Lawmakers in Oregon have proposed a bill that would let patients profit by selling their health data, ZDNet reports.
Four things to know:
1. The Health Information Property Act, a bipartisan bill with 40 co-sponsors, proposes treating personal health data the same as property.
2. The underlying idea is that patients should be compensated for sharing health data with HIPAA-covered entities, particularly those who de-identify the data and later sell it to third parties to use for anything from medical research to marketing.
"If somebody was using my personal data, selling it — which is a huge, huge industry — then perhaps I should be compensated for the information I am providing," co-sponsor Rep. David Gomberg, D, told ZDNet.
3. The three components of the proposed legislation are:
- HIPAA-covered entities and their business associates would be required to obtain signed authorization from consumers before de-identifying their personal health information to sell to a third party.
- Consumers who authorize the HIPAA-covered entity to sell their data could choose to receive payment in exchange for their permission.
- Companies subject to HIPAA would be barred from discriminating against a consumer who refuses to sign such authorization or who requests to get paid for it.
4. Efthimios Parasidis, a professor of law and health services management and policy at Ohio State University, told ZDNet he was concerned that the proposed bill could make it easier for businesses to leverage health data in ways that consumers don't want.
"While the proposed law may provide people with a small payment, in the long run it may have the perverse impact of sanctioning widespread use of health data for purposes beyond medical care and health research," Dr. Parasidis said. For example, he said, "the proposed legislation does not provide any limits on how health information is actually used once consent has been obtained."