Fostering public research or boosting Big Tech?

The European Health Data Space should serve patients and healthcare workers, not private profit.

Data can be used for dangerous as well as beneficial ends. Nowhere is this more stark than in healthcare.

On the one hand, legitimate uses of data can push forward medical research, improve patient outcomes and reduce the burden on health and care workers. On the other, individuals’ health data are the most sensitive, with a vast array of possible misuses. These include identification of those susceptible to addiction, to target advertisements for tobacco or alcohol products. Refinement of health-reimbursement systems, such as via diagnosis-related groups, has meanwhile facilitated the commercialisation and privatisation of public healthcare.

The draft European Health Data Space (EHDS), proposed by the European Commission in May last year, stands at a crossroads between these two visions of data use. The choice is between a space that protects patients’ privacy, supports healthcare workers and defends Europeans’ right to healthcare—as laid down in article 35 of the European Union Charter of Fundamental Rights—and one that commercialises citizens’ personal data, destroys medical confidentiality and overburdens health professionals, all in the name of private profit.

Members of the European Parliament must ensure they support the right version of the EHDS when it eventually comes to plenary. And whereas the commission’s proposal has as its legal basis articles 16 (data protection) and 114 (approximation of laws) of the Treaty on the Functioning of the EU, MEPs must also include article 168 (promotion of a high level of health) to anchor the commitment to improving public healthcare systems in Europe.

Ulterior motives

So far, the commission’s actions have betrayed little interest in a public-good version of the EHDS. This was evident as early as the impact assessment, in which it fraudulently gave the impression that trade unions were supportive of the proposal—the four ‘unions’ in favour turned out to be business and trade organisations. The commission has still not corrected the assessment nor apologised.

Other aspects of the proposal suggest ulterior motives. Article 8, which aims to ‘open up’ the telemedicine market, is totally beyond the purported scope of the EHDS and raises concerns that it could be a Trojan horse for further marketisation and privatisation of healthcare.

Moreover, the unrestricted access to data for secondary uses, even for technology companies with little or no connection to health and care, risks turning the EHDS into ‘patient zero’ for Big Tech expansionism into future European data spaces. Health-policy, law and ethics experts recently warned of disastrous consequences for the public sector, such as Big Tech dominance in ‘research agenda setting and growing dependencies on privately owned computational infrastructures for the provision of public goods, such as health’.

The co-legislators must therefore scale back the commission’s proposal and concentrate on the core aspects of the EHDS—the facilitation of cross-border sharing of personal health data between professionals to improve provision and the secondary use of anonymised data for clearly defined public-interest research. There are three aspects to consider.

Involving workers

First, healthcare workers must be involved in the implementation and governance of the EHDS. Hundreds of thousands—from doctors to nurses to administrative staff—will be involved ‘on the ground’. They are able, through their unions and other representative organisations, to provide insights, denied to the lobbyists for big tech, into how this going to function.

Healthcare professionals will also be massively affected by the EHDS. Medical practices, administrative systems and so on will have to change to meet the new obligations, which are however not likely to be associated with adequate investment in training and new staff. The commission has promised a mere €220 million over four years to assist implementation. The rest will be down to national governments, which have shown little appetite to invest in healthcare, even after the pandemic.

The EHDS therefore needs to ensure that healthcare workers, along with other key stakeholders such as patients, are given a clear and influential role within its governance structures. Unions and professional associations must be involved in the national digital-health authorities, so that the transition does not affect staff negatively. The European Health Data Board must also give a voice to these stakeholders, to enhance transparency and accountability.

Fundamental rights

The second key element is trust. Many patient groups and digital-rights organisations are rightly concerned about the potential impact of the EHDS on fundamental rights such as privacy. A report from the Netherlands shows hospitals already struggle to ensure the confidentiality of patient data, due to unbalanced contracts with large medical-device manufacturers. Excessive scope for secondary uses of personal data, capture by for-profit actors and lack of a mechanism for individuals to permit or deny access are just some of the concerns.

Unfortunately, these concerns are not shared by everyone. In June, a group of research associations and trade bodies published a statement in which they declared: ‘Any form of opt-in or opt-out mechanism [for sharing health data] would introduce the real risk that data bias will form part of the EHDS from its inception and thus undermine its principal value for secondary use research purposes.’

It is inconceivable that European citizens would not be given the opportunity to object to their health data being used for secondary purposes. This would not only be in violation of their right to privacy but also would destroy doctor-patient confidentiality. The real risk to the value of the EHDS for secondary research would be that patients and healthcare workers did not trust it to enshrine their rights.

The vast majority of people are willing to share personal health data for transparent, public-interest research, as a poll commissioned by the Greens/EFA group in the European Parliament shows. They are however less confident about vaguely defined ‘innovation’.

Think of organ donations: whatever the consent system in place, donors are certain that their organs will be used to save another person’s life—not given to a for-profit company to do what it wants with them. The EHDS must give data donors the same assurances, by restricting the scope of acceptable secondary uses to medical research and development and ensuring that only actors with a clear and proven link to the sector can make use of the data.

Public ownership

The final requirement is a focus on public ownership. The choice is not ‘progress’ controlled by Big Tech or Luddism: technology can be used to drive forward socially accountable innovation in the public interest. The EHDS can be a vital tool in improving our healthcare systems only if public ownership and control is built into its architecture. The common infrastructures and the digital-health platform must have an open-source licence, with the code available in the open-source code repository of the EU.

What must be avoided is a private company being given the contract to build and maintain the technical systems—it would then own the code and effectively could never lose the contract. Furthermore, the regulation must ensure that there is a public return on public investments.

The EHDS proposal would force public healthcare systems to make the data they hold, which obviously cost money to collect, store and transmit, available free for secondary uses. A public hospital might thus find itself forced to pay market prices for a new medicine or product it helped develop. There must be profit-sharing between the data holders and those using the data for secondary purposes.

More widely, the overwhelming dominance of Amazon and Microsoft in cloud services means a vast array of sensitive data—even military secrets—must be stored on their servers. This dependence on third-country, private companies raises huge risks of the cartelisation of data storage and denial of accountability for a key strategic infrastructure. Although the commission’s European strategy for data recognises this problem somewhat, neither it nor EU member states’ joint declaration on cloud computing reaches the logical conclusion of greater public ownership of the cloud.

No silver bullet

The EHDS has the potential to be truly transformative for European healthcare, by facilitating public-interest research, reducing the administrative burden on healthcare workers and improving patients’ outcomes. To reach this potential it must however focus purely on these aspects. Privacy and patient trust, with healthcare workers as key collaborators, must be seen as enablers of ethical research, not barriers to it.

Finally, although the EHDS (and digitalisation more broadly) can bring benefits in health, it is no silver bullet for the problems plaguing the sector: understaffing, low pay and underinvestment. A person-centred data space respecting fundamental rights must therefore be coupled with greater investment in public healthcare systems.