Harmonizing regulatory regimes for the governance of patient-generated health data. (June 2022)

• Record Type: Journal Article
• Authors: Winter, Jenifer Sunrise; Davidson, Elizabeth
• Is Part Of: Telecommunications policy. Volume 46:Number 5(2022)
• Publication Date: 2022-06
• Subjects: Patient-generated health data -- PGHD -- Governance -- Privacy -- Big tech -- Regulation; Telecommunication -- Periodicals; Télécommunications -- Périodiques; 384
• DOI: 10.1016/j.telpol.2021.102285
• Languages: English
• ISSNs: 0308-5961

Abstract

Abstract: Patient-generated health data (PGHD), created and captured from patients via wearable devices and mobile apps, are proliferating outside of clinical settings. Examples include sleep trackers, fitness trackers, continuous glucose monitors, and RFID-enabled implants, with many additional biometric or health surveillance applications in development or envisioned. These data are included in growing stockpiles of personal health data (PHI) being mined for insight by health economists, policy analysts, researchers, and health system organizations. Dominant narratives position these highly personal data as valuable resources to transform healthcare, stimulate innovation in medical research, and engage individuals in their health and healthcare. Large tech companies are also increasingly implicated in these areas, through mobile health application sales and data acquisitions. Given the many possible uses and users for PGHD, ensuring privacy, security, and equity of benefits from PGHD will be challenging. This is due in part to disparate regulatory policies and practices across technology firms, health system organizations, and health researchers. Rapid developments with PGHD technologies and the lack of harmonization between regulatory regimes may render existing safeguards to preserve patient privacy and control over their PGHD ineffective, while also failing to guide PGHD-related innovation in socially desirable directions. Using a policy regime lens to explore these challenges, we examine three existing data protection regimes relevant to PGHD in the United States that are currently in tension with one another: federal and state health-sector laws, regulations on data use and reuse for research and innovation, and industry self-regulation of consumer privacy by large tech companies. We argue that harmonization of these regimes is necessary to meet the challenges of PGHD data governance. We next examine emerging governing instruments, identifying three types of structures (organizational, regulatory, technological/algorithmic), which synergistically could help enact needed regulatory oversight while limiting the friction and economic costs of regulation that may hinder innovation. This policy analysis provides a starting point for further discussions and negotiations among stakeholders and regulators to do so. Highlights: Patient-generated health data (PGHD) – health data created and captured by or from patients or other non-clinical actors – are proliferating outside of clinical settings and present unique data governance challenges. Technology vendors, and particularly the Big Tech firms that have brought about transformative innovations in other socioeconomic sectors, are well positioned to similarly transform healthcare and to generate substantial profits as they do so. We outline three overlapping data governance regimes and highlight tensions between privacy-enhancing and innovation-advancing regulations. Diverse regulatory regimes that stakeholders operate within contribute to confusion about what regulations apply to PGHD in different contexts and what compliance may entail. There are lacunae that will enable misuse of PGHD if not addressed. We identify structures (organizational, regulatory, technical/algorithmic), which synergistically help enact needed regulatory oversight.