Patient-governed agentic health data exchange

Abstract

Health data exchange remains constrained by fragmentation, consent burden, limited auditability, and weak incentives. We propose STARFISH, a patient-governed agentic framework where personal health agents manage granular permissions, while institutional research agents request data or execute privacy-preserving analyses. Cryptographically verifiable mandates, automated compliance, and optional benefit sharing align incentives while preserving autonomy. Agentic workflows could accelerate trials and safety surveillance, enabling trustworthy, scalable, and participatory digital health research ecosystems.

Introduction

In the past, artificial intelligence (AI) systems were largely reactive and task-oriented, solving isolated problems and requiring a human to validate and plan their actions^1,2. In healthcare, reactive AI systems have been used for automated decision-making through applications such as disease diagnosis and treatment recommendation^3–5. However, these systems are non-autonomous, lack persistent goals and cannot perform independent multi-step reasoning and planning⁶. AI systems are now transitioning from being mere reactive tools to autonomous, agentic architectures⁷ capable of reasoning, planning, and goal-directed actions. Agentic AI can pursue delegated goals⁸, negotiate resources, and execute transactions across digital environments. The Agent Payments Protocol (AP2)⁹ provides a verifiable language for secure, accountable agent-to-agent¹⁰ economic interactions spanning science, commerce, and governance.

Healthcare is among the fields most likely to be transformed by agentic AI¹¹. Over the past decade, AI has been playing an important role in modern medicine in areas such as abnormality detection, diagnostics, treatment selection, patient care and personalized medicine^12–17. At the same time, the volume of user-generated health data is expanding exponentially as new streams of health-related information emerge from wearables, home sensors, and mobile health apps¹⁸. The availability of such continuously generated longitudinal data could be an enabler for health research that depends on users sharing their data with research institutions. However, such data sharing is subject to patient consent. A global meta-analysis in 2025 estimated 77% of people are willing to share their health data for secondary purposes¹⁹ given adequate privacy and transparency safeguards. Realizing the potential of such agentic healthcare systems will require the development of interoperability standards and protocols that allow agents to communicate and trade safely across systems. For example, agents autonomously discover data partners, negotiate terms, and execute complex healthcare tasks²⁰, supported by the Agent2Agent (A2A) protocol²¹, the Model Context Protocol (MCP)²², and AP2 as interoperability and payment foundations.

The point-to-point health data exchange between institutions and patients is often through Direct Secure Messaging (DSM)²³ which requires manual coordination, consent management and negotiating terms of use^24,25. Such a process is time-intensive, iterative and prone to human error. Even after data exchange, researchers often have to keep the data in sync, standardize heterogeneous data formats and oftentimes such data is not reusable^26,27. Such data sharing is non-auditable, non-incentivized and lacks patient governance^28,29. However, even with advanced health information exchange frameworks such as Trusted Exchange Framework and Common Agreement (TEFCA)^30,31, the current data sharing paradigms have limited patient governance on how and when their data is used and for what purpose³². Can agentic transactions transform the landscape of health data sharing into patient-governed data sharing? The emergence of OpenClaw³³ has made an impressive demonstration of how AI agents could act on behalf of humans and complete complex tasks. What if there is an AI assistant dedicated to health? Envision a future where each individual is equipped with a personal health AI agent, a smart, tireless data assistant that the user fully controls. This agent would aggregate the person’s health information from medical records, wearable devices, genetic tests, and wellness apps into a private, comprehensive longitudinal health record under the user’s ownership.

On the other side, researchers, clinical trial organizers, public health agencies, and pharmaceutical innovators would deploy their own AI agents to seek out relevant data for studies or product development. When a research need arises, for instance, data on heart rates from fitness trackers of patients with a certain condition, the research team’s agent can discover and negotiate with Personal Health Agents (PHAs) holding matching data. In this process, the health data owner enables the AI agent to autonomously manage and facilitate the data sharing procedure. This is achieved through a straightforward setup of the AI agent, thereby offloading the majority of the operational tasks to the agent and decreasing the need for repetitive manual interventions. Envision each individual equipped with a personal health agent for aggregating medical records³⁴, wearable data, and wellness apps into a private, user-controlled longitudinal record secured by encryption and privacy-enhancing technologies³⁵. Simultaneously, researchers and public health agencies deploy their own agents to seek relevant data, negotiate access terms, and initiate privacy-preserving analyses, offloading operational burden while respecting each individual’s predefined sharing preferences.

A key advantage of modern AI agents is their accessibility for users. Unlike traditional health data exchange, which requires patients to manually manage their data and parse legal consent forms, modern AI agents complete complex tasks through natural language interactions. Applied to health data exchange, patients can define a configurable preference setting for data sharing in natural language. Although this initial preference setting would automate much of the process and reduce burden on patients, this setting still remains configurable, which allows agentic data sharing activities to be audited, monitored, revoked, paused or modified by humans. To give humans control over such a configurable process, the agent would be required to get human approval for new or high-risk data usage. Based on the human preference, the agent handles the discovery, negotiation, compliance, and delivery autonomously.

Traditional data sharing systems demand sustained effort and even professional backgrounds from individuals. Beyond placing a substantial burden on users, there are broader structural barriers as well, such as inadequate incentives, limited patient trust and difficulties in complying with privacy regulations. These barriers have contributed to reliance on siloed datasets for health research. Agentic health data exchange, with integrated incentivization, regulatory compliance and trust mechanisms, can offload the technical burden from individuals and streamline the process to make it accessible to the broader community.

Inspired by this paradigm, this Perspective envisions STARFISH, a Secure Transactable Agentic Research Framework for Interoperable Sharing of Health data. STARFISH is designed to address the specific barriers identified in the current health data sharing by enabling patient health exchange to be agent-mediated under explicit, cryptographically enforced consent. Fig. 1 shows the function-level overview of STARFISH. Collectively, these components establish a trusted, programmable infrastructure for agentic data transactions to transform health data sharing into a secure, interoperable, and auditable digital economy.

Fig. 1. ∣ Overview of the STARFISH agentic health data exchange architecture.

Personal health records aggregated from personal EHRs, wellness apps, wearable sensing data, and smart health devices are managed by the Personal Health Agent, which cleans, filters, advertises, negotiates, and delivers data on the individual’s behalf. Research Agents acting for health data consumers, such as clinical trials, public health agencies, health researchers, and pharmaceutical companies, perform discovery, matching, negotiation, contracting, and payment. A payment network settles the agreed compensation between the two agents.

Challenges in current health data sharing

Several interconnected barriers continue to impede broader, privacy-preserving, and incentive-aligned health data exchange.

A first barrier is data silos and limited accessibility. Most health data resides in institutional silos, such as hospital EHRs, laboratory systems, and private registries, creating fragmented data ecosystems³⁶. Beyond institutional records, integrating individual health data from personal wearable devices and health apps into clinical systems presents additional challenges³⁷. Limited interoperability among HL7 FHIR³⁸ and OMOP³⁹ implementations slows multi-institutional studies, and international data exchange is further hampered by storage restrictions, leaving vast amounts of health data underutilized⁴⁰.

A second barrier is misaligned incentives. Financial incentivization is a key driver for health data sharing, yet individuals rarely see direct benefit⁴¹. Following a single direction, the data flow largely goes from patients to researchers or companies, with financial and informational value accruing to institutions. Interview studies confirm that incentives are heavily emphasized by prospective participants but remain under-researched⁴². Aligning incentives equitably so contributors receive commensurate rewards remains a central unsolved challenge.

Fragmentation further burdens both patients and researchers. Individuals often have to manually manage records from multiple sources such as wearable logs, lab results, and clinic visits, in order to share them with researchers or even their own providers^43,44. This tedious and inefficient process is burdensome for patients and may discourage them from sharing their health data⁴⁵. Few tools exist to help people aggregate and donate their diverse health data seamlessly. At the same time, the collection of data from these fragmented patient records burdens researchers, both in technical and administrative ways, since they spend a lot of time querying relevant users, coordinating data transfer and processing the data^37,46,47.

Lack of trust and accountability also suppresses sharing. Once data leaves the patient’s hands, few mechanisms exist to verify its use or enforce promises. The 2025 meta-analysis of patient willingness to share data shows that trust in sharing data with private companies is lowest at about 54%, higher for researchers at around 65% and the highest around 71–72% for hospitals¹⁹. Without robust audit trails and enforceable consent, many patients withhold data or refuse broad sharing.

Compliance with global regulations poses yet another barrier. Health data sharing must navigate a complex patchwork of data protection laws. HIPAA⁴⁸ in the US, GDPR⁴⁹ in Europe, and the emerging European Health Data Space (EHDS)⁵⁰ each impose different requirements on data collection, storage, and transfer, which represents a major barrier to scalable, cross-border data exchange. Ensuring compliance currently requires case-by-case contracts and institutional agreements that do not scale to large, dynamic data networks.

Finally, prior data exchange initiatives offer lessons on implementation barriers. Health Information Exchange (HIE) has existed for decades to enable patient data sharing across different organizations^51–53. HIE has faced barriers in its implementation that provide a suitable foundation for our work. Some barriers as identified in⁵⁴ include privacy concerns for data siloed in organizations, limited patient governance and trust in how and by whom data would be accessed. Another major challenge identified in sharing personal health records (PHRs) is that participants are reluctant where manual effort is required. Other identified issues include inefficient technical workflows and exchanged data failing to meet user needs due to lack of data standards⁵⁵. A study identifies the barriers in HIE implementation in low and middle-income countries as mostly socio-political, financial, organizational such as burden on workers and infrastructure availability issues⁵⁶. Barriers in HIE use in clinical practices include insufficient participation of clinicians, inadequate infrastructure to exchange data, standardizing different data formats and managing patient consent⁵⁷.

STARFISH addresses challenges related to patient governance, trust, accountability and patient incentivization as previously identified and also observed in HIEs. However, partially and fully unresolved challenges such as privacy, infrastructure availability, financial sustainability remain and are further discussed in Section "Limitations and challenges in STARFISH implementation."

The STARFISH agentic data exchange framework

In an agentic data sharing ecosystem, every stakeholder is represented by an autonomous digital agent that communicates, negotiates, and transacts according to predetermined rules and permissions. Those agents are regulated by a series of mandates. In AI agent systems, a mandate is a formally specified instruction set that constrains and authorizes an agent’s actions, defining what the agent may or may not do. A mandate is not a suggestion but a binding operational charter that the agent cannot exceed. STARFISH defines a verifiable, agent-mediated architecture enabling personal health information to be transacted between individual-controlled Personal Health Agents (PHAs) and institutional Research Agents (RAs) under explicit, cryptographically enforced consent.

Participating parties in STARFISH

A PHA is a persistent AI assistant that aggregates health information from multiple sources such as EHR portals, fitness trackers, and smart devices into a composite personal health record. The PHA serves as an intelligent gatekeeper that evaluates incoming data requests, verifies requester credentials, and automatically enforces the user’s predefined sharing preferences, specifying who may access data, for what purpose, under what privacy safeguards, and for what compensation. By handling retrieval, de-identification, aggregation and delivery, PHAs reduce individual burden, consolidate fragmented data into usable health data records and enable safe participation even for users with limited technical skills.

Organizations that require health data deploy RAs configured with eligibility criteria and data requirements, which they broadcast as structured requests. PHAs continuously scan such announcements and respond when criteria match their user’s data profile and sharing preferences. Once connected, PHA and RA negotiate access terms under strict governance, including the data scope, purpose, duration, and compensation. The RA is bound by the agreed digital contract throughout and may either receive agreed-upon raw data or initiate a privacy-preserving analysis, with compliance and contract execution handled autonomously. This automation of participant discovery, negotiation of usage terms and data transfer reduces the burden on researchers.

Key features of STARFISH

STARFISH introduces Consent Mandates, cryptographically signed digital contracts specifying which data may be shared, with whom, for what purpose, for how long, and under what compensation or conditions. Once signed with a user’s private key, a mandate becomes a tamper-proof, machine-enforceable instruction set governing data use. It is analogous to a digital consent form but binding on both parties without manual enforcement. By defining the conditions of data access and usage, Consent Mandates address a key barrier in current data exchange by making the data sharing process more transparent and patient-governed. Signed mandates strengthen patient trust in the process and offer accountability since unauthorized modification or forgery attempt can be detected.

When individual records cannot be shared, STARFISH uses a privacy-preserving mechanism called the Analysis Mandate. The data consumer runs an algorithm within the PHA’s secure environment, returning only results or model parameters. As Fig. 2 shows, a classic instantiation is federated learning⁵⁸, where an RA sends a model to participating PHAs; each PHA trains locally, and only model updates leave the device, enabling research insights without raw data exposure and resolving privacy or regulatory impasses. This addresses a critical concern in sensitive raw data sharing by allowing federated trained model updates or aggregated statistics to be shared instead.

Fig. 2. Analysis Mandate.

PHA and RA can share raw data directly or conduct meta-analysis. Privacy-enhancing techniques such as federated learning protect data privacy. RA may evaluate PHA contributions and distribute incentives at the Model Valuation Layer.

To balance human involvement with automation in the agentic data sharing process, Consent Mandates and Analysis Mandates are paired with ongoing consent and consent withdrawal features. Ongoing consent means that although consent may initially be expressed through configurable preference setting for routine data sharing, these preferences can still be reviewed, audited and modified on human demand. If the agent detects a change in the data usage scope or identifies a high-risk scenario, it must get approval from the human. To make the agentic process transparent and prevent error propagation, agent decisions, reasoning and transactions should be logged for human auditing.

Once the patient has decided to no longer share their data, STARFISH allows them to withdraw consent. The withdrawal of consent from the patient invalidates and cryptographically revokes the mandate. Revocation should prevent new access to data and further processing and provide patients with the evidence of data deletion and access termination. However, revocation has certain challenges which should be explicitly mentioned in the mandate. For consent mandates, the mandate itself can be marked as revoked, but complete data deletion cannot be guaranteed when data was transferred to downstream recipients or a backup copy exists. For analysis mandates, revocation is more practically feasible because patient data never left their device and only learnt model parameters were shared. In such cases, model retraining or machine unlearning^59,60 can be applied to withdraw the knowledge gained from the user data.

Trust is bootstrapped through verifiable identities and credentials issued by recognized authorities. Before any transaction, agents verify that the counterparty is who they claim to be and is authorized for the proposed exchange, which is analogous to a physician’s licence or an institution’s IRB approval in the offline world.

For payment integration, STARFISH supports built-in value exchange to encourage and incentivize participation. Using AP2⁹, a payment instruction is attached to the data sharing mandate, creating an atomic transaction. Data is delivered only when the promised compensation is transferred, directly aligning contributor incentives. This compensation might be traditional currency, cryptocurrency⁶¹, or even non-monetary rewards such as service credits or digital tokens.

For automated compliance and governance, STARFISH includes a compliance layer, as illustrated in Fig. 3, that incorporates both the user’s and requester’s regulatory context. Because laws differ globally, agents identify the applicable laws based on the location of RA and PHA and map data transfer requests to appropriate governance laws. If a European patient’s data is requested by a US company, agents automatically verify required guarantees for compliance with both GDPR and HIPAA. STARFISH thus translates a simple user consent into all legal and technical artifacts required to make sharing lawful in both jurisdictions.

Fig. 3. Global compliance.

STARFISH provides a layer that accounts for rules derived from both the user’s locale and the requester’s locale.

Clinical scenarios

A potential application is rare disease clinical trial recruitment, which is often delayed by the geographic dispersion and underdiagnosis of eligible participants⁶². A Research Agent (RA) publishes machine-readable eligibility criteria; Personal Health Agents (PHAs) securely scan local EHRs, genomic reports, and wearable data to identify matches, then notify individuals with a summary of study purpose, risks, benefits, and compensation. Upon consent via a Consent Mandate, the PHA shares de-identified data or confirms eligibility through an Analysis Mandate without exposing raw records. This workflow could reduce recruitment timelines from months to days, expand participation beyond major academic centers, and improve cohort diversity and representativeness in rare disease research. Recent work has demonstrated that privacy-preserving federated learning across distributed institutions can enable big-data approaches even for rare cancers⁶³. Using our envisioned infrastructure could further accelerate and encourage such collaborations by automating the process and setting the proper incentives.

Post-market surveillance of medications and devices similarly benefits from agentic exchange. Regulatory agencies deploy RAs to monitor real-world safety signals; PHAs continuously analyze local patient outcomes, wearable sensor streams, and medication logs, contributing anonymized summaries or Analysis Mandate outputs when predefined safety thresholds are met. This enables near real-time monitoring across diverse populations and earlier detection of rare or delayed adverse events, reducing reliance on passive reporting systems.

Newly enabled research opportunities

On the clinical side, agent-mediated health data exchange opens new avenues for embedded pragmatic trials, rare disease recruitment, real-world evidence generation, and active pharmacovigilance. By enabling real-time eligibility detection, automated consent, and continuous outcome monitoring through personal health agents, research can be integrated directly into care workflows, including emergency departments and primary care. This approach supports more representative cohorts, inclusion of underserved populations, and longitudinal follow-up beyond institutional boundaries. In turn, these capabilities advance precision medicine, strengthen learning health systems, and enable regulators and clinicians to detect safety signals and treatment effectiveness earlier, while preserving patient autonomy and privacy.

Limitations and challenges in STARFISH implementation

Digital divides pose a substantial equity risk. Agentic exchange presumes that users have fundamental resources such as reliable internet access, digital literacy, and compatible devices. However, populations in low-resource settings, rural communities, and among elderly or digitally excluded groups may lack these prerequisites. Without deliberate design for the inclusion of these populations, agentic systems risk widening existing health research disparities rather than narrowing them. Financial incentives, while motivating participation, also risk constituting undue inducement for economically vulnerable individuals. Financial sustainability, such as whether institutions are willing to pay participants and presence of political barriers, are recognized challenges in previous data exchange mechanisms, such as Health Information Exchange (HIE), and remain relevant to STARFISH as well⁵⁴. Scalability in low-resource settings will demand lightweight, interoperable implementations and sustained investment in digital health infrastructure.

Agent trustworthiness, auditability, and liability are critical unresolved governance challenges. Participating PHAs and RAs must be certified against defined behavioural standards, with cryptographic audit trails enabling post-hoc verification of every data transaction. Recent evidence⁶⁴ indicates that AI agents are still prone to errors, so clear liability frameworks must assign accountability among the agent developer, deploying institution, and data owner. Another challenge is that increased data availability does not guarantee to benefit research findings because data could be inaccurate, incomplete, or noisy. Existing legal structures offer limited guidance for autonomous agent actions, and resolving this gap requires collaboration among technologists, legal scholars, regulators, and patient advocates. When patient decides to withdraw their consent, we cannot guarantee that the previously transferred data will be completely deleted or all knowledge learnt would be eliminated.

From an ethical standpoint, the patient-governed design of STARFISH aligns with recently articulated ethical principles for AI agents and agentic AI⁶⁵. Transparency is supported because patients define, audit, and modify how and when their data is used, while agent decisions, reasoning, and transactions are logged for human review. Accountability is provided through cryptographically signed mandates that bind both parties to the agreed terms, with revocation obligating institutions to provide evidence of data deletion or machine unlearning. Fairness is promoted by incentivizing participation and enabling model training on data from underrepresented groups, which can reduce bias in the resulting models. Privacy is preserved through Analysis Mandates that share federated model updates instead of raw sensitive data, and non-maleficence is reinforced by requiring human approval for new or high-risk data usage so that agents never act entirely on their own. These safeguards, however, must be read alongside the equity, inducement, and agent trustworthiness risks discussed above.

Conclusion and future directions

Agent-mediated, patient-governed data exchange offers a pathway to trustworthy, scalable, and participatory digital health research. By enabling granular consent, privacy-preserving analysis, and potential benefit sharing, STARFISH reframes individuals as active partners rather than passive data sources. Realizing this vision will require advances in interoperability, identity infrastructure, governance, and equity safeguards. Future work should focus on pilot deployments, safe agent behaviour benchmarks, standards alignment, and policy sandboxes to evaluate safety, inclusivity, and clinical impact. Support from policy-makers co-designed with patients, regulators, and healthcare systems will be essential to ensure agentic ecosystems enhance trust while accelerating evidence generation within learning health systems.

Author contributions

S.D. and J.Z. conceived and designed the perspective. The manuscript was drafted by S.D., G.T. and Z.S., with critical revisions for important intellectual content provided by J.Z., Y.C. and F.W. All authors reviewed and approved the final version of the manuscript.

Data availability

No datasets were generated or analysed during the current study.

Declarations

Competing interests

The authors declare no competing interests.