The law of open medical data: past application and future challenges

Abstract

Since 2003, US federal funders’ scientific data-sharing policies have encouraged open sharing of weakly de-identified medical and genomic data. This sharing fueled important scientific advances but, as this article explains, was of dubious legality, and recent regulations have removed any doubt: open access to medical data is a dying concept if not already dead. The future of medical data sharing lies with controlled access data repositories, which replicate many of the scientific benefits of data sharing but provide stronger privacy and data security protections. The drawback is that meaningful data protections cost money, forcing controlled access repositories to explore new private funding models to sustain data availability over the long haul after federal funding expires. Unless carefully crafted, transactions to finance controlled access repositories (such as charging user fees or receiving discounts on cloud storage from information technology service providers) can violate federal laws this article explores. Going forward, the law of medical privacy boils down to how much privacy those who share and use our data can realistically and lawfully finance. That is how much privacy we, the public, can expect.

I. INTRODUCTION

The concept of open data—data that are ‘freely accessible, usable, and shareable without restrictions, typically under an open license or in the Public Domain’¹—‘has been around for some years’ and has many advocates.² Its benefits were on vivid display last year when the Royal Swedish Academy gave a shout-out to the Protein Data Bank as crucial to the research on computational protein structure design and prediction that won the 2024 Nobel Prize in Chemistry.³

Even strong proponents of open data admit that some data are just not suitable for unrestricted sharing. An example is the Open Data Institute (ODI), a non-profit that Sir Tim Berners-Lee and Sir Nigel Shadbolt founded in 2012 to ‘create an open, trustworthy data ecosystem on which AI systems and other technologies can depend’.⁴ The ODI distinguishes data that ‘are, or could be, open – and equally importantly, what won’t be open’.⁵ The ODI stresses that open data only work for ‘non-personal data, that is, data which do[] not contain information about specific individuals’.⁶ Government data often can be open, but ‘national security restrictions apply’.⁷ In the ODI’s framework, the term ‘open data’ means ‘providing unrestricted data to everyone’ and differs from the more general term ‘data sharing’, which also includes ‘providing restricted data to restricted organizations or individuals’.⁸

The Open Source Initiative (OSI),⁹ a California non-profit supporting the open-source software movement, also recognizes differing degrees of openness including: (i) ‘open’ data that can be freely accessed, used, and shared, for example, under an open access license; (ii) ‘public’ data that are ‘accessible by anyone without authentication or special permissions’; (iii) ‘obtainable’ data that are accessible but require ‘specific actions, such as licensing deals, subscriptions, or permissions’; and (iv) ‘unshareable’ non-public data that are ‘confidential, protected by privacy laws, agreements or proprietary rights and cannot be legally shared or publicly distributed’.¹⁰

This article investigates a genuine mystery: individual medical data—some of the most privacy-protected data in the world—clearly seem unsuitable for open sharing under the ODI and OSI frameworks. Yet large-scale open downloading of sets of individual medical data is allowed and even encouraged in the USA.¹¹ How did that happen, and is it likely to continue?

This article resists the urge to treat genomic data as exceptional. It focuses more broadly on medical data, the full array of ‘health information’ collected and used in clinical health care.¹² Gene sequences fuel ongoing debate about whether data can truly be de-identified, and the National Institutes of Health (NIH) is seeking yet another round of public input on its genomic data-sharing policy as this article goes to press.¹³ Still, genomic data are just one of many types of medical data that may uniquely identify the individuals the data describe.¹⁴ For example, medical images of the head reveal recognizable facial features despite efforts to de-identify them.¹⁵ A recent federal data security regulation treats ‘voice prints and patterns, retina and iris scans’ as biometric identifiers.¹⁶ Retinal imaging is common in eye and diabetes care, and voice data ‘have emerged as a type of digital biomarker … for use in disease monitoring and detection’.¹⁷ Experts debate whether ‘biometric identifier’ means a characteristic that actually is in regular use as a means of identifying individuals versus one that theoretically could be used for this purpose, and even the authoritative National Institute of Standards and Technology (NIST) goes both ways in its definitions.¹⁸ Either way, it is clear that genomic data are hardly exceptional in their potential to identify individuals, and many other types of medical data raise similar concerns.

After a brief history of open data in the USA, Section II sets the scope of analysis by introducing federal laws included in this article’s survey of laws governing open medical data. In addition to the ‘usual suspects’—privacy and human subject protection laws—it adds several other laws that may have unexpected significance in the future.

This article covers two time periods: Section III examines the past, and Section IV examines the future of open medical data in the USA. Section III argues that open sharing of individuals’ weakly de-identified genomic and medical data has always been of dubious legality. US federal medical privacy laws set a strong standard—at least on paper—for de-identifying data, but, in 2012, the responsible privacy regulator announced a general policy of not enforcing the standard.¹⁹ The prevalence of open medical data in the USA today traces to this administrative nullification of a key federal privacy standard, and the affected public faces uphill battles when seeking judicial review of this flawed policy.²⁰

Going forward, our society faces a choice. One option is to accept that open access to medical data offers great societal benefits and soften medical privacy laws to align them with actual data-sharing practices. Legislation proposed in 2024 would have moved in that direction.²¹ The other option is to implement medical data-sharing policies that, while not completely open, could afford reasonable privacy protection while preserving many of the benefits of scientific data access. This latter option is what Section IV explores.

II. A BRIEF HISTORY OF OPEN MEDICAL DATA AND LAWS GOVERNING IT

II.A. Open Data in the United States after 1990

Worldwide calls for open data initially focused on data that governmental bodies collect, generate, or use as the basis for their own decisions.²² It makes sense that taxpayers should have access to data they paid to assemble, and access promotes transparency and accountability. After 2000, international bodies such as the Organization for Economic Cooperation and Development (OECD) and International Bank for Reconstruction and Development (The World Bank) launched open data initiatives, likening government data to ‘the new oil’ that ‘must be “refined” or otherwise transformed to realize their full potential’.²³ Open government data ‘enable individuals, organizations and even governments themselves to innovate and collaborate in new ways’.²⁴

In the USA, some of the earliest calls for open access to scientific data came from industries (such as tobacco, oil, and coal) wishing to critique and reanalyze data on which adverse regulatory policies had been based.²⁵ Kayte Spector-Bagdady et al. note, however, that US science funding agencies began thinking about scientific data sharing in the 1980s, and the 1990s Human Genome Project sparked further interest, leading to the ‘Bermuda Principles’ for genomic data sharing in 1997.²⁶ In 1998, Senator Richard Shelby attached a rider to an appropriations bill mandating public access to data produced by federally funded scientists (as opposed to data from federal agencies themselves).²⁷

Extramural researchers funded by the National Science Foundation and the NIH are not federal employees, and their research is not work for hire that causes their data to become government data in a true sense, but their findings do inform many regulatory decisions.²⁸ Requirements for funded researchers to share data are implemented through funders’ grant policies as conditions for receiving grants. Researchers who prefer not to share their data are, of course, free (at least in theory) to refuse federal grants, but, assuming they find other funding, they still must navigate academic publishers’ requirements to deposit data on which research articles are based.²⁹ Pressures to share scientific data are embedded throughout the modern research enterprise.³⁰

In 2003, the NIH released its ‘final statement on sharing research data’, making a ‘data sharing plan mandatory for any funding starting at US $ 500,000 per year’.³¹ The agency periodically updates its data-sharing policies.³² The NIH developed a policy on sharing data from Genome-Wide Association Studies (GWAS) during 2007–08.³³ After the Obama Administration called more generally for sharing of scientific data from federally funded research in 2013, the NIH replaced its GWAS policy with a broader genomic data-sharing policy in 2014.³⁴ NIH’s scientific data-sharing policies have expanded over time to cover ‘all research, funded or conducted in whole or in part by the NIH’ and not just projects costing more than $500,000 per year.³⁵ A 2022 memo from the Biden Administration encouraged ‘equal opportunity’ through open science and broad data access, allowing all Americans to benefit from federally funded data resources—not just well-funded research institutions and professional scientists but citizen scientists, students, and others.³⁶

Open data sharing—whatever its benefits—can potentially move data to parties who lack the qualifications or resources to implement state-of-the-art privacy protections. At present, the ‘NIH encourages the sharing of data whenever possible’.³⁷ The NIH recognizes that exceptions to data sharing are sometimes justified by ethical, privacy, or other legal concerns, but exceptions require a ‘compelling rationale’ that ‘will be assessed by the NIH’.³⁸ Grant applicants fear that too many exceptions, even for good causes like protecting privacy, might make their current or future research unfundable.³⁹

Influential voices also promote access to data from commercial and privately funded research.⁴⁰ In the USA, however, laws forcing disclosure of privately funded scientific data raise thorny taking problems, and there are statutory constraints on government agencies’ power to force disclosure of trade secrets.⁴¹ As a result, federal research funders like the NIH remain a prominent force shaping US policies on open scientific data, and this is especially true for genomic and other types of medical data that NIH-funded researchers generate and use.

II.B. Scope of Federal Laws Included in This Analysis

This article focuses on laws and policies that govern open sharing of medical data by US academic medical centers that conduct federally funded research in addition to providing routine patient care. Such entities must comply with the Common Rule,⁴² which requires human-subject protections for federally funded research, and the Health Insurance Portability and Accountability Act of 1996 (HIPAA)⁴³ Privacy Rule,⁴⁴ the major federal medical privacy law governing entities that provide clinical care. Academic medical centers may, in addition, be subject to state laws imposing additional protections that are more stringent than what the Common Rule and HIPAA Privacy Rule require.⁴⁵

These laws offer only a few pathways for open sharing of medical data. One pathway is to de-identify the data and take the position that de-identified individual data no longer ‘contain information about specific individuals’ and thus can be openly shared.⁴⁶ The HIPAA statute and Privacy Rule protect personally identifiable genetic and clinical health data, which HIPAA refers to as ‘protected health information’ (PHI).⁴⁷ This article uses the term ‘de-identified’ to refer to data that meet the applicable legal standard to be considered non-personally identifying information (non-PII), while recognizing that different laws use different terms to refer to such data.⁴⁸ In HIPAA terminology, ‘de-identified’ data are not PHI and receive no privacy protection under the HIPAA Privacy Rule and can be openly shared without violating HIPAA.⁴⁹ In this respect, HIPAA is like most other modern data privacy laws around the world, which ‘share the same basic assumption – that in the absence of PII [personally identifiable information], there is no privacy harm. Thus, privacy regulation focuses on the collection, use, and disclosure of PII, and leaves non-PII unregulated’.⁵⁰ The Common Rule similarly excludes people whose data are shared or used in de-identified form from its research ethical protections.⁵¹

The second major legal pathway for open sharing of medical data is to obtain individual informed consent and HIPAA authorizations.⁵² However, surveys suggest most people will only consent to open sharing of their health records if the data are de-identified.⁵³ NIH’s policies for open data sharing rely heavily on data de-identification and consents procured based on assurances that data will only be shared in de-identified form.⁵⁴ Thus, a consent-based approach does not obviate the need for effective means of de-identifying data.

The HIPAA Privacy Rule has been harshly criticized for authorizing the use of a weak de-identification method that leaves data susceptible to re-identification.⁵⁵  Section III of this article explains, for the first time, that this critique misses a crucial point. The HIPAA Privacy Rule does not authorize the use of a lax de-identification standard.⁵⁶ In reality, the HIPAA statute and the Privacy Rule both set a strong de-identification standard, equivalent to the rigorous standard for data ‘anonymization’ in the European Union's General Data Protection Regulation (EU-GDPR).⁵⁷ The problem with the HIPAA Privacy Rule is that its strong standard is weakly enforced.⁵⁸ The US Department of Health and Human Services (HHS) Office for Civil Rights (OCR), which enforces the HIPAA Privacy Rule, announced a general policy of not enforcing HIPAA’s de-identification standard in 2012.⁵⁹ With this crucial standard unenforced, US scientific data-sharing policies perhaps unwittingly promoted open sharing of genomic and medical data that, legally speaking, were individually identifiable PHI at the time they were disclosed.⁶⁰  Section III chronicles the steps in America’s gradual descent into medical privacy madness between 1999 and 2012.

This article’s thesis that the HIPAA Privacy Rule is weakly enforced might surprise HIPAA-covered health care providers and insurers that have felt the sting of OCR’s regulatory aggressiveness and paid civil penalties that can be quite large. An example is the hapless health plan that paid a ‘resolution amount’ of $1,215,780.00 to settle ‘potential’ HIPAA violations for returning ‘photocopiers to a leasing agent without erasing the data contained on the copier hard drives’.⁶¹ This article does not deny OCR’s vigorous enforcement of venial privacy sins by HIPAA-regulated entities.⁶² Rather, it discusses a more mortal privacy sin: the regulator’s deliberate turning away from the de-identification standard Congress established in the HIPAA statute.⁶³

Even as weak de-identification practices continue today, the NIH has taken proactive steps to address growing concerns that open data sharing can harm privacy even when the data are ostensibly de-identified.⁶⁴ As an alternative to open sharing, the NIH allows data to be shared through ‘controlled access’⁶⁵ repositories if various conditions apply. Such conditions exist, for example, if the data (i) are ‘sensitive’⁶⁶ or (ii) cannot be de-identified without undermining the data’s scientific utility or (iii) ‘pose risks due to information that can still allow inferences to be made about participants’ even after the data have been de-identified.⁶⁷ NIH’s concept of controlled access mirrors the concept of ‘obtainable’ data under the OSI framework: data are accessible but subject to restrictions.⁶⁸

Under the OSI framework, data that would otherwise be ‘unshareable’—for example, because the data are identifiable or lack consent for broad, unrestricted data use, or due to other legal constraints—can sometimes still be ‘obtainable’ if the recipient agrees to terms and conditions that respect the relevant constraints. Such terms might include, for example, granting users time-limited access within a secure data enclave⁶⁹ or trusted research environment (TRE),⁷⁰ instead of letting users export (download) and retain the data in perpetuity. These approaches reduce the risk of re-identification or misuse of data by limiting the amount of time and the software tools users have available to commit any mischief. Other restrictions could include requiring users to register with the repository and agree to implement strong privacy policies and submit to periodic auditing and reporting. The restrictions might also include a data use agreement that, for example, limits the allowed data uses, forbids re-sharing or re-identification of the data, and requires users to destroy the data after use. Data that cannot be openly shared might still be ‘obtainable’ if users agree to controls that ensure ethical, privacy-preserving use of the data for as long as the data are shared.

Controlled access is the future of medical data sharing in a world without hope that data can truly be de-identified. This future brings fresh legal challenges that Section IV introduces. Administering a controlled access data repository requires ongoing effort and oversight, the costs of which will persist long after the typical 4-year federal grant award expires.⁷¹ Controlled access thus requires a sustainability plan to marshal non-federal revenue streams to cover the ongoing cost of controlled data repositories. Various laws constrain the collection of fees in return for supplying medical data.

For example, the Health Information Technology for Economic and Clinical Health (HITECH) Act⁷² and the HIPAA Privacy Rule restrict ‘data sales’ in which health care providers ‘directly or indirectly receive remuneration in exchange’ for HIPAA-protected data.⁷³ HIPAA violations are usually a civil matter resulting in fines but more rarely can lead to criminal prosecutions, which OCR refers to the US Department of Justice (DOJ).⁷⁴ There is also a remote but still troubling risk that common transactions to sustain controlled data repositories—such as receiving discounts on cloud storage or other outside information technology (IT) services—could implicate the False Claims Act (FCA)⁷⁵ and/or the Medicare Anti-Kickback Statute (AKS).⁷⁶ In addition, the DOJ recently began enforcing its new Data Security Program (DSP), a data export control regulation that restricts the sharing of certain genomic and medical data with various ‘countries of concern’ and ‘covered persons’ with ties to those countries.⁷⁷ Data regulated by the DSP cannot be ‘open’ in the sense of being freely available for anybody to download and will require at least enough controls to ensure DSP compliance.⁷⁸

Truly open medical data may be unachievable without jettisoning privacy. Even so, medical data sharing will continue in some form because it offers scientific and public health benefits. Controlled data sharing helps address privacy concerns but requires sustainable funding. Unless carefully designed, the funding mechanisms can expose investigators and research institutions to new types of legal jeopardy that Section IV of this article explores. Going forward, the law of medical data sharing is, to a great degree, the law of financing medical data sharing.

III. HOW MEDICAL DATA BECAME OPEN

This section describes the HIPAA statute’s demanding standard for data to qualify as de-identified: there must be ‘no reasonable basis to believe’ the data could be re-identified.⁷⁹ It then chronicles a series of steps that weakened this standard until it ceased to be enforced, enabling the rise of open medical data.

III.A. The Central Role of Identifiability in Modern Data Privacy Laws

Many data privacy laws around the world today trace back to a set of fair information practice principles (FIPPs) for automated databases that the US Department of Health, Education, and Welfare (‘HEW’)⁸⁰ published in 1973.⁸¹ The 1973 HEW Report drew the now-familiar distinction between personally identifiable information (PII) and non-identifiable personal information (non-PII) and proposed that privacy rules should focus on protecting PII.⁸²

The fact that ostensibly de-identified medical data can be re-identified is sometimes portrayed, in legal literature, as a ‘[s]urprising [f]ailure of [a]nonymization’ as if it were an unexpected occurrence that reasonable minds could not have foreseen.⁸³ Under this narrative, data custodians who tell us information is de-identified, only to have it later re-identified, are guilty of ‘[b]roken [p]romises’⁸⁴ but not misrepresentation or fraud.⁸⁵ This narrative is far too forgiving. The 1973 HEW Report was aware of re-identification risk 50 years ago. ‘Statistical disclosure’—what we now call re-identification risk—was known to statisticians before 1970, and the 1973 HEW Report recommended a reasonability standard for assessing the risk that it might occur.⁸⁶ A reasonability standard does not require absolute certainty that data will never be linked back to a particular individual; it merely requires that there be no reasonable basis to believe re-identification could occur.⁸⁷

Congress included a reasonability standard in the 1996 HIPAA statute.⁸⁸ The statute defines ‘individually identifiable health information’ as health information that ‘(i) identifies the individual; or (ii) with respect to which there is a reasonable basis to believe that the information can be used to identify the individual’.⁸⁹ The HIPAA Privacy Rule parrots this statute word-for-word when defining ‘protected health information’ (PHI), the individually identifiable information the regulation protects.⁹⁰

The HIPAA Privacy Rule states a standard for de-identifying data so that it ceases to be PHI. Its ‘de-identification standard’ at 45 C.F.R. § 164.514(a) states that health information is ‘not individually identifiable’ if two conditions are both met: (i) the information ‘does not identify an individual’, and (ii) ‘there is no reasonable basis to believe that the information can be used to identify an individual’.⁹¹ This is logical and correct. If the statute provides that information is identifiable if (i) or (ii) is true, then information is not identifiable if (i) is not true and (ii) is not true. The Privacy Rule’s de-identification standard faithfully follows the HIPAA statute.

Similar reasonability standards appear in most modern privacy laws that define identifiable or non-identifiable data. For example, the proposed American Data Privacy Protection Act⁹² from 2022 and the proposed American Privacy Rights Act (APRA) from 2024⁹³ both included reasonability standards for data de-identification. The EU-GDPR calls for data controllers to have a reasonable basis for their decisions deeming data to be either identifiable (and thus protected) or ‘anonymized’ (and outside the scope of protection).⁹⁴ The EU-GDPR’s concept of ‘anonymized’ data applies the same legal standard that HIPAA requires for data to be ‘de-identified’: data must be treated as identifiable if there is a reasonable basis to believe the data could be re-identified.

III.B. De-identification Standards as a Scienter Requirement

The Privacy Rule’s de-identification standard is best understood as a scienter requirement—that is, a description of the state of mind personnel of a HIPAA-covered entity must have when declaring data to be de-identified (non-PHI).⁹⁵ They must have a reasonable basis to believe their determination is accurate. Under this standard, they need not be 100 per cent certain.⁹⁶ It is not against the law to be mistaken, but they must ‘exercise reasonable care or competence in obtaining or communicating information’ about data’s de-identification status and re-identification risk.⁹⁷

This ‘reasonable care and competence’ standard is the same scienter a person needs at common law to avoid liability for negligent misrepresentation, a tort that is available ‘[w]hen there is no intent to deceive but only good faith coupled with negligence’.⁹⁸ The HIPAA statute sets this as its scienter requirement for de-identifying data. In effect, it requires covered entities to avoid making negligent misrepresentations about de-identification status and re-identification risk.

Obviously, this standard also implies that covered entities must avoid the more serious violation of making fraudulent claims that data are de-identified. Under the Second Restatement of Torts, an erroneous statement is fraudulent if the speaker knows or believes, when making the statement, ‘that the matter is not as he represents it to be’ (actual knowledge of falsehood), or if the speaker ‘does not have confidence in the accuracy’ of the facts ‘he states or implies’, or if the speaker ‘knows that he does not have the basis for his representation’.⁹⁹ In addition to this ‘scienter’ (ie awareness that assurances about de-identification are false or very shaky), fraudulent misrepresentation is an intentional tort also requiring intent to deceive (an intent, or at least a ‘reason to expect’ that the false or shoddy assurances will influence choices made by the person who receives them).¹⁰⁰ Survey data confirm that de-identifying data has a material impact on people’s willingness to share personal information.¹⁰¹ This supports an inference that covered entities offering false assurances that data have been de-identified do have the requisite intent to deceive.

The HIPAA statute sets a demanding standard for parties who make claims that data have been or will be de-identified. This standard goes beyond merely requiring them not to commit outright fraud when offering these assurances. They must, in addition, take care not to make negligent representations for want of competence or reasonable care.

III.C. Impact of De-identification on Individuals’ Legal Rights

The 1996 HIPAA statute was unusually sparse in terms of substantive standards to guide the rulemaking that produced the HIPAA Privacy Rule. HIPAA was an insurance statute.¹⁰² Its Administrative Simplification provisions authorized HHS to regulate the electronic exchange of information among health care providers, insurers, and others in the chain of payment for clinical health care.¹⁰³ Privacy was just one of many regulatory concerns.¹⁰⁴ HHS was concerned that the HIPAA statute had not granted HHS sufficient authority to be fully effective as a privacy regulator.¹⁰⁵ The HIPAA statute foresaw that Congress would enact follow-up health privacy legislation by August 21, 1999 and thus offered few substantive details itself.¹⁰⁶ HHS would have authority to promulgate the HIPAA Privacy Rule only if Congress failed to legislate.¹⁰⁷ HHS reluctantly took up the task in 1999 after Congress failed to legislate.¹⁰⁸

Given the sparsity of substantive privacy standards in the HIPAA statute, it is striking that Congress went to the trouble to include clear statutory definitions of ‘health information’¹⁰⁹ and ‘individually identifiable health information’.¹¹⁰ This effort was warranted, because properly characterizing data as identifiable or de-identified profoundly affects people’s rights and legal duties.¹¹¹ Moreover, a clear scienter standard is needed when assessing whether criminal HIPAA violations have occurred.¹¹²

If health information is not individually identifiable (not PHI), it can be freely used and shared without individual authorization and escapes the Privacy Rule’s other privacy protections. Those other protections, such as the HITECH Act’s restrictions on data sales, only apply to PHI.¹¹³ Deeming data to be de-identified puts the data outside the scope of HITECH’s requirement for covered data sellers to obtain individual authorization for data sales after disclosing that they will receive remuneration in exchange for the data.¹¹⁴

False assertions that data are de-identified also thwart people’s right to find out who has received or bought their data. Empirical studies show that people want to know who has their data and the purpose of the disclosure, and these questions persist even when data have been de-identified.¹¹⁵ The HIPAA Privacy Rule allows individuals to request an accounting for disclosures of PHI made for up to six years prior to the date of a request.¹¹⁶ After receiving such a request, a HIPAA-covered entity must provide a written accounting describing what types of information were disclosed, the dates of the disclosures, the recipients, and the purpose of the disclosures.¹¹⁷ Unfortunately, these requirements do not apply to disclosures of de-identified data, so people have no way to know if their de-identified data have been sold, who has it, or how it is being used. Once a HIPAA-covered entity declares data to be ‘de-identified’, people lose these important rights. Because false assertions that data are de-identified affect individuals’ rights so profoundly, Congress set a clear standard for determining whether health information is individually identifiable, and the HIPAA Privacy Rule accurately mirrors this standard.¹¹⁸

III.D. The Progressive Erosion of HIPAA’s De-identification Standard

This discussion traces a series of steps eroding the crucial HIPAA de-identification standard Congress established in 1996. To summarize, during the HIPAA privacy rulemaking of 1999–2000, HHS made a decision to ease HIPAA’s demanding reasonability standard for certain small, unsophisticated health care entities that rarely share much data. As originally conceived, this was to be a temporary measure and arguably was a valid exercise of enforcement discretion to help small-scale actors, who often receive light-handed regulation in US regulatory practice. Unfortunately, the policy was badly implemented, sowing ongoing confusion that led, in 2012, to a further clarification that crossed the line into a general policy of not enforcing HIPAA’s de-identification standard.¹¹⁹ This discussion retraces the history in ponderous detail to allay readers’ understandable skepticism that an industry accounting for 18% of US gross domestic product could pervasively violate a major federal statute without anybody noticing and with few legal consequences.¹²⁰

III.D.1. The origin of HIPAA’s safe harbor method

The HIPAA Privacy Rule states its de-identification standard at 45 C.F.R. §164.514(a), followed by § 164.514(b), which supplies ‘implementation specifications’.¹²¹ In the implementation specifications, HHS sought to clarify what it means to have ‘no reasonable basis to believe’ that information can be re-identified. It is fairly common for US federal laws to state open-textured reasonability standards that regulatory agencies are left to interpret and apply, such as the ‘just and reasonable’ rates traditionally required in public utility statutes like the Natural Gas Act.¹²² There is a difference, however, between a reasonable thing, such as a utility rate, and a reasonable belief. The latter is a scienter requirement, and it is not really a federal agency’s responsibility to define what is reasonable for people to believe.¹²³

The §164.514(b) implementation specifications state that ‘[a] covered entity may determine that health information is not individually identifiable health information only if’ it has applied either of two HHS-approved de-identification methods.¹²⁴ The two italicized passages are carefully worded legalese, as explained below after briefly introducing the two approved de-identification methods.

The first method, commonly known as ‘expert determination’, is to have an appropriately skilled expert determine and document that the risk of data re-identification is ‘very small’.¹²⁵ This method correctly states the essence of what it takes to have no reasonable basis to believe data can be de-identified. To avoid making a negligent misrepresentation, one should engage an ‘appropriately skilled expert’ to determine and document that a risk is ‘very small’. Taking these steps would, in fact, satisfy the common-law concept of exercising ‘reasonable care and competence’ before concluding that the risk is unlikely to occur. The expert determination method thus reflects a permissible interpretation of what HIPAA’s de-identification standard requires.

The second method, called ‘safe harbor’ de-identification, unfortunately falls short.¹²⁶ It requires that 18 listed identifiers ‘are removed’¹²⁷ and simultaneously that ‘[t]he covered entity does not have actual knowledge that the [remaining] information could be used alone or in combination with other information to identify an individual who is the subject of the information’.¹²⁸ This does not, under any conceivable legal theory, satisfy Congress’s ‘reasonable basis to believe’ standard, which requires covered entities to avoid making negligent misrepresentations about re-identification risk. Instead, it replaces Congress’s standard with a much lower standard: covered entities must not knowingly commit fraud.¹²⁹ Having no actual knowledge that your house is on fire is a different state of mind than having no reasonable basis to believe it could ever catch on fire.

The ‘only if’ locution in § 164.514(b) is an instance of crafty legal wording. The implementation specifications at § 164.514(b) would be ripe for judicial invalidation if they directly contradicted the de-identification standard at 45 C.F.R. §164.514(a) and the HIPAA statute itself.¹³⁰ Section 164.514(b) carefully avoids a direct contradiction. It states that information is de-identified ‘only if’ one of the two listed de-identification methods (expert determination or safe harbor) has been applied, but not ‘if’.¹³¹ Using one of the two listed methods is thus a necessary condition, but not a sufficient condition, for determining that health information is de-identified.¹³² To be sufficient, there also must be ‘no reasonable basis to believe’ the data could be re-identified.¹³³ To clarify with a familiar example, consider the following sentence: ‘A person can be President of the United States only if they are at least 35 years old’. Here, being at least 35 is necessary but not sufficient to become President, because there are various additional requirements such as being a US citizen and winning a presidential election. Many people are over 35 years old without being President, so simply being over 35 is not sufficient.

The implementation specification suggests, but never actually states, that using the safe harbor method is sufficient to de-identify data. Casual readers might think it sufficient, but careful readers – for example, anybody with a reasonably sentient lawyer – can see that they still must meet the ‘no reasonable basis to believe’ scienter standard in § 164.514(a) before deeming data to be de-identified. The ‘may determine’ language in the implementation specification highlights this requirement.¹³⁴ After a covered entity has employed one of the two approved methods–expert determination or safe harbor–this does not mean the data are now de-identified, because there is still a determination to be made. Using one of the two methods simply means the covered entity has satisfied the necessary condition to move on to the next step and make that determination. When making that determination, the de-identification standard at § 164.514(a) governs: a covered entity ‘may determine’ that the data are ‘not individually identifiable health information’ if there is ‘no reasonable basis to believe’ the data could be re-identified. Only after that determination has been made can the data be treated as de-identified.

The rulemaking preambles for the HIPAA Privacy Rule make clear that HHS was aware that safe harbor de-identification does not ensure compliance with the HIPAA statute.¹³⁵ The safe harbor method evolved between 1999, when HHS first proposed it, and 2000, when HHS finalized it in its current form.¹³⁶ The 1999 proposed safe harbor required covered entities to have ‘no reason to believe’ that data could still be re-identified after removing 19 specific identifiers.¹³⁷ The year-2000 final safe harbor changed the scienter for safe harbor de-identification, requiring ‘no actual knowledge’ of re-identification risk after removing a revised list of 18 specific identifiers.¹³⁸ HHS acknowledged it was changing the scienter standard ‘in order to provide greater certainty to covered entities using the safe harbor approach’.¹³⁹

HHS did not discuss how this change might affect people’s privacy. As HHS put it, ‘[t]he safe harbor is intended to involve a minimum of burden and convey a maximum of certainty that the rules have been met by interpreting the statutory “reasonable basis to believe that the information can be used to identify the individual” to produce an easily followed, cook book approach’.¹⁴⁰ The overall tone of this discussion suggests that the primary concern of a privacy regulator is to minimize burdens on regulated entities, rather than to protect privacy. Viewed a certain way, it is a refreshing breath of fresh air for a regulator to disclose its priorities with such candor.

From a legal perspective, however, HHS was not interpreting the statute but materially altering the scope of its applicability. In today’s large-scale data environments, there is often (almost always) a reasonable basis to believe data de-identified using the safe harbor method could be re-identified, unless additional protections are in place, such as providing time-limited access to data within a secure data enclave or TRE with strict privacy commitments and contractual limitations on data use and state-of-the-art technical safeguards.¹⁴¹ If there is a reasonable basis to believe data can be re-identified, then the data are still PHI as defined in the HIPAA statute, and Congress intended for the data to receive HIPAA’s full protections.

III.D.2. The safe harbor method as a valid exercise of enforcement discretion

The 1999 rulemaking clearly understood the statute’s ‘no reasonable basis to believe’ language to be a scienter standard reflecting the state of mind a covered entity must have when deeming data to be de-identified: ‘In enforcing this regulation, the Secretary would consider the sophistication of covered entities when determining whether a covered entity had reason to believe that information it had attempted to de-identify continued to identify the subject’.¹⁴² HHS stated its intent to apply enforcement discretion on a case-by-case basis when assessing each covered entity’s scienter. ‘Covered entities that routinely create and distribute de-identified data would be expected to be aware of and to use advanced statistical techniques’ [ie, the expert determination method], whereas ‘covered entities that rarely create de-identified information would not be expected to have the same level of knowledge of those statistical methods’.¹⁴³

HHS portrayed the safe harbor method as a discretionary exception for small entities whose low volume of data sharing left them with insufficient staffing and experience to apply the more demanding expert determination method.¹⁴⁴ Professor Kellen Zale, in studying regulation of small economic actors, notes that ‘regulatory systems typically treat small-scale activities with reduced stringency’ and that there are sound rationales for doing so.¹⁴⁵ US regulators often focus scrutiny on large players that ‘pose greater harm and have more resources to address problems’ while offering safe harbors or other special breaks for small actors, and some commentators even recommend this approach as a ‘better practice’ offering ‘important lessons for E.U’.s GDPR and its international emulators’¹⁴⁶.

HHS also portrayed the safe harbor method as a temporary, transitional measure to allow time for a new service industry to emerge: expert determination de-identification service providers with which HIPAA-covered entities could contract to de-identify PHI using the most advanced statistical techniques. As of 2000, HHS observed that ‘very few small entities engage in de-identification currently. Fewer small entities are expected to engage in such activity in the future because the increasing trend toward computerization of large record sets will result in de-identification being performed by relatively few firms or associations over time’.¹⁴⁷ As this new industry emerged, covered entities would ‘find it more efficient to contract with specialists in large firms to de-identify protected health information’ instead of de-identifying data themselves.¹⁴⁸

This new service industry, unfortunately, did not emerge at the scale HHS anticipated. HHS’s own inartful regulatory drafting destroyed its economic viability: the HIPAA Privacy Rule failed to define the eligible class of smaller, unsophisticated hospitals and care providers for which the safe harbor method was originally intended. With no eligibility criteria specified, covered entities of all sizes and levels of sophistication predictably embraced the safe harbor method as their primary means of data de-identification.¹⁴⁹ It is clear-cut, conceptually simple, and saves the cost of maintaining a staff of statisticians and data scientists (or hiring outside experts) to implement the expert determination method. Why would you pay money to hire an expert determination service provider to ensure state-of-the-art data de-identification, when you can strip 18 identifiers off for free?

Had the Privacy Rule stated eligibility criteria, the safe harbor method might have been a permissible exercise of regulatory enforcement discretion.¹⁵⁰ For example, granting lenity to small community hospitals could have been justified as a necessary measure to increase inclusivity and reduce bias in health data sets, which all too often draw data from leading academic medical centers and research hospitals that serve relatively privileged, well-insured patient populations.¹⁵¹ But with no eligibility criteria to limit its use, the vast majority of covered entities, large and small, embraced the safe harbor method that HHS intended as a discretionary exception for a few small, unsophisticated players.

HHS allowed this outcome by not following its own stated policy of requiring ‘entities that routinely create and distribute de-identified data’ to ‘use advanced statistical techniques’ for de-identification.¹⁵² When HHS failed to implement this policy, safe harbor de-identification ceased to be a valid exercise of enforcement discretion. It morphed into a general policy of non-enforcement of the HIPAA statute, amounting to ‘prospective licensing of prohibited conduct’¹⁵³–ie, of allowing the prohibited sharing of PHI, in the form of weakly de-identified data that there is a reasonable basis to believe can be re-identified.

III.D.3. Safe harbor de-identification becomes a general HIPAA non-enforcement policy

Use of the safe harbor method was rampant after 2003–04, but there was ongoing discomfort with it. Most large hospitals and academic medical centers have well-staffed counsel’s offices that can read laws and know that reasonable belief and actual knowledge are two different states of mind. Amid calls for clarification, the Obama Administration’s first major piece of legislation, the 2009 American Recovery and Reinvestment Act (ARRA), ordered the Secretary of HHS to provide guidance on how to de-identify data under the HIPAA Privacy Rule.¹⁵⁴ In response, the HHS Office for Civil Rights, which administers the Privacy Rule, issued an influential 2012 Guidance.¹⁵⁵

The salient feature of the 2012 Guidance, for this discussion, is that it interprets the carefully worded ‘only if’ in § 164.514(b) of the Privacy Rule to mean ‘if’.¹⁵⁶ The Guidance abandons pretense and announces that HHS intends to treat safe harbor de-identification as sufficient (and not merely necessary) to de-identify data.¹⁵⁷

The 2012 Guidance starts well, correctly reciting the de-identification standard at 45 C.F.R. §164.514(a) of the HIPAA Privacy Rule: ‘health information is not individually identifiable if it does not identify an individual and if the covered entity has no reasonable basis to believe it can be used to identify an individual’.¹⁵⁸ Then, it describes the expert determination and the safe harbor methods of de-identification.¹⁵⁹ The 2012 Guidance erroneously asserts that ‘[s]atisfying either method would demonstrate that a covered entity has met the standard in 45 C.F.R. § 164.514(a)’.¹⁶⁰ The Privacy Rule delicately avoids a direct clash with the HIPAA statute, treating the two methods (expert determination or safe harbor) as necessary, but not sufficient, to meet the de-identification standard.¹⁶¹ The 2012 Guidance shows no such scruples, asserting that safe harbor is sufficient: an entity that uses either method ‘has met’ the standard.¹⁶² This assertion is inconsistent with the plain wording of the HIPAA statute and the HIPAA Privacy Rule’s own de-identification standard.¹⁶³

Stating something in a guidance document does not make it true.¹⁶⁴ However, agency policies announced in guidance documents are especially hard to challenge in court: ‘Even assuming standing to sue can be shown, a guidance document may not be considered final agency action or ripe for review’.¹⁶⁵ For this reason, when an agency wishes to nullify its enabling statute, it is safer to do so in a guidance document than in a regulation.

Even when guidance documents are legally untrue, they often linger unchallenged and have a ‘practically binding’¹⁶⁶ effect that ‘still establishes the law for all those unwilling to pay the expense, or suffer the ill-will of challenging the agency in court’.¹⁶⁷ Errant guidance documents often evade legal challenges and elicit ‘grudging compliance, “even when the doubts as to the lawfulness of the [guidance] are substantial.”’¹⁶⁸ In the case of the 2012 Guidance, which eases compliance burdens for regulated entities, they presumably hold no grudges and have no reason to challenge it.

The only parties with grudges would be patients whose PHI is shared and sold without their authorization under false assurances that the data are de-identified. Patients, unfortunately, face multiple barriers to challenging HHS’s non-enforcement policy. Lacking access to counsel, they might not even realize the law is being violated. If they do, the HIPAA Privacy Rule has no private right of action.¹⁶⁹ There is an administrative complaint process that directs them to petition the same regulator that nullified their statutory protections to enforce the protections.¹⁷⁰

HIPAA’s de-identification standard can help inform the standard of care if a suitable common-law or statutory cause of action is available, but it can be difficult for patients to establish standing to bring such suits.¹⁷¹ Federal circuits are split on the question of whether being exposed to heightened re-identification risk constitutes ‘injury-in-fact’ as required for standing.¹⁷² And, indeed, it is hard to find people who have been demonstrably harmed by the open sharing of data de-identified using the safe harbor method, although this may reflect the difficulty of demonstrating causation rather than the actual absence of harm. Injuries such as medical identity theft and health-based discrimination occur, but the data flows that led to them are often too untraceable to demonstrate how the harm came about or whose privacy lapse caused it.

The 2012 Guidance is in the nature of a general non-enforcement policy and, as such, enjoys a presumption against reviewability.¹⁷³ It can be hard to trace specific, concrete injuries to a regime of weak regulatory enforcement. Attempts to bring Section 1983 suits to enforce patients’ privacy rights run up against the reality that the HIPAA statute and Privacy Rule do not unambiguously grant patients any enforceable civil rights, instead focusing on broad institutional policies and practices of covered entities.¹⁷⁴ More generally, courts are reluctant to second-guess agencies’ civil enforcement decisions in the administrative context: ‘an agency’s decision not to take enforcement action should be presumed immune from judicial review’.¹⁷⁵

This presumption against reviewability can be overcome in various circumstances, some of which are relevant here.¹⁷⁶ One relevant exception occurs when ‘the substantive statute has provided guidelines for the agency to follow in exercising its enforcement powers’.¹⁷⁷ The HIPAA statute sets a statutory standard that information is individually identifiable if there is ‘reasonable basis to believe’ it can be re-identified.¹⁷⁸ This is not a matter that Congress ‘committed to agency discretion’ such that a court would have ‘no law to apply’ when reviewing HHS’s general policy of holding covered entities to a lower standard.¹⁷⁹

Another relevant exception occurs when an agency ‘consciously and expressly adopt[s] a general policy that is so extreme as to amount to an abdication of its statutory responsibilities’.¹⁸⁰ There is not a large body of case law to clarify when an agency’s refusal to enforce the law rises to the level of abdicating statutory responsibilities,¹⁸¹ presumably because it is hard for plaintiffs to establish standing to challenge non-enforcement decisions.¹⁸² Courts are thought to be more willing to review a general policy of non-enforcement than ‘individual, isolated non-enforcement decisions’.¹⁸³ In Crowley Caribbean Transportation v. Pena, the D.C. Circuit found a general enforcement policy reviewable when an agency ‘expressed the policy as a formal regulation’ or otherwise established a ‘general policy delineating the boundary between enforcement and non-enforcement’ in a way that ‘purport[s] to speak to a broad class of parties’.¹⁸⁴ This accurately describes the safe harbor method at § 164.514(b)(2) of the HIPAA Privacy Rule. By failing to define the small hospitals for which the safe harbor was originally intended, the safe harbor regulation authorizes the entire regulated industry to benefit from a weak de-identification standard that HHS described, in rulemaking, as a discretionary exception for unsophisticated small players that share data in low volumes.

HHS’s general policy of not enforcing HIPAA’s de-identification standard arguably fits in these exceptions to the presumption against reviewability and could be challenged. Despite this, a successful challenge seems unlikely. Even if patients could establish standing to challenge HHS’s failure to enforce HIPAA’s de-identification standard, they still face the question of whether a guidance document is ripe for review.¹⁸⁵

III.E. How HIPAA De-identification Would Work (if the Law Were Enforced)

HHS’s non-enforcement policy has obfuscated HIPAA’s de-identification standard to a point that it is now widely misunderstood. The ‘may determine’ and ‘only if’ phrases in the implementation specification at 45 C.F.R. § 164.514(b) imply that safe-harbor de-identification is a two-step process.

Step 1. The ‘no actual knowledge’ requirement in the safe harbor method at §164.514(b)(2)(ii) is a useful reality check, when applying this method, to detect known conditions that would preclude its use. Here, the 2012 Guidance offers helpful examples.¹⁸⁶ If data have been stripped of the listed 18 identifiers but still reveal that a patient has an inherently identifying job occupation (eg, ‘former president of State University’) or a rare and identifying clinical condition (eg, the patient gave birth to octuplets), this counts as actual knowledge that the remaining information is still identifiable.¹⁸⁷ There is also actual knowledge if data will be shared with a recipient known to possess contextual knowledge that would make it possible for the recipient to recognize individuals in the data set.¹⁸⁸

In these situations, where known characteristics of the data or of the intended recipient thwart safe harbor de-identification, the covered entity needs to take additional steps to de-identify the data. These could include, for example, removing additional information (such as occupations and rare clinical conditions) or restricting who can receive the information or, in the alternative, crafting a data protection plan that passes muster under the expert determination method.¹⁸⁹

Step 2. When there is no actual knowledge of such conditions, using the safe harbor method is allowed but is not, by itself, sufficient to ensure that the remaining information has ceased to be individually identifiable health information.¹⁹⁰ The de-identification standard at §164.154(a) requires a further finding that there is ‘no reasonable basis to believe that the information can be used’ to identify an individual before the information qualifies as ‘not individually identifiable’.¹⁹¹ This additional finding is a crucial step and is legally required.¹⁹²

For over 15 years, computer scientists have warned that ‘[w]ithout a formal analysis of the risk of re-identification, assurances of data anonymity may not be accurate’.¹⁹³ Despite these warnings, many data custodians and their ethics review bodies share de-identified data without a formal analysis of re-identification risk,¹⁹⁴ perhaps taking comfort that the 2012 Guidance seems to allow such sharing.¹⁹⁵ These lax privacy practices persist even as advances in data analytics make re-identification attacks progressively easier to carry out and thus more foreseeable.¹⁹⁶

The §164.514(a) de-identification standard requires a broad inquiry into what is reasonably foreseeable after data are released. Might the known recipient re-share the data with others, as commonly occurs if data are shared without a data use agreement preventing re-disclosure? Would it be reasonable to require a data use agreement contractually binding the recipient not to re-disclose the data? The risk of re-identification varies depending on the specific terms of sharing: Is information shared in a secure enclave allowing recipients to access it for a finite period of time but not to download or export it from the enclave? Can users download the data and keep it in perpetuity? Are users under a contractual obligation to destroy the data after completing their study? Are they bound by contract not to attempt to re-identify it? Must they submit to regular audits to ensure they comply with agreed terms of use?

The 2012 Guidance notes that ‘technology, social conditions, and the availability of information changes over time’.¹⁹⁷ There is a temporal element to re-identification risk. There may have been ‘no reasonable basis to believe’ safe harbor data could be re-identified when the 2012 Guidance issued, but every reason to believe risks are higher today due to advances in computational techniques and wider availability of linkable data sets. There might be ‘no reasonable basis to believe’ data can be re-identified today or over the next year, but every reason for concern if the data will remain in circulation for a decade. The HIPAA Privacy Rule protects a person’s PHI throughout their lifetime and ‘for a period of 50 years following the death of the individual’.¹⁹⁸ If there is a reasonable basis to believe a person’s safe harbor de-identified data can be re-identified in that time frame, the person seemingly should be asked to authorize the release.

Covered entities that release safe harbor data without weighing such factors are violating HIPAA’s de-identification standard. Weakly de-identified data that have not met HIPAA’s true de-identification standard are PHI and cannot lawfully be shared without first obtaining individual authorization¹⁹⁹ or else complying with one of 22 carefully enumerated exceptions to authorization that the Privacy Rule provides.²⁰⁰ These exceptions protect socially beneficial data flows for specific public health, regulatory, law enforcement, national security, and other enumerated uses.²⁰¹ Each such exception specifies its own set of alternative privacy protections that covered entities must follow when sharing personal data without authorization–for example, restrictions on how much data can be shared, restrictions on who is eligible to receive the data, and procedures to follow before sharing PHI.²⁰² If there is a reasonable basis to believe that safe harbor data can be re-identified, these 22 exceptions are the only lawful pathways for disclosing the data without individual authorization.

III.F. Root Causes of HHS’s Non-enforcement of HIPAA’s De-identification Standard

The fact that a 12-year-old guidance document misstates the law hardly seems worth the amount of space just devoted to it. Federal agencies do, with depressing regularity, publish legally flawed guidance documents.²⁰³ What is striking here is the scale of non-compliance with HIPAA’s de-identification standard. Variants of safe harbor de-identification to remove names and other obvious identifiers are ‘the most widely used privacy preservation techniques for medical datasets’.²⁰⁴ In a recent survey of twelve major US academic medical centers, all reported relying primarily on HIPAA’s safe harbor when de-identifying data (although some noted they sometimes apply additional protections such as data use agreements).²⁰⁵ The vast scale of noncompliance with this federal statute elicits surprise and a wish to understand what went wrong. This section attributes the problem to two simultaneous factors: disempowerment of the affected public and disempowerment of the regulator charged with protecting the public.

III.F.1. Diminished public voice in privacy policy-setting

The 1973 HEW Report, a foundational document in modern data privacy law, stressed that if databases contain personal information, they ‘must, therefore, be governed by procedures that afford the individual a right to participate in deciding what the content of the record will be, and what disclosure and use will be made of the identifiable information in it’.²⁰⁶ Subsequent privacy laws did not heed this imperative.

A right to participate in database governance would mean involving individuals in decisions about what types of data our society should generate and collect, how data should be maintained and kept secure, what data uses are permissible, and what privacy protections are required when data are shared and used.²⁰⁷ In practice, these decisions are made through top-down, expert-led processes involving educated elites–medical researchers, legal scholars, privacy theorists, bioethicists, ethics review bodies, policymakers, regulators, compliance officers, and commercial technology companies–who set data use and privacy policies with almost no input from the affected public.²⁰⁸ Data subjects–the patients whose medical information fuels biomedical discovery–have, at most, only a narrow legal right of informed consent/authorization that lets them accept or reject policies already set by these experts.²⁰⁹

The idea of individual consent as a privacy protection arose several years after the 1973 HEW Report and was not what it meant by ‘a right to participate’ in database governance.²¹⁰ Nevertheless, by the year 2000, obtaining consent before collecting or sharing PII was the ‘leading paradigm on the Internet and in the real, or offline world’ for protecting individual privacy.²¹¹ This approach has various names: control-over-information theory,²¹² informed consent,²¹³ a notice and choice model,²¹⁴ privacy self-management,²¹⁵ or a rights/compliance model.²¹⁶ This approach calls for individual consent (opt in or at least opt out²¹⁷) before collecting a person’s PII/PHI or disclosing or using it for additional (secondary) purposes. It usually allows unconsented access to PII/PHI for a narrow set of socially beneficial purposes authorized by law, and excludes personal data from consent requirements if the data are deemed not to be PII/PHI.²¹⁸

Equating consent rights with privacy protection has various flaws. The most obvious is that consent does not itself protect privacy and often serves as a permission to let one’s privacy be abused.²¹⁹ Real privacy protection requires a duty-based approach, placing those who collect, store, and use people’s data under binding duties to keep the data well protected and properly used and holding them accountable if they fail.²²⁰ Worse still, consent-based privacy frameworks disempower people by preoccupying them with small, immediate, and relatively inconsequential individual consent dilemmas while distracting them from crucial decisions about database governance on which their privacy actually depends.²²¹ As described below, the 2012 Guidance offers a stark example of public disempowerment.

In 2010, HHS/OCR convened a Workshop²²² to discuss ways to comply with the ARRA mandate to issue guidance clarifying the Privacy Rule’s de-identification implementation specifications.²²³ The Workshop was open to the public but featured invited speaker panels of leading privacy experts, mostly drawn from academic and corporate data-using organizations and HIPAA-regulated health care institutions.²²⁴ After the conference, HHS/OCR stated that it ‘synthesized the input from workshop panelists and general comments to incorporate into [the 2012 Guidance]’.²²⁵ The Guidance thus heavily privileged the views of 24 invited experts who spoke at the 2010 Workshop.

The Census Bureau reports that 308.7 million people were present in the United States in 2010, rising to 312.8 million in 2011²²⁶ They were the protected class whose privacy was affected by the 2010 Workshop. In terms of educational attainment, 70% of the population over the age of 25 lacked a Bachelor’s degree; 19% held a Bachelor’s degree but no advanced degrees; 8% held a Bachelor’s degree plus a terminal Master’s degree; and 3% had a doctoral or professional degree, as seen in the hashed bars in Fig. 1.²²⁷ In contrast, the 24-member panel was a highly educated privacy elite. The 24 panelists (shown in solid black in Fig. 1) included nobody without a Bachelor’s degree; 4% (1/24) with a Bachelor’s degree only; 4% (1/24) with a Bachelor’s and Master’s degree; and 92% (22/24) with at least one doctoral-level degree (including three with an MD plus a Ph.D. or Master’s of Public Health degree, two with an M.D. only, twelve with only a Ph.D., and five with J.D. degrees).²²⁸

Figure 1.

HHS/OCR 2012 Guidance on HIPAA De-identification: Policy-Setting Panel vs. the Affected Public.

The 24 expert panelists included representatives from seven private commercial entities involved in the data processing business (eg, MITRE Corp., Microsoft, and survey research centers, consultants, and de-identification service providers); twelve universities and large academic medical centers that generate, process, and share health data; two independent, non-profit organizations (The Center for Democracy and Technology and the Institute of Medicine); two government bodies that use health data (the National Center for Health Statistics in the Centers for Disease Control and the National Library of Medicine within the National Institutes of Health); and one practicing attorney experienced in privacy law.²²⁹

These 24 panelists are leading experts with impeccable reputations in their fields. The point here is not to criticize them for volunteering their time to help inform the nation’s privacy policies. Rather, the point is to criticize the regulatory process that produced the 2012 Guidance and the agency that orchestrated the process. The agency’s concept of ‘stakeholder’ input privileged the voices of elite privacy and biomedical specialists, unreflective of the HIPAA Privacy Rule’s protected class and having interests (eg ready access to data for research and commercial projects) potentially adverse to the public’s desire for privacy.²³⁰

Apart from not treating the affected public as ‘stakeholders’, the 2012 Guidance is irregular in other ways. It lacks disclaimers that commonly appear on modern guidance documents (such as a disclaimer about their non-binding nature).²³¹ It has various procedural irregularities. Guidance documents do not require notice-and-comment rulemaking under the Administrative Procedure Act (APA).²³² However, the 2012 Guidance rewrites a key provision of the HIPAA Privacy Rule, claiming that the safe harbor method is sufficient to de-identify data under the regulation (which the regulation itself never claims). That is a material regulatory revision and called for notice-and-comment rulemaking.²³³ Without concern for the appearance of ex parte communications, the Guidance credits and thanks a panel member–representing a large HIPAA-covered medical research institution–who assisted OCR in preparing the Guidance.²³⁴ HHS’s web page introducing the 2012 Guidance misstates the section of ARRA that charged OCR with developing the Guidance.²³⁵ Despite all these irregularities, the 2012 Guidance clearly seems to state a policy that OCR intends to follow in its enforcement of the HIPAA regulation.

The sort of stakeholder input incorporated in the 2012 Guidance justifies recent calls to banish the word ‘stakeholder’ from polite discourse altogether. ‘To start, “stakeholder” has a mercenary connotation’ tracing to its origins in gambling as the ‘person who literally held the money of bettors while the game was on’.²³⁶ Others criticize its allusion to settler colonialism, where the ‘word has been used, for example, to “stake a claim” (using stakes to mark out Indigenous land to be claimed by colonizing settlers)’.²³⁷ Other critics object to the suggestion that one’s sensitive personal data are something that other parties have a ‘stake’ or interest in.²³⁸

The 2012 Guidance hits every single one of these sour notes by incorporating recommendations of a panel of experts representing commercial and academic data processors, public health bodies, survey organizations that use people’s data, and the health institutions that routinely disclose those data to them. These entities have ‘staked claims’ to patient data; they feel they have a ‘stake’ or interest in patient data, and they are ‘holding’ patients’ data during a game with rules that leave patients gambling whether their privacy will be protected.²³⁹

The 2012 Guidance misstates the law. It excludes large swathes of identifiable health information from the protections of the HIPAA Privacy Rule by erroneously asserting that safe harbor de-identification ‘has met the standard in 45 C.F.R. § 164.514(a)’.²⁴⁰ De-identified data play an important role in scientific discovery, regulatory oversight, public health, and many other socially beneficial purposes, but re-identification risks are real. It is crucial for privacy laws–and the agencies that enforce those laws–to hold data custodians to a duty to exercise reasonable care and competence to manage re-identification risks.

III.F.2. Sectoral regulators and the conflict between privacy and programmatic goals

US privacy laws are criticized as “sectoral” because they address privacy in specific industrial sectors instead of applying uniform principles throughout the information economy.²⁴¹ Yet a strong case can be made for sectorally aware policy-setting, because privacy norms are contextual.²⁴² The risks and the social benefits of data sharing are sector-specific, and this is particularly true in medicine.²⁴³ Bringing sectoral expertise to bear on privacy rule-setting can have value. Even the EU-GDPR–lauded for the apparent universality of its approach–preserves an element of sectoral rule-setting by granting the 27 E.U. Member States leeway to deviate from its standards in various contexts where necessary to protect public interests, including medical privacy.²⁴⁴

Problems arise, though, when sectoral regulators not only help set, but also enforce, privacy rules–a pattern common in the US with its decentralized privacy enforcement structure. If privacy enforcement comes into conflict with broader regulatory programmatic goals, privacy can suffer. HIPAA offers a useful lens into the pressures sectoral privacy regulators face. HHS has 80,000 federal employees, with 13 major operating divisions including the Centers for Medicare and Medicaid Services (CMS), which administers $1.6 trillion in Medicare and Medicaid spending covering 160 million Americans; the NIH, with $50 billion for biomedical research programs; the Centers for Disease Control and Prevention (CDC), with $16 billion of outlays for public health programs: and the Food and Drug Administration (FDA), with $4 billion for food and medical product safety.²⁴⁵ OCR, which enforces the HIPAA Privacy Rule in amid many other responsibilities, is a small entity within the Office of the HHS secretary and has a budget under $60 million, a mere speck three orders of magnitude (a thousand times) lower than the NIH, CDC, and FDA budgets and six orders of magnitude (a million times) below the CMS budget.²⁴⁶

Upholding patients’ privacy rights–including HIPAA compliance–is a condition for health care providers to participate in the Medicare program.²⁴⁷ Yet ‘most hospitals are willing to admit they are not fully compliant with HIPAA regulations’.²⁴⁸ Their ‘periodic non-compliance is anticipated and built into the administration of many federal programs’ and usually addressed through escalating administrative remedies aimed at improving compliance, instead of refusing payments or terminating program participation.²⁴⁹ HHS ‘officials are primarily motivated by the desire to make Medicare benefits available, and they are subject to political pressure to keep facilities open if at all possible’ and ‘are very reluctant to take formal enforcement actions, especially to the extent of terminating a facility’ which could leave vulnerable patients without access to health care.²⁵⁰

Other HHS divisions, such as CDC and FDA, are heavy users of real-world health data, and enforcing HIPAA’s de-identification standard could make care providers less willing to share data to support agency activities.²⁵¹ For NIH, rigorous enforcement of HIPAA’s de-identification standard could increase the costs of its funded research and data-sharing policies.²⁵² Prior to 2021, NIH’s genomic data-sharing policy ‘required’ safe harbor de-identification instead of the more rigorous expert determination method.²⁵³ Meeting HIPAA’s ‘no reasonable basis to believe’ de-identification standard makes data-sharing policies cost more, for example, by making data available in secure data enclaves instead of letting users download the data, or by requiring well-enforced access and use restrictions and technical privacy safeguards.²⁵⁴ ‘Research budgets are tight, and funders prefer spending scarce funds on science rather than privacy’.²⁵⁵

OCR reports to the Secretary of HHS, who manages 13 operating divisions with an aggregate budget of $1.8 trillion.²⁵⁶ A small, sectoral regulator like OCR has limited leverage to press privacy policies that might terminate Medicare eligibility of HIPAA-non-compliant hospitals, thwart needed data access by data-intensive agencies like CDC and FDA, and strain the data-sharing policies and research budget of NIH. The privacy regulator appointed to protect a disempowered public is itself disempowered. Noncompliance ‘can become the norm, as both providers and program administrators recognize that legislative standards are simply aspirational or cannot be accomplished for the amounts the government is willing to pay’.²⁵⁷

In 2000, HHS transferred the Office for Human Research Protections, which oversees Common Rule protections for human subjects in NIH-funded research, away from the NIH and placed it within the Office of the HHS Secretary, reporting to the Assistant Secretary for Health.²⁵⁸ The National Bioethics Advisory Commission (NBAC) immediately expressed concern that ‘this degree of separation may still be insufficient, because NIH is part of []HHS, and the new office is still regulating an organization on which it relies for budgetary and other support’.²⁵⁹ NBAC recommended establishing an independent federal office to oversee research protections.²⁶⁰ The same reasoning applies with equal force to OCR’s oversight of the HIPAA Privacy Rule. NBAC’s recommendation was not followed.

Privacy competes with other important social values, requiring trade-offs between privacy and other social goods. A strength of sectoral privacy enforcement agencies is their close familiarity with the competing values that might be lost under a regime of strict privacy enforcement. That also is their weakness: knowing what privacy will cost, they may trade it away. Independent enforcement–whether by the US DOJ, the Federal Trade Commission, or by citizens exercising private rights of action–might (and sometimes does) strike a different balance,²⁶¹ giving privacy greater weight.

This article refrains from stating an opinion as to whether medical privacy is a good idea or should be abandoned in pursuit of the scientific benefits open medical data can offer. That is a determination best left to legislatures. The conclusion here is simpler: current regulatory and industry practice is out of alignment with the requirements of federal medical privacy law. HIPAA’s statutory and regulatory de-identification standard is not being enforced by the sectoral privacy regulator responsible for enforcing it, and non-compliance with this standard is pervasive in the health care industry. Open sharing of identifiable medical information is quite real, but the idea that law allows it is only a mirage.

IV. LAWS AFFECTING FUTURE MEDICAL DATA SHARING

When an industry is out of compliance with federal law, one way to address the problem is to water down the law. Data privacy legislation proposed in 2024 would have done just this.²⁶² The APRA proposed the world-standard ‘reasonable basis to believe’ de-identification standard for all but one type of personal information.²⁶³ Notably, the one exception was medical data: the APRA proposed to treat ‘health information subject to the HIPAA regulations’ as de-identified if it ‘has been de-identified in accordance with section 164.514(b) of title 45, Code of Federal Regulations’.²⁶⁴ To the trained eye, this looked like a sneaky attempt to replace HIPAA’s ‘reasonable basis’ de-identification standard [which is at Section 164.154(a)] with the Section 164.514(b) implementation specifications that apply a weaker ‘actual knowledge’ standard to data de-identified using the safe harbor method. The APRA thus singled out medical data to receive weaker de-identification than all other types of personal information.²⁶⁵ Had it been enacted, it would have aligned federal law more closely with HHS/OCR’s 2012 general policy of not enforcing HIPAA’s rigorous de-identification requirements.²⁶⁶

Few privacy scholars seemed to notice that the APRA would weaken HIPAA’s standard, and those who noticed did not rush to write articles calling it out. The specific details of data privacy law cease to matter, if the regulator responsible for enforcing the law has announced a general policy of not enforcing crucial legal standards and there is no private right of action letting members of the public petition courts to enforce them. The history of HIPAA de-identification calls to mind the question, roughly attributed to Bishop Berkeley: ‘If a tree falls in the forest and nobody is around to hear it, does it make a sound?’²⁶⁷ Analogously, if the HIPAA statute is violated and nobody is around to enforce it, are there any legal consequences? Since the 2012 Guidance, medical privacy has seemed more of a philosophical than a legal matter.²⁶⁸

This may be about to change. Section IV argues that, going forward, data privacy is best framed as a financial matter. Measures to protect privacy and data security cost money that, to date, proponents of scientific data sharing have been unwilling to spend.²⁶⁹ Recent regulatory changes will increase the cost of data-sharing activities.²⁷⁰ The financial arrangements data repositories enter to help defray these costs can carry serious legal consequences unless carefully designed.²⁷¹ The central privacy challenge will be to find lawful ways to cover the cost of durable privacy protections that last as long as the data are shared. Data privacy law will, in many respects, become the law of how much privacy data stewards can lawfully finance.

The notion that medical data can be de-identified and then openly shared gained traction and survives today because it offers a very low-cost approach to scientific data sharing. It resembles the ‘trap, neuter or spay, and return’ (TNR) animal control programs that desex stray cats before releasing them back to the wild.²⁷² TNR programs achieve a social benefit (reducing the feral cat population) while simultaneously avoiding the large, ongoing costs of caring for, housing, and feeding the cats and the unpleasantness of killing them.²⁷³ Open release of safe harbor de-identified data avoided the ongoing costs of protecting privacy through controlled sharing arrangements and the unpleasantness of ‘killing’ the data (ie destroying the data or refusing to permit secondary uses).²⁷⁴ It was a second-best solution that ‘performed’ an apparent concern for privacy at a rock-bottom cost while letting medical data run free and live out all nine lives of their future scientific utility.²⁷⁵ This section explains why open sharing of medical data is giving way to controlled data sharing and explores why this shift creates fresh legal issues.

IV.A. The End of Open Medical Data

Open sharing of medical data appears increasingly untenable, and this is true no matter how rigorously the data have been de-identified. The death knell of open medical data was the DOJ’s new DSP regulations,²⁷⁶ which apply ‘regardless of whether the data are anonymized, pseudonymized, de-identified, or encrypted’.²⁷⁷ The DSP is not a 1970s-style ethics or privacy regulation to protect the rights of individual data subjects. Instead, it is a national security regulation to prevent group harm.²⁷⁸ President Biden justified the need for the DSP by noting that large samples of medical and other sensitive personal data—even when de-identified—have nefarious uses that can harm not just individuals but national security.²⁷⁹ This concern has bipartisan support, and the Trump Administration announced plans to enforce the DSP regulations.²⁸⁰ Whether individuals consent to let their data be shared has no bearing on permissible sharing under the DSP.²⁸¹ ‘By analogy, obtaining a patent owner’s informed consent to share nuclear secrets with an enemy nation might make the sharing ethical but does not make it legal’.²⁸²

The DSP regulations restrict certain transactions granting access to ‘bulk U.S. sensitive personal data’.²⁸³ The thresholds for “bulk” data are met if a dataset includes 100 people’s genomic data, 1000 people’s other ‘omics data (eg proteomic or metabolomic data) or biometric identifiers, or 10,000 people’s health data.²⁸⁴ Biometric identifiers are defined in a way that includes ‘facial images, voice prints and patterns, retina and iris scans’.²⁸⁵ Scientists regularly produce these types of data under federal research grants, subject to data-sharing policies that require open or controlled sharing of data in these “bulk” quantities.

The DSP regulations restrict ‘covered data transactions’²⁸⁶ allowing access to such data by ‘countries of concern’²⁸⁷ and ‘covered persons’²⁸⁸ with ties to those countries. The DOJ and US Department of Commerce supply a list of the countries of concern but leave it largely up to data stewards to perform their own due diligence to make sure they are not making prohibited data transfers to covered persons.²⁸⁹ The DSP defines ‘access’ in a way that includes most or all of the common methods for sharing scientific data: it means ‘logical or physical access, including the ability to obtain, read, copy, decrypt, edit, divert, release, affect, alter the state of, or otherwise view or receive, in any form, including through information systems, information technology systems, cloud-computing platforms, networks, security systems, equipment, or software’.²⁹⁰

The DSP regulations have a ‘grandfather’ provision for data already shared in open-access repositories in the past.²⁹¹ Such data can continue to be shared—‘presumably, all the world’s nefarious actors already have those data’.²⁹² However, open sharing may not always be feasible for ‘new’ genomic, biometric, and medical data that were not already open ‘at the time of the transaction’ that first proposes to share them.²⁹³ Those wishing to share new data would need to track which elements of their data sets are grandfathered and which are new, who is accessing the new data and in what quantities, and the dates of access, since bulk thresholds can be exceeded through a series of transactions ‘at any point in the preceding 12 months’ between the same US person and the same covered person.²⁹⁴ When this level of ongoing oversight is required, access no longer meets the definition of ‘open data’ and, in effect, is ‘controlled access’.²⁹⁵

Data stewards may also need to monitor the purposes for which data are being shared. The DSP contains an exemption for ‘official business of the U.S. government’ allowing federal grantees to share data with countries of concern and covered persons.²⁹⁶ Sharing is permissible, however, only ‘to the extent that’ the grant expressly directs, authorizes, or funds the otherwise-prohibited data-sharing transaction.²⁹⁷ Covered persons, such as foreign laboratories or researchers, can receive data if their work is funded as part of a federal grant ‘but would be prohibited if they were not part of the federally funded research’.²⁹⁸ Sharing of data with covered persons would not be permissible for secondary uses outside the grant’s scope of work.

The regulations indicate that sharing is permissible if a grant expressly directs US researchers to share their data ‘via an internet-accessible database open to public health researchers with valid long-in credentials … including covered persons primarily resident in a country of concern’.²⁹⁹ However, the sharing must comply with any restrictions ‘required by the Federal grantmaker’.³⁰⁰ This would not necessarily imply lighter restrictions: on April 2, 2025, the NIH took steps to align its own genomic data-sharing policies with the DSP.³⁰¹ To be exempt from the DSP under the ‘official business’ exception, the federal grant must direct or authorize the data sharing or fund the work of the laboratories in countries of concern or covered persons who will receive the data. Otherwise, the sharing is ‘not within the scope of the Federal grant’ and not exempt from the DSP.³⁰²

Controlled data sharing requires sustainable funding to cover the costs of staffing and oversight to ensure regulatory compliance for as long as the data are shared. Once a federal grant expires, usually after four or five years, these funds may need to come from private-sector sources, for example, by charging database users a fee for data access. The DSP regulations provide an example in which a federal research grant covers only part of the costs of ‘creation and publication of the database’ so that the data steward ‘obtains funds from private institutions and donors to fund the remaining costs’ and requires users to ‘pay a small annual fee to access the database’.³⁰³ The DSP regulations discussed how these funding arrangements affect application of the DSP but did not explore whether they might also implicate other federal laws, such as the ones discussed below.

IV.B. Laws Regulating the Receipt of Remuneration for Data Access

Routine transactions to finance a controlled access data repository (such as charging user fees or receiving discounts on cloud storage from an IT service provider) can run afoul of the HITECH Act’s data sales prohibition³⁰⁴ and possibly implicate HIPAA’s criminal provisions,³⁰⁵ unless the transactions are carefully crafted.

IV.B.1. The HITECH Act’s prohibition on data sales

The HITECH Act states that ‘a covered entity or business associate shall not directly or indirectly receive remuneration in exchange for any protected health information about an individual’ unless the individual authorizes the sale.³⁰⁶ For this purpose, ‘remuneration’ includes not just money but in-kind payments such as free or discounted goods and services.³⁰⁷ A ‘sale’ of data does not require transfer of ownership and includes ‘disclosures in exchange for remuneration including those that are the result of access, license, or lease agreements’.³⁰⁸ If data are de-identified, they are not PHI, and the HITECH Act’s sales prohibition does not apply.³⁰⁹

In the past, data repositories that receive remuneration for data access may have assumed that the HITECH Act’s data sale prohibition is irrelevant, once data have been de-identified using HIPAA’s safe harbor method. Yet, as Section III explained, such data are still identifiable as far as the HIPAA statute is concerned, if there is a reasonable basis to believe the data can be re-identified. When this is the case, data de-identified using the safe harbor method remain subject to the HITECH Act’s data sales prohibition, unless additional steps are taken to manage re-identification risk. The fact that there have been few legal consequences to date simply reflects the fact that the same regulator—HHS/OCR—that is failing to enforce HIPAA’s de-identification standard is also responsible for enforcing the HITECH Act’s data sale prohibition.³¹⁰ Data repositories might face legal risks, however, if exchanging weakly de-identified data for fees or other remuneration triggers liability under other laws enforced by more diligent regulators.³¹¹

A common type of data sale involves disclosing data to a technology company in return for free or discounted software or IT services, as exemplified in the Dinerstein case.³¹² This case shows how hard it is to enforce the HITECH Act through private lawsuits. Mr Dinerstein sued over a research collaboration in which a university medical center transferred patients’ electronic health records (EHRs) to Google, Inc. in the form of a ‘limited data set’ including treatment dates, so his data were not ‘de-identified’ even under HIPAA’s lax safe harbor method.³¹³ The data use agreement governing the transfer granted the university a non-exclusive license to use the software Google would develop using the data.³¹⁴ In effect, the medical center swapped patients’ identifiable data in return for free or discounted use of a software tool, described as a machine-learning predictive health model to reduce hospital readmissions and predict future medical events.³¹⁵

The lower court felt Mr Dinerstein was ‘on firm ground’ in claiming his data had been sold.³¹⁶ The software license was ‘remuneration’ and did not fit into any of the Privacy Rule’s allowed exceptions.³¹⁷ The Court of Appeals for the 7th Circuit, while affirming the lower court’s dismissal for lack of standing, did not dispute its conclusion that the university had sold Mr Dinerstein’s data.³¹⁸ Plaintiffs have no private right of action under HIPAA, and Mr Dinerstein lacked standing to bring the state-law causes of action he tried to use instead, which left him without recourse.

If HHS/OCR will not enforce HIPAA’s de-identification standard and patients cannot obtain judicial review, there is another pathway. Section 13410(e) of the HITECH Act empowers state attorneys general to bring civil actions in federal court on behalf of state residents to obtain damages for, or to enjoin, violations of the HIPAA Privacy and Security Rules. Any state has the power to seek judicial review of three questions that have, since 2012, eluded judicial review: (i) Does safe harbor de-identification meet HIPAA’s statutory de-identification standard? (ii) Is OCR’s 2012 Guidance consistent with the HIPAA statute and HIPAA Privacy Rule? (iii) Is the unauthorized sale of data de-identified using the safe harbor method an unlawful sale of PHI under the HITECH Act?

Even without a court challenge, it is increasingly hard to pretend that any de-identification strategy (whether safe harbor or something else) can be applied at a single moment in time and, thereafter, medical data can be openly shared without risks to patient privacy. Under the NIH’s current data-sharing policies, one of the major justifications for using a controlled access repository is if there are doubts about whether the data are actually de-identified.³¹⁹ Often, the data in a controlled access repository are potentially re-identifiable; otherwise, they would not be there. Once there is a reasonable basis to believe re-identification could occur, the data are PHI, and the HITECH Act’s sale prohibition comes into play and regulates receipt of remuneration. Just when a controlled access repository is most needed, the HITECH Act makes it difficult to finance.

IV.B.2. HIPAA criminal violations

Fees and discounts that raise questions under the HITECH Act also, under certain circumstances, might implicate HIPAA’s criminal provisions. The HIPAA statute added Section 1177 to the Social Security Act, allowing criminal prosecution of ‘a person’ who knowingly and in violation of the law ‘uses or causes to be used a unique health identifier’, ‘obtains individually identifiable health information relating to an individual’, or ‘discloses individually identifiable health information to another person’ without individual authorization.³²⁰ The HITECH Act clarified that this reference to ‘a person’ refers not just to personnel of HIPAA-covered entities but to any individual who commits the prohibited acts—such as a software developer obtaining PHI.³²¹ Penalties start at $50,000, 1 year’s imprisonment, or both, but can range up to $250,000, 10 years, or both ‘if the offense is committed with intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm’.³²²

In a 2012 case involving a terminated employee who subsequently accessed hospital records, a federal appeals court interpreted the ‘knowingly and in violation of this part’ language of 42 U.S.C. § 1320d-6 as requiring two things: (i) the person knowingly obtained the records and (ii) doing so violated HIPAA.³²³ It is not necessary that the person actually knows they are violating HIPAA, as long as they know they are obtaining the records. This case should concern parties that obtain or disclose inadequately de-identified data. Such data are still ‘individually identifiable health information’ if there is a reasonable basis to believe the data can be re-identified. If a party knowingly obtains or discloses the data and doing so violates HIPAA, that seemingly meets the scienter for a criminal violation. The fact that the party mistakenly believed the data were properly de-identified might not provide a defense.

Collaborations like the one seen in Dinerstein are increasingly common because modern medical software—both for health care operations and for research—marshals data at a vast scale that often requires academic organizations and hospitals to contract for cloud storage and other IT services supplied by commercial technology companies.³²⁴ Many researchers also contract for commercial storage and IT services to help implement federal funders’ data-sharing policies.³²⁵ HIPAA allows the commercial technology partners to keep, reshare, and reuse de-identified data without individual authorization/consent.³²⁶ The research institution/hospital could, of course, require a data use agreement that limits downstream resharing and reuse of the data contractually, but doing so might cause commercial IT providers to charge more for the services. Weak de-identification practices are pervasive in the health care industry.³²⁷ As a result, patients’ PHI is routinely exchanged for discounts and other forms of remuneration, often without the HITECH Act’s required individual authorization for data sales.³²⁸

The HITECH Act calls for patients whose PHI is being sold to sign an authorization under § 164.508 of the Privacy Rule ‘that includes, in accordance with such section, a specification’ of whether the PHI can be further sold by the party receiving it.³²⁹ In other words, patients should be informed not only of whether their health care provider or research investigator is selling their data but also whether the buyer will be able to resell it. In the HIPAA Privacy Rule, HHS interpreted this statute as requiring only that patients be told whether the covered entity selling their data will receive remuneration but not whether the buyer will be able to resell it.³³⁰ HHS’s logic for this change was not persuasive.³³¹ Because the regulation potentially requires less disclosure to patients than the HITECH Act requires, sales of patients’ PHI may not be properly authorized even if an authorization for sale was obtained under the Privacy Rule. Moreover, when data are shared or sold under false assurances that the data are de-identified, there often is no authorization in place at all (or, if there is an authorization, it might be invalid for misrepresenting that safe harbor de-identification complies with HIPAA’s de-identification standard).

Despite all this, institutions that make unauthorized sales of weakly de-identified data face only a remote risk of facing criminal prosecution under HIPAA. The DOJ, which enforces HIPAA’s criminal provisions, is not bound by HHS’s lax interpretation of HIPAA’s de-identification standard and might be less likely than OCR has been to subordinate privacy to other HHS programmatic goals.³³² However, DOJ enforces HIPAA based on referrals from HHS/OCR.³³³ With OCR complicit in the fiction that safe harbor de-identified data are non-PHI, criminal referrals for improper data sales seem unlikely. In coming years, the DOJ will routinely scrutinize medical data sharing for compliance with its own DSP regulations. However, those regulations do not distinguish whether data are de-identified or identifiable because they apply in either case. Thus, it is not clear that the DOJ will focus its scrutiny on lax de-identification practices.

Action by state attorneys general may offer the best hope for enforcing the HITECH Act’s data sales prohibition. The states’ enforcement authority is civil in nature, so enforcement of HIPAA’s criminal provisions is beyond their scope. For this reason, civil actions to enforce the HITECH Act thus seem the most promising pathway to seek judicial clarification of what forms of remuneration a controlled access repository can receive in exchange for data access.

IV.C. Laws Regulating Payment of Remuneration by Academic Medical Centers That Share Data

When academic medical centers exchange patients’ and research subjects’ data for discounts on software and other IT services, remuneration is actually flowing in both directions. Medical data are a valuable commercial asset, so hospitals that share data are paying in-kind remuneration—in the form of data—to the software developer or IT service provider. Payments of remuneration by health care providers (or researchers employed by them) can trigger problems under various federal laws, including tax laws and laws addressing fraud in federal health care programs such as Medicare and Medicaid.³³⁴

Depending on what the health care provider receives in return for making an in-kind ‘payment’ of data to a software developer, the payment might potentially violate the FCA³³⁵ and AKS.³³⁶ The FCA is of special concern because it contains qui tam provisions, giving members of the public a private right of action to seek judicial review of questionable transactions involving health care providers.³³⁷ The FCA is thus a potential pathway for patients whose health data are improperly shared or sold to seek judicial review of academic medical centers’ data-sharing practices.

Roughly 20 years ago, Joshua Collins explored using the FCA as a tool to punish privacy violations by health care providers.³³⁸ The FCA is a civil statute to deter fraud by parties billing the government for goods or services, and, in 2023, health care fraud accounted for ‘almost 70% or $1.8 billion of the $2.68 billion of fraud recoveries by the Department of Justice’.³³⁹ Under the ‘implied false certification’ theory, health care providers who submit bills to Medicare or Medicaid implicitly certify that they have complied with all statutes, regulations, and contractual requirements to receive payments, and they can face FCA liability if they knowingly fail to disclose noncompliance.³⁴⁰ Writing in 2007—before the Supreme Court decided the 2016 case, Universal Health Services v. U.S. ex rel. Escobar (‘Escobar’)³⁴¹—Collins concluded that it ‘seems quite possible’ that patients could bring qui tam actions under this theory to enforce Privacy Rule violations.³⁴²

Escobar, unfortunately, complicates this privacy enforcement pathway. The Court confirmed that the FCA is not ‘a vehicle for punishing garden-variety breaches of contract or regulatory violations’.³⁴³ FCA liability attaches only if the undisclosed violation is ‘material’ to the government’s decision whether to pay the bill, and simple regulatory violations (such as non-compliance with HIPAA’s de-identification standard) seemingly would not meet that ‘demanding’ standard.³⁴⁴

Nevertheless, certain abusive practices that flow from violations of HIPAA’s de-identification standard might rise to the level of materiality that supports FCA liability. For example, swaps of patient data for discounted software might, in some circumstances, violate the AKS prohibition on kickbacks.³⁴⁵ In 2010, Congress clarified that claims for items or services ‘resulting from’ an AKS violation also violate the FCA.³⁴⁶ The AKS prohibits ‘knowing and willful payment of “remuneration” to induce or reward patient referrals or the generation of business involving any item or service payable by the Federal health care programs (e.g., drugs, supplies, or health care services for Medicare or Medicaid patients)’.³⁴⁷ Under the AKS, remuneration ‘includes anything of value and can take many forms besides cash’ such as a hospital that gives a software developer past patients’ data in order to ‘pay’ for future patient referrals.³⁴⁸

Suppose a provider pays a software developer with past patients’ data and, in return, receives free or discounted access to a clinical decision support (CDS) software tool, which is a type of software that recommends care plans for patients currently receiving health care.³⁴⁹ If those recommendations include any items or services payable by Medicare or Medicaid, the software developer arguably is making referrals that the hospital paid for—potentially an AKS violation if scienter can be shown.³⁵⁰ An antikickback violation renders a subsequent Medicare claim ‘false’, even if the services were medically necessary and properly performed.³⁵¹

In U.S. v. Jain, an AKS violation occurred when a hospital paid for referrals, even though the patients truly needed to be hospitalized, the hospital to which they were referred was as good as competing facilities, the patients were not harmed, and the government seemingly would have had to pay the same amount to hospitalize them somewhere else if they had not received treatment at the facility paying kickbacks.³⁵² Even if a CDS tool recommends patient care that is necessary and competently provided, there is still a potential kickback problem if the hospital made a side payment of past patients’ data to induce the software developer to give the hospital the tool that makes future referrals for Medicare-billable services.

To date, there is no AKS safe harbor defining permissible swaps of patients’ data for CDS tools that recommend treatment plans for future patients, nor are there any Advisory Opinions exploring such swaps.³⁵³ One easy step to clarify whether such swaps are problematic would be to request an Advisory Opinion: if a hospital swaps past patients’ data for software that steers future Medicare/Medicaid patients to seek more care from that same hospital, does that violate the AKS? If it does, then a large swathe of the health care industry will need to revisit current data-sharing policies in order to avoid potentially draconian AKS and FCA liability.³⁵⁴

Other AKS concerns can arise when health care providers receive discounts on software and other IT services that will be used in the course of providing Medicare-billable clinical health care. By analogy, discounted or free samples of pharmaceutical products can create kickback problems, unless the discounts fit into AKS safe harbors and any discounts are reported and passed along to the Medicare program.³⁵⁵ For medical software, efforts are underway to obtain billing codes that would make it possible to bill Medicare and insurers for the use of software in patient care.³⁵⁶ If these efforts come to fruition, the practice of offering software discounts in return for patients’ data could raise novel AKS problems, unless there is careful accounting for the discounts and compliance with a yet-to-be-developed AKS safe harbor. Patients whose data are swapped for software discounts might be able to draw unwanted scrutiny to these transactions, for which no clear legal framework is yet in place.

The financial penalties for violating the FCA and AKS are potentially profound, rising into the hundreds of millions of dollars in some cases.³⁵⁷ One or two qui tam suits might be all it takes to send a message to HIPAA-regulated academic medical centers and data repositories: unlawful sales of PHI can have serious legal consequences, even if lax privacy regulators look the other way. The qui tam provisions of the FCA would let patients (or disgruntled health care workers or tech company employees who become aware of questionable data sharing or acquisition practices) bypass lax regulators and place their concerns directly before a federal court and enrich themselves with a share of the recoveries in successful suits.³⁵⁸ The courts in Dinerstein seemed receptive to the plaintiff’s claim that unlawful data sales were occurring but could not find standing to let the case advance. The FCA’s qui tam provisions solve that problem. Ideally, proceeds from early qui tam suits in the HIPAA-regulated sector could be reinvested in future efforts to organize and empower data subjects in other sectors of the data economy where privacy is routinely abused.

IV.D. The Law of Financing a Controlled Access Repository

Controlled data sharing helps address privacy concerns in an age when open sharing of medical data is becoming socially and legally untenable. Unfortunately, federal grant funders that promote scientific data sharing may not be able to cover the long-term costs of controlled access data repositories. There are, however, a limited number of legal pathways for collecting fees for data access without running afoul of the HITECH Act’s data sale prohibition.

IV.D.1. HITECH Act exceptions

The HITECH Act contains several exceptions allowing PHI to be exchanged for remuneration without the transaction counting as a prohibited data sale. Several of these exceptions offer potential building blocks for financial sustainability plans for controlled access repositories. HITECH Act-compliant fee structures offer ways to preserve many of the scientific benefits of data sharing while funding the costs of providing strong privacy, ethical, and data security protections for as long as the data are shared.

• Sharing data with public health agencies. Disclosing of PHI or limited data sets for public health activities is not a data sale, regardless of the remuneration received.³⁵⁹ Federal public health authorities (such as the FDA and CDC) and state public health agencies are allowed to pay for data access without the data transfer being deemed a ‘sale’.³⁶⁰ In making this exception to the HITECH prohibition on data sales, Congress appears to have placed priority on making sure these agencies could obtain data they need to protect the public’s health, under the assumption that market-based fees for data access can help ensure data availability.³⁶¹ Use of data by the FDA for testing, validation, and post-marketing safety surveillance of medical software tools is unquestionably a public health use of data that would be eligible for market-based access fees under this HITECH Act exception.

• Sharing data for research use. Disclosing PHI or limited data sets for research that receives IRB/Privacy Board oversight is permissible if ‘the only remuneration is a reasonable, cost-based fee to cover the cost to prepare and transmit’ the information.³⁶² When amending the HIPAA Privacy Rule to incorporate the HITECH Act in 2013, HHS clarified what can be included in a ‘reasonable cost-based fee’.³⁶³ The fee structure allows fairly broad cost recovery, including ‘both indirect and direct costs, including labor, materials, and supplies for generating, storing, retrieving, and transmitting the protected health information; labor and supplies to ensure the protected health information is disclosed in a permissible manner [i.e., IRB, legal, regulatory compliance costs, and the costs of operating a controlled access governance framework to protect data subjects’ privacy]; as well as related capital and overhead costs [i.e., expenses and capital cost of investments in information systems, overhead costs of personnel to operate the systems, etc.]’.³⁶⁴

• Sharing data for use in clinical care. Disclosing PHI for treatment and payment purposes subject to § 164.506(a) of the Privacy Rule is permissible, regardless of the remuneration received.³⁶⁵ If the use of data to train a CDS tool for use in future clinical care counts as a treatment use of data, then the HITECH Act allows data to be shared with no restrictions on remuneration.³⁶⁶ The HIPAA Privacy Rule also allows such transfers to be made without individual authorization, even if the data will be used to treat a third party who is unrelated to the person whose data are shared, but the data recipient must be a health care professional.³⁶⁷ What counts as a ‘treatment’ use of data is a question of state law and, to date, states have not clarified whether using data to train a CDS tool qualifies as a treatment use of data.³⁶⁸ State legislation deeming this use to count as a treatment use of data would open up lawful pathways for charging fees for data access by software developers for the purpose of training CDS tools and other artificial intelligence and machine learning systems intended for clinical use.

The above exceptions allow repositories to receive remuneration when supplying data for several important secondary uses. The HITECH Act also allows additional exceptions to be added in the future through state or federal legislation or HHS rulemaking:

• Legislative approval of data sharing and fee structures. Legislatures can approve additional types of remunerated disclosures and establish permissible levels of remuneration.³⁶⁹ Seeking state legislation governing controlled access data repositories offers a way to create workable financing structures that the HITECH Act’s data sale prohibition, as implemented in the HIPAA Privacy Rule, would then accept as lawful.³⁷⁰

• Data sharing approved by rulemaking, subject to reasonable, cost-based fees. The Secretary of HHS, through rulemaking, can amend the HIPAA Privacy Rule to create new exceptions to the HITECH Act’s data sale prohibition, provided the ‘only remuneration is a reasonable, cost-based fee to cover the cost to prepare and transmit the PHI for such purpose’ or a fee ‘expressly permitted by other law’.³⁷¹

IV.D.2. Mobilizing new business structures for financing controlled access repositories

An additional loophole might let controlled-access repositories mobilize private-sector funding through a non-profit foundation that provides grants to support data-sharing operations. In the preamble to the 2013 HIPAA/HITECH final rule, HHS clarified the status of grants:

We do not consider sale of protected information … to encompass payments a covered entity may receive in the form of grants, or contracts, or other arrangements to perform programs or activities, such as a research study, because the provision of protected health information to the payer is a byproduct of the service being provided. Thus, the payment by a research sponsor to a covered entity is not considered a sale of protected health information even if research results that may include protected health information are disclosed to the sponsor in the course of the study. Further, the receipt of a grant or funding from a sponsor is not a sale of protected health information, even if, as a condition of receiving the funding, the covered entity is required to report protected health information to the agency for program oversight or other purposes.³⁷²

This clarification may have been directed at federal research grants but its wording also covers private grants. It confirms that data can be disclosed ‘to a grant sponsor’ (eg to the NIH or a private funder) without the grant being treated as remuneration for the sale of data. The grantor could itself use the data for ‘other purposes’, which could include setting up a grantor-operated data repository that allows access by third parties. It is not clear, however, that a grantor could order the grantee to share data ‘directly with third parties’ as a condition of the grant. In that situation, the grant seemingly would constitute remuneration paid indirectly on behalf of the third-party data recipients. The HITECH Act prohibits HIPAA-covered academic medical centers from ‘directly or indirectly receiv[ing] remuneration in exchange’ for HIPAA-protected data.³⁷³

Despite this limitation, this grant exception suggests a workable financing model in which a 501(c)(3) non-profit foundation collects user fees from parties wishing to access data held in one or more controlled access data repositories. This non-profit foundation could apply the fees to fund private grants to support ongoing repository operations, for example, grants to fund the costs of providing strong privacy protections for data the repositories hold. Obviously, this approach requires careful navigation of non-profit taxation rules. The foundation’s aims would need to be defined broadly enough to avoid ‘inurement’, which exists if a non-profit organization directs its funds to a few specific individuals or entities.³⁷⁴ The non-profit foundation cannot simply be a pass-through for channeling remuneration back to the participating data repositories.

In addition to supporting the ongoing operation and improvement of the controlled access data repositories, the non-profit foundation would need to support a broad array of additional scientific activities. Examples of such activities might include: (i) providing data access scholarships to support research by citizen scientists, students, and others who cannot afford user fees to access data held in controlled access data repositories; (ii) offering training programs for persons wishing to learn how to conduct database research in an ethical, scientifically valid manner; (iii) funding grants to support work by additional researchers to make their own data sets interoperable with the repositories’ existing data, to expand and improve shareable scientific data resources over time; (iv) supporting development of new research tools and software to allow better use of the controlled access data resources; or (v) funding scientific and data privacy research more generally.

V. CONCLUSION

Open sharing of weakly de-identified medical data was always legally dubious, and recent regulations and the relentless advance of re-identification technologies amplify these doubts. Open sharing of medical data is a dying concept, if not already dead.

Easy access to weakly de-identified medical data has fueled progress in medical analytics and artificial intelligence tools that might enhance the quality and lower the cost of US health care (someday). These hoped-for benefits could be lost as the legal environment for medical data sharing grows more challenging.

The future of medical data sharing lies with controlled access, which replicates many of the benefits of scientific data sharing while ensuring enhanced privacy protection for people whose medical information is shared. The drawback is that meaningful privacy protections cost money, requiring controlled access data repositories to develop financial sustainability plans.

Existing exceptions to the HITECH Act’s data sales prohibition offer several pathways to collect data access fees to help fund controlled sharing arrangements. Legislation or rulemaking to create further exceptions with approved private funding mechanisms may prove critical to the future viability of controlled access repositories. New organizational structures in the form of nonprofit grant-making organizations might also play a role in financing scientific data sharing. These approaches avoid problems under the HITECH Act’s data sales provisions but do not address the remaining risk that academic medical centers sharing medical data might inadvertently violate the FCA and AKB statutes.

Because medical data are a commercially valuable asset, academic medical centers that share data are making in-kind payments of remuneration to the data recipients. Hospitals and clinics must avoid transactions in which the data recipients—or software tools that data recipients supply—refer patients for care at the facilities that provided the data. Such transactions could amount to kickbacks in which past patients’ data are swapped for referrals of future patients. Academic medical centers urgently need to direct their fraud compliance programs to scrutinize transactions with software companies to which they supply patient medical data, seeking Advisory Opinions as necessary to clarify what is permissible.

Medical privacy law needs to snap out of its longstanding fantasies that abuse is okay if people consent to it, and de-identified data pose no privacy harms. Privacy requires hard work on the part of all who share and benefit from the sharing of our data, and work costs money. The law of medical privacy boils down to how much privacy can be realistically, lawfully financed.

Funding

This research received funding under the NIH Bridge2AI Patient-Focused CHoRUS for Clinical Care AI (NIH Office of the Director, OT2OD0327, Eric S. Rosenthal & Azra Bihorac, PIs). Views expressed are the author's own and do not reflect views of funders or research collaborators.