODE. The company created a database of genetic and associated health information of Icelanders. After bankruptcy proceedings, ownership of the company’s assets has at least twice been transferred.[9]

Data as an Academic Freedom

The complex question of data ownership is no less prominent in academia. It is fairly well settled—if not still controversial—that the institution, as grantee, owns the data generated from federally funded research, while the investigator (institution employee) acts as steward with rights to access and use the data.[10] The investigator generally maintains control over publication and associated copyright. With institutional permission, investigators may take data, but usually with the provision that it will be returned if requested or that the university will have future access as necessary.

In at least one instance, an institution attempted to prevent the use of data in light of adjudged noncompliance with applicable human subjects regulations.[11] A tenured member of the faculty at a prominent U.S. university obtained private funding for a multi-year social and behavioral research study. The particular study involved educational testing and interviews only, implicating possible exemption from IRB oversight under 45 C.F.R. § 46.102(b)(2).[12] Nonetheless, the faculty member was informed that local IRB review would be necessary, and the university’s IRB approved the research, with a $600 payment to each participant. The investigator surmised after pulling all the study materials together that participants from lower socio-economic backgrounds would require more time to complete the study and altered the payment scheme by compensating lower income participants at the $600 rate and higher income participants at a new $300 rate. The investigator reasoned that this compensation plan was more equitable, as it better reflected the differential in time commitment. Problematically, the change was not reviewed by the IRB, though the university-approved budget reflected this new compensation structure. The research commenced.

Well into the study, after the discrepancy was realized, the IRB informed the investigator that the data collected from participants paid $300 could not be used unless and until the amounts were supplemented to the IRB-approved $600. The remaining budget was insufficient to cover these supplemental payments. The investigator filed suit.

The investigator sought to enjoin the university from its data use restriction. Specifically, she raised five counts. First, she challenged the composition of the Board, alleging that the university’s IRB contained no minorities in contravention of 45 C.F.R. § 46.107 which mandates diversity of board membership, and, what is more, deprived her of equal protection under of the laws therefor. Second, she alleged due process violations, for failure to provide “further appropriate review”, pursuant to 45 C.F.R. § 46.112. Third, she sought a declaratory judgment that since her research was privately funded or, in the alternative, exempt, the study was not subject to IRB oversight. Fourth, she sought economic damages due to the interference with her intellectual property right in the fruits of the investigation. Last, the plaintiff alleged interference in the relationship with the funding foundation.

The university countered that the plaintiff had not stated a claim upon which relief could be granted by denying it lacked jurisdiction owing to its Federal Wide Assurance and that the research was exempt because the study involved children who are expressly excluded from the pertinent exemption criterion. Ultimately, the parties agreed to mediation, and the court entered a dismissal stipulation with prejudice.

Seeking a Comprehensive Solution

The appropriate path forward, in particular as it relates to clinical research, is a topic of much scholarship. Chadwick and Berg recommend a shift in the ethical principles that underpin informed consent, to include solidarity and equity, specifically in the context of genetic databases.[13] At least one prominent author has questioned whether propertization of all health data—either private or public, either in the individual or in government respectively—as proposed by other scholars would accomplish the desired result of increased transparency and access to health information.[14] She has most recently proposed a consumer-driven health data commons.[15] In stark contrast, the NPRM has introduced the controversial concept of broad consent for future, unspecified uses of research data.[16]

In the face of such uncertainty, credibility and success will only come from the ability to proactively consider and address the different interests, i.e., property rights, contractual obligations, and professional freedoms, implicated by a particular research activity. This may require consulting with experts in the fields of law, ethics, clinical research, and information technology and the development of a standing data management practices plan. Unfortunately, until there is a comprehensive solution, if there ever is one, most will likely only learn about any shortcomings in their data practices once a person, business, or institution affected by them alleges a deeply held interest has somehow been abridged.



[1] Research has a different individual and relative societal value than either the direct provision of healthcare or pure commoditization of health data.

[2] See Moore v. Regents of University of California, 793 P.2d 479 (Cal. 1990) (holding that patient did not have property right in excised tissue); Greenberg v. Miami Children’s Hosp. Research Inst., 264 F. Supp. 2d 1064, 1075 (S.D. Fla 2003) (holding that patient has no property right in tissue voluntarily donated for medical research); Washington University v. Catalona, 490 F 3d 667 (8th Cir. 2007) (holding that donors made a gift of their samples and did not retain a right to direct where to transfer their samples). See also Adams v. King County, 192 P. 3d 891 (Wa. 2008) (holding that family had a claim based on their interest in proper treatment of the body and not based on a property interest in the body).

[3] Colorado: “Genetic information is the unique property of the individual to whom the information pertains.” C.R.S.A. § 10-3-1104.7(1)(a). Florida: “…DNA analysis may be performed only with the informed consent of the person to be tested, and the results of such DNA analysis, whether held by a public or private entity, are the exclusive property of the person tested, are confidential, and may not be disclosed without the consent of the person tested.” F.S.A. § 760.40(2)(a). Georgia: “Genetic information is the unique property of the individual tested.” G.C.A. § 33-54-1(1). Louisiana: “An insured’s or enrollee’s genetic information is the property of the insured or enrollee.” LSA-R.S. §22:1023.

[4] “A DNA sample and the results of a DNA analysis performed on the sample are the exclusive property of the person sampled or analyzed.” A.S. §18.13.010(a)(2).

[5] See AL H. 78, pgs 2, 3 (Alabama), MA S.B. 1080, lines 5-6, 64-65 (Massachusetts), SD H.B. 1260, lines 9-11 (South Dakota), and VT H. 368, lines 8-11, 15-17(Vermont).

[6] The FDA recently released draft guidance which recognizes the need for appropriate collaboration owing to the challenge of diverse ownership of electronic systems and data. U.S. Food and Drug Admin., Guidance for Industry: Use of Electronic Health Record Data in Clinical Investigations (Proposed Official Draft Guidance 2016), available at http://www.fda.gov/downloads/Drugs/GuidanceComplianceRegulatoryInformation/Guidances/UCM501068.pdf.

[7] Health Information & the Law, Who Owns Medical Records: 50 State Comparison, http://www.healthinfolaw.org/comparative-analysis/who-owns-medical-records-50-state-comparison (2012).

[8] The patient also has the right to amend, obtain a copy, and direct disclosures of the record. Of note, the University of California system has determined that a designated record set does not include a separate research record, for the purposes of HIPAA compliance. See HIPAA and Research 10, http://policy.ucop.edu/doc/1100616/HIPAA%2014 (January 30, 2014). However, specific to California state law, the right to access “patient records”, inclusive of data generated by a health care provider during a clinical trial, apparently may not be abridged, without at a minimum providing a summary. See CA Health And Safety Code §§ 123110 and 123130.

[9] A recent event highlights a potential problem of leveraging big data and the need for thoughtful discourse and meaningful standards. A team of researchers released the personal information of 70,000 users of a dating website by scrapping allegedly public information from the website, re-purposing the data, and publishing online under the banner of open-source research. Michael Zimmer, OK Cupid Study Reveals the Perils of Big-Data Science, https://www.wired.com/2016/05/okcupid-study-reveals-perils-big-data-science/ (May 14, 2016). The ubiquity of information will only serve to further complicate the question of data ownership and control. In this particular instance, the data was removed pursuant to a Digital Millennium Copyright Act complaint by the dating service.

[10] To foster public-private partnerships and bring ideas to market, the Bayh-Dole Act of 1980 granted universities the intellectual property rights generated from federally funded research, technology which then can be licensed to industry. See Ownership of Data – Federal Policies, Office of Research Integrity, https://ori.hhs.gov/education/products/rcradmin/topics/data/tutorial_2.shtml.

[11] See Professor Sues Brown University Over IRB Mission Creep, http://www.institutionalreviewblog.com/2011/03/professor-sues-brown-university-over.html (March 13, 2011).

[12] The research involved children, which would place the study outside this exemption criterion.

[13] Ruth Chadwick and Kare Berg. Solidarity and equity: new ethical framewoks for genetic databases, 2 Nature 318 (2001).

[14] Barbara J. Evans, Much Ado About Data Ownership, 25 Harv. J. Law & Tech. 1 (2011).

[15] Barbara J. Evans, Barbarians at the Gate: Consumer-Driven Health Data Commons and the Transformation of Citizen Science, Commissioned White Paper, Robert Wood Johnson

Foundation-funded Health Data Exploration Project, forthcoming in 42 Am. J. Law & Med. 4 (2016) (available at http://ssrn.com/abstract=2750347).

[16] Federal Policy for the Protection of Human Subjects, 80 Fed. Reg. 53,933 (September 8, 2015).

Tags: , ,