The White House announced it is launching a health data tracking system early next year that involves an unprecedented partnership between the federal government, providers, payors, and private sector technology companies. The stated objective is to enable patients to more easily access and share their personal health data and medical records across different platforms, including through apps operated by private technology companies (the “Tracking System”). While the initiative may ultimately aspire to improve patient care through expanded data sharing, it raises notable legal and privacy concerns.
How the New System Will Work
Currently, medical information is stored in different systems across hospitals, providers’ offices, payor systems, and wellness apps, among other systems. The healthcare industry has long been working to improve care outcomes by optimizing the sharing of medical information. For example, beginning in 2021, the 21st Century Cures Act has prohibited certain information-blocking practices with the goal of promoting health technology interoperability.
In effect, if patients choose to opt in and allow for their medical information to be processed through the Tracking System, all of their health data—from lab results to daily step counts tracked by iPhones—would be pulled into a single, secure system maintained by the Centers for Medicare and Medicaid Services (“CMS”). Participating apps and health networks would then be able to access this information and gain a more complete picture of an individual patient’s health condition. However, for the private sector to have seamless access, existing encumbrances in data sharing processes would likely need to ease up.
Key Legal and Privacy Concerns
Supporters argue the Tracking System could improve chronic disease management, bring personalized lifestyle advice to patients, and eliminate cumbersome processes like requesting and transferring records between offices that can lead to delays in care. However, the added convenience comes with legal and ethical concerns, such as:
- Patient Consent – While CMS suggests that patients must opt in to sharing their health data via the Tracking System, advocates question if patients will truly understand what they are agreeing to. Based on the information available to date, the scope of data use within the Tracking System is unclear, as is the extent to which patients will be able to control how their data is used or shared.
- Data Privacy and Security – Concentrating highly sensitive information on a single system increases the risk that hackers or other bad actors would target the Tracking System. There is also skepticism around whether government and private-sector partners can maintain data security, particularly where numerous parties are able to access sensitive medical data. It will be critical that appropriate safeguards and systems are implemented to ensure that data is appropriately protected.
- Potential for Commercialization of Personal Information and Misuse – Patient advocates warn that health data could be used for purposes patients do not expect, including for targeted advertising or law enforcement activities, as well as more malicious purposes, such as bio-surveillance and bioweapons, discriminatory practices and selections, and product development unrelated to health care, with companies or government profiting from private personal information. The Health Insurance Portability and Accountability Act of 1996 and its implementing regulations do not fully regulate tech companies or many health apps, resulting in potential gaps in protection with respect to uses of health data for purposes unrelated to patient care.
- Regulation Lag – While states have expansive privacy and security laws, health privacy laws and regulations have not kept up with fast-moving technology advancements. Ensuring updated and transparent regulation will be essential if this Tracking System moves forward.
Looking Ahead
The Tracking System could help modernize healthcare in the U.S., but it also poses real risks if patient privacy, control, and security are not firmly protected. As this plan moves toward launch, it will be critical for regulators, providers, and tech companies to devise clear rules and robust safeguards to earn public trust.
