Liability (And) Rules for Health Information

Abstract

The recent trend toward propertization of health data could pose significant challenges to biomedical research and public health. Property rule systems can result in sizable up-front costs in the acquisition of consent from individual data subjects, as well as the ongoing risk that data subjects will retract consent or object to unanticipated data uses, thus compromising existing data resources and analyses. Instead, we propose that research using individual health data should be subject to a regulatory regime, enforceable by government/public repositories, while at the same time permitting limited private enforcement actions to address particularized individual injury. Thus, while the physical collection of human tissue would continue to be subject to existing rules regarding informed consent, ex ante consent would not be required for the use of information derived from physical samples. Rather, rules regarding proper research use of health information would be put in place, and violations of those rules would be dealt with on an ex post basis, both through regulatory penalties and private liability actions. These recommendations are supported by two cases studies: the Utah Population Database and Statistics Denmark, both of which provide examples of successful health data repositories that are governed by regulatory systems. While these examples are drawn from governmental data resources, the approach that they exemplify can be extended to academic and other research environments. These case studies suggest that regulatory and liability models should be considered more broadly for the governance of research using human health data in lieu of property-based systems.

Keywords: health information, health data, genetics, property, liability, public health, biomedical research, Utah Population Database, Statistics Denmark