Introduction

Systematic and timely sharing of health data holds out the promise of multifarious benefits: from improving diagnoses and treatment management to reducing costs and accelerating drug production. However, data sharing in healthcare is hindered by challenges related to availability and quality of data, lack of unified protocols and standards for data storage, as also patient concerns around trust, privacy, and misuse of information. This paper examines the failures of existing mechanisms for data sharing within healthcare and sets out to make a case for data stewardship – an emerging paradigm for data governance which affords varying degrees of security and consent controls to patients, providers, and caregivers, foregrounding accountability, community control, and user agency as the guiding imperatives for health data sharing.

There is a growing realisation that access to health data is highly lopsided, such that the rights of individuals and communities – the primary generators of health information – are posed at odds with the actions of providers who seek to maximise and extract value from health data. This fundamental tussle is exacerbated in the context of the pandemic that has overwhelmed health systems globally, making reliable data sharing an imperative to formulate effective public health responses. However, current practices of data exchange in healthcare are largely restricted to closed bilateral or multilateral data sharing agreements (DSAs) that privilege private contractual interests over public health concerns. Further, the specific terms of DSAs can be highly limiting, even excluding patients and caregivers from decision-making processes and in the process blocking use of data for social benefit. 

Consequently, a policy framework anchored in democratic approaches to data governance is needed to redress the power asymmetry that inherently relegates individuals and communities to merely providing inputs in the data sharing process. This is essential for setting out lucid roles, responsibilities, and rights of stakeholders, including patients and care providers, to engineer effective outcomes for the health sector. Health data stewardship constitutes a compelling alternative to existing mechanisms for data sharing by including individuals and communities in decision-making, thereby incorporating trust and participation as abiding principles for health data exchange. 

Data stewards perform the role of critical intermediaries, unlocking the value of data in public interest while safeguarding the rights of individuals, communities, and private organisations. They are being extensively examined as a mechanism for more equitable data governance. Aapti’s research, along with that of Ada Lovelace, ODI, GovLab and CIGI, has shown that data stewards can facilitate responsible sharing and distribute the value of data between individuals, communities and society more broadly.

To fulfil data stewardship’s potential in the health sector, coordinated action on multiple fronts is necessary to formulate a coherent ecosystem-level strategy. In top-down state policy action, a clearer and broader identification of harms is needed within legislation, beyond individual privacy concerns. The legal framework must take into account collective harms to patients and larger demographic groups. Collective privacy and community consent are principles that have thus far largely been ignored in regulations globally. The salience of the principles of collective privacy and community consent is heightened in the context of insights derived from aggregated health data. An enabling legislative ecosystem for health data stewardship should confer appropriate community data rights for collective enforcement of claims and subsequent value derivation from health information. 

At the community level, empowering patients and caregivers to exercise collective preferences regarding data through bottom-up mechanisms for health data governance should be the focus. For instance, Salus Coop is a health data cooperative that empowers members to make decisions regarding how their data is used; Ciitizen is a private collaborative platform that enables patients with cancer and rare neurological disorders to collect, digitise and share their health information for research and treatment; LunaDNA is an innovative application through which individuals can share health and genomic data for research, in exchange for compensation by way of its shares.

The ecosystem approach to health data stewardship envisaged in this paper represents an integrated approach that brings together top-down legal and bottom-up stakeholder engagement which strengthens organisational and community-level efforts aimed at evolving participatory frameworks for health data governance and sharing. Such an approach posits a sustainable and long-term strategy for protecting and sharing health data, enhancing the value derived from it, and maximising public benefit. 

Unpacking the health data ecosystem

The ecosystem approach to health data stewardship assumes importance in a sector where data sharing for public good and innovation is at odds with the data rights of patients, caregivers, and communities who are generators of the data. As a result, individuals and communities have little control over their data and cannot hold entities – governments and healthcare providers – accountable for harms arising from collecting and processing their health information. Moreover, current compliance-bound practices of obtaining “informed consent” are wanting, particularly because they ensure that patient consent is obtained at point-of-care only, without providing essential clarity on the parties involved in the sharing process. 

To this end, health data stewardship proffers a radical alternative to data governance by reconstituting power relationships between various actors in the ecosystem. It outlines the functions and responsibilities of stakeholders in healthcare – namely, patients, caregivers, providers, public institutions, civil society, and academia – for handling data in a manner that is fair, transparent, and geared towards the fulfilment of certain predefined objectives and broad-based social benefit. Accordingly, data stewardship manages the relationships and interests involved in sharing data, and helps develop policies that create beneficial public impact and societal value.

Notably, enabling stewardship functions will require a policy-level overhaul of the current framework of bilateral and multilateral ad hoc DSAs for health data sharing. This policy framework requires rule-making by authorities, but also supporting regulatory infrastructure for communities to participate and express their preferences in order to exercise agency over data. The latter element of providing a platform for community engagement is salient to the success of the ecosystem approach to health data sharing. Regulation is useful for enforcement of rules against breach of consent and abuse of trust, but participative bottom-up frameworks are necessary to re-balance the health data ecosystem itself.

Stakeholder roles, responsibilities in the health data ecosystem

Instantiating health data stewardship calls for the fulfilment of varied and interdependent roles and responsibilities ascribed to each stakeholder in the healthcare ecosystem. Aapti’s research on health data stewardship has identified five categories of stakeholders in healthcare who interact on questions of data. The stakeholders and their roles in the ecosystem are described below: 

1. Patients and their caregivers who make up the category of individuals and communities that are the primary generators of data.
2. Providers, including for-profit organisations, such as hospitals, clinics, pharmaceutical companies, and insurance agencies, which generate and consume data in the process of their operations.
3. Public institutions which include policymakers and regulatory authorities who determine standards and legal frameworks for health data sharing.
4. Civil society, such as philanthropic foundations and not-for-profit organisations which constitute influential sources for funding and delivery of healthcare in resource-scarce contexts. Consequently, these organisations generate a wealth of health data.
5. Academia, comprising universities and research organisations that conduct critical health research which are data-intensive endeavours.

As organisations begin contemplating reforms to their internal data governance practices and facilitate greater collaboration among stakeholders, the value created by health data stewardship is enhanced for patients and their communities. Significantly, the vision of stewardship proposed in this approach places individuals and communities at the core of the healthcare ecosystem, simultaneously empowering them to gain meaningful control over their data. 

The primary generators of health data – individuals and communities –  entrust providers, public institutions, civil society and academia with their data. In exchange, they expect to receive innovation in drug development and treatment management, enhanced quality and access to affordable health services, unlocking the public value of health data. In reality, communities have been denied visibility of data sharing decisions, with few avenues and opportunities to engage with other stakeholders in the ecosystem to register their preferences. 

Therefore, the reciprocal responsibility assigned to communities in the healthcare ecosystem calls for the leveraging of their positions as originators of health information. Harnessing the power of collective bargaining in pursuit of group enfranchisement is another responsibility of individuals and communities looking to meaningfully assert their claims or rights over data. In turn, the conference and recognition of data rights will enable communities to hold other stakeholders such as providers, civil society, public institutions and academia accountable for the latter’s data sharing actions. Community rights over data are also pivotal to staking claim to value created through insights derived from aggregated health information, failing which the growing commodification of health data by organisations such as 23andMe and DeepMind cannot be stymied. 

On the other hand, providers constitute the first link in the health data supply chain, collecting and processing troves of sensitive health information as part of their care delivery. As a result, it becomes incumbent upon providers to introduce dynamic consent controls as a part of their data collection process to ensure that the interests of individuals and communities are adequately represented in data sharing decisions. An accompanying responsibility involves a reconfiguration of providers’ internal data governance practices and frameworks, and delineating specific storage and end-use limitations for data – such that patient data is shared and reused for predefined purposes that respect community preferences. The experience of Johns Hopkins Medicine that has instituted a “data trust administrator” is an encouraging example of the ecosystem approach to health data stewardship that protects patient privacy while enabling use of medical records for better care provisioning and facilitating of research.

Civil society organisations and academia perform similar roles within the health data ecosystem inasmuch as they help fill gaps in care delivery, research and innovation, particularly in resource-scarce contexts. As a result, the two stakeholders actively interact with communities in varying capacities, engaging in complex dynamics of negotiation and representation that leave them awash with health data. Thus, stewarding this health data in ways that put control back in the hands of communities, and diverting its use for socially beneficial ends in a secure and responsible manner are the primary responsibilities of civil society organisations and academia. Liaising with policymakers, promoting digital literacy and strengthening community participation in data governance are other responsibilities associated with these stakeholders. Bottom-up efforts at health data stewardship by data cooperatives such as MiData and LunaDNA are remarkable reminders of civil society actors who have empowered communities to gain control over their health data. 

Lastly, public institutions play a critical role in mediating the relationships between communities and other stakeholders such as providers, civil society and academia. Since the framework of health data stewardship elucidated within this paper’s ecosystem approach places individuals and communities at its core, all state action must acknowledge the primacy of their positions as originators of all data and confer appropriate data rights. Furthermore, public institutions must redirect data governance to ultimately benefit communities, supplying the standards, frameworks and principles that would regulate health data sharing. Additionally, enabling technical and regulatory innovation through consistent testing, pilots and sandboxes is another responsibility of public institutions looking to build a resilient ecosystem for health data stewardship. Finland’s Findata and Estonia’s X-Road are important forerunners that have adopted a cohesive ecosystem approach to public-benefit health data sharing, providing valuable insights for other public authorities around the world. 

Investment incentives for public-benefit health data sharing

Health data primarily takes the form of electronic health records, which are digitally-mediated documentation of a patient’s medical history and care. Data sharing remains a challenge in many contexts of the digital medium due to the differing level of accessibility in digital health services. This can be attributed to a low level of digital literacy but also to the absence of a common set of standards that would make health data easily shareable and usable with a shared ontology. This forms one of the main roadblocks to incentivising data sharing, leaving only a portion of the data usable if even once shared. Moreover, this discourages investment in creating platforms to share or even the sharing of data at all in the first place.

Setting up a responsible sharing framework can help increase transparency and accountability of health systems with regard to data use and access, and increase community trust in the process of sharing. Additionally, data sharing promises to create compelling financial, social and political incentives. These incentives, though multiple and layered, call for sustained investment in a comprehensive ecosystem that provides the requisite technical and regulatory infrastructure for health data stewardship. Consequently, better governance, enabled as a result of stewardship, would lead to increased faith in actions of public authorities as well as amongst stakeholders. Apart from ecosystem-level benefits, healthcare providers stand to gain in terms of cost margins, efficiency, and increased possibilities in research and care delivery.

The varying contours of incentives for uptake of health data stewardship are delineated below:

1. Financial sustainability of health systems – Data-driven care has increased the preventive scope of health services, averting adverse outcomes as well as reducing expenditure on treatment measures. One study by Nesta estimates a total savings of £4.4 billion a year on public spending when patients and communities are involved in their own care. Stewardship’s central tenet is grounded in enhancing participation of communities in data governance. As a result, patients and caregivers are empowered with necessary data to make informed decisions about their health.
2. Multiplier effect in data economy – Government spending in health and education follows the fiscal multiplier pattern, demonstrating the long-ranging economic benefits of such investments. A report by WHO offers persuasive affirmation of investment in public health, producing approximately four-fold returns on every dollar spent on healthcare. Another more recent estimate by researchers in Europe indicates that multipliers are particularly expansive for social policies, bringing in benefits of €3 or more per euro spent in health system overhaul.
3. Social impetus – Stewardship would result in stronger collaborations to facilitate faster and socially beneficial open innovation, as in the case of Covid-19 vaccine development. Similarly, public data repositories maintained by the European Union and other governments have led to rapid, cost-effective, and safe data sharing to advance outbreak research. Providing a wider set of tools for care also increases the chances of greater self- and peer-care options, while decentralising access to care itself in the process. To this end, a study by Nesta estimates annual savings of £950 million per year (for health systems alone) from targeted peer support and self-management education for specific health conditions. 
4. Political impetus – The state, in most countries, is required to act in alignment with principles that benefit its population, as mentioned in the International Covenant on Economic, Cultural, and Social Rights. This enjoins development of healthcare as a primary objective of policymaking, along with management of resources to maximise beneficial outcomes. Progressive investments in health data stewardship would be in line with this objective, as would be bolstering health research and developing platforms for it.

The pandemic has demonstrated the ability of data-driven solutions to improve preparedness and effectiveness of public health interventions. Embedding stewardship within the healthcare ecosystem is one such data-driven innovation that offers benefits to a cross section of stakeholders: for the public exchequer, it improves the financial sustainability of health systems and creates positive externalities for the wider population; for service providers and health technology start-ups, stewardship provides opportunities to increase cost efficiencies; for individuals and communities, stewardship can channel their data in safe and effective ways to meet prioritised health outcomes.