Providers' data-sharing ventures try to make patient data more useful, keep it safe

Healthcare providers are moving into the complex world of sharing and sometimes selling patient data, but will have to address privacy concerns and maintain patient trust to be successful.

HCA Healthcare in January announced plans to share de-identified data on COVID-19 patients treated at its facilities with HHS' Agency for Health Research and Quality and a consortium of universities for COVID-19 research. In a separate venture, 14 health systems—including AdventHealth, Providence and Tenet Healthcare—in February launched Truveta, a for-profit company that will aggregate and de-identify data from the founding providers for research.

The projects are still in early stages, with limited details shared to date.

HCA, a for-profit hospital chain based in Nashville, hasn't yet selected specific topics for research, but is currently evaluating proposals from groups in the consortium, and Truveta hasn't shared details on its business model. But both are hoping to glean new insights by tapping into vast clinical data collected as part of patient care.

Having standardized patient data available and ready to share with external researchers could accelerate discoveries and make it easier to collaborate. It could also underpin advancements in artificial intelligence and precision medicine, which rely on having standard, longitudinal data from a range of patients.

"There are a number of research questions that large-scale data analytics can really help with," said Cora Han, chief health data officer at University of California Health, who isn't involved with either venture.

Building repositories of patient data isn't a new trend, as healthcare players for years have tried to bring together diverse data to serve as a central resource for research.

The National Institutes of Health in 2018 launched the All of Us Research Program, an effort to collect medical histories, lifestyle information and genetic data from 1 million people across the U.S. Last year it began beta testing a platform where researchers access and analyze data from the project's first 225,000 participants and has been returning early genetic results directly to participants.

Developers of electronic health records software, too, have recently launched or highlighted services that build on their role in the data ecosystem. Epic Systems Corp. recently launched its own research journal, which publishes studies based on data held in its EHR. Cerner Corp. has highlighted its "data-as-a-service" business as an opportunity for growth. And the data, analytics and care coordination segment was a highlight of Allscripts Healthcare Solutions' 2020 fourth-quarter earnings.

It's easier than ever to share and analyze patient data electronically, noted Dr. Ken Mandl, director of the computational health informatics program at Boston Children's Hospital, noting the rise in EHR adoption among hospitals in the last decade, which has laid the foundation for these types of efforts. "The environment's very rich for a lot of innovation," Mandl said. "The next set of questions is how this innovation should happen."

While all of the above efforts are working with patient data, they're taking different approaches.

HCA's approach, in which a set of institutions have the opportunity to propose study topics and work with HCA's researchers, establishes a standard, repeatable way to evaluate proposals and share resources, said Dr. Jonathan Perlin, chief medical officer at HCA. That "new paradigm" for striking research partnerships could prove useful beyond COVID-19.

Only HCA has access to original patient data. That's because the platform where researchers analyze the data lets researchers investigate questions and trends using obscured data, without providing access to the raw data itself. The platform, developed by DataFleets, isn’t connected to HCA’s internal clinical systems.

But even if data is secure, there's still the question of how much patients expect to know about how their data is being used, and whether hospitals have a responsibility to let them know when their information is shared as part of a new research venture.

It's unfair that patients don't get to choose whether or not their data is shared when healthcare providers, researchers and companies strike such partnerships, according to Cynthia Fisher, a patient advocate and founder of PatientRightsAdvocate.org, since—even when de-identified—it's still their data.

Providers should be transparent about how patient data is being used for research, make it easier for patients to opt-out of having their data shared, and share clinical findings from such studies back with patients, particularly if it's useful for informing their care, Fisher said.

In cases when a company is profiting off of monetizing the data, Fisher asks, "Why isn't the patient paid as part of that revenue stream? It's their data."

HCA does not charge researchers to access the COVID-19 dataset, and it's not looking to make money from the consortium, according to Perlin.

The new approach to sharing data with the consortium was reviewed by an institutional review board, said an HCA spokesperson. He added that since the platform doesn't provide direct access to patient data, it goes "beyond de-identifying the data in the traditional sense."

Traditionally, de-identifying data just involves stripping it of 18 identifiers including names, birth dates, telephone numbers and Social Security numbers.

Generally speaking, patients tend to be most comfortable sharing health data with their own physicians and provider organization, rather than outside companies. In recent years, that's come to a head when providers have shared data with tech giants like Google without seeking explicit consent from patients first.

Mandl suggested data projects that are the most successful keep provider organizations in the driver's seat—so that provider organizations can "appropriately shepherd … data on behalf of their patient." He's a proponent of so-called federated architectures, in which data stays in a controlled environment at the provider organization, but can be queried and analyzed by outside organizations.

Nearly half of patients (47%) indicated they would decline to share their health data with a for-profit institution for research, according to a 2019 study that asked patients about their willingness to share EHR data for research. But 28.3% of patients said they would opt-out of sharing data with a not-for-profit institution and only 3.7% would opt-out of sharing data with their own provider organization.

Provider-led data projects could capitalize on that. It's an angle that executives at Truveta have been pushing since the company's launch. Truveta is "governed by providers," said Terry Myerson, Truveta's CEO. Leaders from the health systems that founded Truveta will determine what researchers Truveta shares data with and for which projects, and will advise the company on ethics, health equity, data integrity and clinical outcomes, according to the company. The 14 health systems each hold ownership stakes in the company, too.

It's encouraging to see different models for sharing data emerge, said Paddy Padmanabhan, founder and CEO of healthcare consultancy Damo Consulting, as the industry needs to find a robust way of "aggregating, integrating, standardizing and normalizing" a growing amount of patient data. But he noted Truveta hasn't shared publicly how it will earn revenue.

That lack of clarity will probably lead to scrutiny from others in the industry.

"We don't know much about their commercial motives," Padmanabhan said. "What are they going to get out of it? It's not clear."

So far, Truveta hasn't shared specifics on its business model, but has said it will create a data platform where others can access data and data tools. That could include some datasets that are available for free or more complex datasets that Truveta charges researchers to access, as well as AI and machine learning tools it develops for physicians and researchers.

Truveta will be able to share more details later this year, according to a spokesperson for the company. And, as the company's work gets off the ground, each of the founding partners will "assess how best to inform patients."

Overall, to succeed, data-sharing projects must prioritize maintaining patient trust, experts say. Even if they're not legally required to get patient consent before sharing de-identified data for a specific project, offering transparency into how a patient's data is being used, how it's being protected and how findings from studies will advance science can bolster patients' confidence in the system.

Big data projects will offer "tremendous benefit" to healthcare research, said Han from University of California Health. "The question is: How do you build trust in the ecosystem so that you can reap those benefits?"