CIS 450 Module 6 Legal and Ethical Issues in Health Data Example

Data, Consent and Fairness: Legal and Ethical Issues in Sharing and Using Health Data

Student Name

Health Care Administration Program, Aspen University

CIS 450: Informatics in Healthcare

Instructor Name

Month Day, Year

Data, Consent and Fairness: Legal and Ethical Issues in Sharing and Using Health Data

Health data have value beyond individual care: research, quality improvement, product development and prediction. Using them raises legal questions about privacy and ethical questions about consent, fairness and trust. This paper examines two decisions at a composite health system: whether to share a de-identified data set with a technology company, and whether to adopt a commercial algorithm to identify patients for care management.

Decision One: Sharing Data

A technology company offered to build a readmission prediction tool if the health system provided five years of de-identified patient records, in exchange for a discount on the finished product. Leaders asked whether this was legal, whether it was ethical and what safeguards were needed.

HIPAA De-Identification

Under the HIPAA Privacy Rule, 45 C.F.R. § 164.514, health information is considered de-identified, and outside the rule's protections, if either the safe harbor method is followed, removing 18 specified identifiers with no actual knowledge that the remaining information could identify someone, or a qualified expert concludes that identifying anyone from what remains is highly unlikely (U.S. Department of Health and Human Services, 2012). Properly de-identified data may be shared without patient authorization.

The Re-Identification Problem

Legal de-identification is not the same as anonymity. A modeling study concluded that fifteen ordinary demographic details would be enough to pick out almost every American in a data set, even one sampled heavily (Rocher et al., 2019). Rich clinical data sets combined with other data sources can therefore expose individuals even when names are removed.

Ethical Questions in Sharing

Beyond legality, the system considered whether patients would reasonably expect their data to be shared with a company for profit, whether the benefits would return to patients and whether sharing would erode trust. Patients often accept research use for public benefit but object to commercial use without their knowledge.

Decision Two: A Risk Algorithm

A vendor offered an algorithm that ranks patients by predicted future health needs to select them for a care management program. Before adopting it, the health system's data team asked how it was built and whether it performed fairly across groups.

Algorithmic Bias

Algorithms can embed bias. Obermeyer and colleagues examined a popular commercial tool and showed that it scored Black patients as healthier than equally sick White patients; the tool forecast spending rather than sickness, and because less had historically been spent on Black patients, fixing the problem would have more than doubled their share of extra care (Obermeyer et al., 2019). The choice of what an algorithm predicts is an ethical choice.

Issues at a Glance

The table summarizes the issues.

The System's Data Decision

The health system agreed to share data only under expert-determined de-identification, a data use agreement forbidding re-identification and linkage with other data sets, limits on retention and a commitment that the tool would be tested for fairness. It also posted a public notice describing the partnership and created a patient advisory group to review future data-sharing proposals.

The System's Algorithm Decision

The data team tested the vendor's algorithm on local data and found that Black and White patients given identical scores differed in illness burden, with Black patients carrying more chronic conditions. The system declined to use the algorithm as offered and asked the vendor to retrain it on a measure of illness rather than cost. Until then, care managers used a clinical criteria list reviewed for equity.

Governance

Both decisions led the system to create a data governance committee with clinical, legal, ethics, informatics and patient members. The committee reviews proposals for secondary data use and algorithm adoption against criteria for privacy, benefit, fairness and transparency, and it can require audits after deployment.

Consent Models

Some ethicists argue for broader consent, such as asking patients at registration whether their de-identified data may be used for research or product development. Others worry that consent forms are rarely read. The system chose transparency and governance, with an opt-out process for patients who do not want their data included in commercial partnerships.

Security as an Ethical Duty

Even properly governed data sets can be stolen. The data use agreement required the company to meet security standards, notify the health system of any breach and destroy the data at the end of the project. Security is an ethical obligation as well as a legal one, since patients bear the harm when data escape.

Research Versus Commercial Use

The committee distinguished academic research, reviewed by an institutional review board under research rules, from commercial product development, which may not receive the same oversight. It decided that commercial uses would require committee review even when the data met de-identification standards.

Explaining Data Use to Patients

The public notice explained in plain language what data would be shared, with whom, for what purpose and with what protections, and how to opt out. A short version appeared in the portal. Patients who understand data use are more likely to trust the organization, even if they choose to opt out.

Monitoring After Deployment

Fairness is not settled at purchase. The committee required quarterly reports of any adopted algorithm's performance by race, ethnicity, sex, age and insurance, with a process to pause use if disparities appear. Algorithms can drift as populations and practices change.

Conclusion

Sharing de-identified data may be legal under HIPAA's standards, but evidence that most people can be re-identified from a handful of attributes and that algorithms can encode racial bias shows that legality is not enough. Safeguards, transparency, fairness audits and governance with patient voices help health systems use data responsibly and keep patients' trust.

References

Obermeyer, Z., Powers, B., Vogeli, C., & Mullainathan, S. (2019). Dissecting racial bias in an algorithm used to manage the health of populations. Science, 366(6464), 447-453. https://doi.org/10.1126/science.aax2342

Rocher, L., Hendrickx, J. M., & de Montjoye, Y.-A. (2019). Estimating the success of re-identifications in incomplete datasets using generative models. Nature Communications, 10, Article 3069. https://doi.org/10.1038/s41467-019-10933-3

U.S. Department of Health and Human Services. (2012). Guidance regarding methods for de-identification of protected health information in accordance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule 45 CFR § 164.514. https://www.hhs.gov/hipaa/for-professionals/special-topics/de-identification/index.html