The Health Data Use Act

Making health data usable – by law

Data is generally considered the ‘oil of 21st century’. And just like oil, data must be used to develop its value, that is, its potential.

To date, however, the use of data in the healthcare sector has been hardly possible, if at all. As health data is highly sensitive data, this is all too understandable, because the use of this data can lead to considerable disadvantages for individuals if it is handled improperly. If a potential employer is concerned about frequent absences because they found out that the applicant has just completed chemotherapy – and rejects them on account of this knowledge – this would be very frustrating for the potential employee. Even though this kind of discrimination is prohibited by law, there are certainly black sheep who use health data in ways that are not fair.

With the introduction of the GDPR, access to such sensitive data has become much more difficult. In this context, earmarking in particular plays a significant role: data may only be used for a specific purpose, the so-called primary purpose. Other secondary use is only permitted under the GDPR in a handful of exceptions.

However, the use of data can add significant value to both individuals and society. Be it the development of new active substances, the prediction of interactions or the detection of rare diseases, the existing treasure trove of data, which is continuously growing, has considerable potential for healthcare improvements and thus opens up the opportunity for every individual to benefit from this data being evaluated.

Data and information

Mere access to data is not the decisive factor. Data are individual pieces of information, such as the knowledge that a person is prescribed a certain medicine. This data can only deliver substantial added value if it is brought together to form an overall picture. Only by knowing why someone needs this medicine in the first place, why this medicine was chosen rather than another and what side effects were found, do connections emerge. And in this context, a wide range of data relevant to a patient’s health can play a role. This includes, among other things, age, gender, physical fitness, nutritional habits, childhood illnesses or vaccinations. The types of data available to us are almost infinite. And the use of this information, i.e., the data spectrum of a large number of specific individuals, enables both research and industry to vastly advance healthcare.

The data is available and can already be aggregated into information in many sub-areas. An estimated 22,000,000,000,000 gigabytes of health data is collected every year. Stored on (admittedly outdated) CDs, the resulting stack would be over 37,000 kilometres high – that’s almost the circumference of our planet. This data can be turned into information by driving the standardisation of data structures. Many, if not most, countries have already recognised that this is necessary and have been accounting for this interoperability in laws and regulations for some time now.

Making the information usable

Research, industry and politics have recognised the potential of information use for society as a whole. Artificial intelligence (AI), one of the key technologies of the future, is already being applied in many cases, but this happens far too rarely in the healthcare sector. Apart from other obstacles, such as time-consuming approval processes, this is mainly due to the inaccessibility of information.

The current federal government is eager to promote this utilisation and has stated in the coalition agreement that it ‘[...] will launch instruments such as data trustees, data hubs and data donations together with business, science and civil society’. The specific instrument to help implement these goals is the planned Health Data Use Act (or GeDaNug in short). Even though the exact time frame for implementation has not yet been announced, experts are pushing for its implementation in the near future.

Willingness to donate data and implementation

The Corona pandemic has shown that the general population is willing to donate their data and information. More than 530,000 individuals in Germany have provided their data to the RKI for study and scientific purposes, amounting to more than 170 million data sets. According to a Bitkom study, 90 per cent of Germans are willing to make their data available to research, and one in two would also make their data available to commercial enterprises.

These figures reveal one of the main issues that needs to be addressed by the Health Data Usage Act: how, or, more to the point, by what mechanism should citizens be able to donate their data? Technically, it should be possible to donate the data stored in the ePA digital patient file starting in 2023. Whether this option will be used by the majority, however, is doubtful. This is because, similar to the German organ donor card, citizens must actively agree (opt-in) to make their information usable.

An opt-out mechanism would be more effective. The assumption here is that citizens generally want to make their data available yet still want to have the option of preventing the donation of their data. This mechanism comes with two major advantages:

• The amount of information is significantly increased because it does away with the hurdle of having to actively unlock one’s data. In addition to the effort required to enable data donation individually, users must also be aware of this possibility. Since it should not be assumed that the majority of the population is following the development of the ePA, information campaigns would have to be launched to educate citizens about this option and motivate them to donate data.
• If implemented, data donation via opt-in would lead to a bias in the information that is available. After all, individuals affected on a personal level or who stand to benefit from donating their data will be more willing to make this donation. So if people with rare diseases, the chronically ill, e-health professionals or medical professionals are more willing to share their information, the average patient is underrepresented, and this can have unexpected consequences, especially in the field of AI development.

Privacy and data security

In addition to the making data donations possible and fostering a willingness to do so, the legal framework must be adapted. Research institutes, colleges and universities can already use health data today. However, this is not the case for businesses and the industrial sector, although they are key drivers of innovation. This is mainly because data may only be used for the main purpose (primary use). It is therefore essential for these actors that the data and information collected may also be used for other purposes (secondary use). Of course, data protection must still be upheld in the process. Therefore, lawmakers must define in detail which data may be used in which format and for what purpose.

Of course, technical solutions must also be developed to ensure the security of the data and to allow it to be linked with information. As the data originates from different sources, including care facilities, pharmacies, health insurance companies and different medical device manufacturers, it must be collected, managed and aggregated centrally. The Health Data Usage Act envisages data trustees for this purpose. These trustees will be able to manage data centrally and make it available to interested parties in a suitable format, for example, pseudonymised. However, this data should not only be limited to health data, but other possible sources should also be considered: biometric, genetic, personal and socio-economic data should be available as well as fitness data and care data, which has been excluded to date. This is the only way to contextualise this data and generate the needed information.

Conclusion

The use of healthcare data holds vast potential for innovation, and this offers the opportunity to fundamentally improve healthcare for all.

Health data should be seen as a kind of public property that could be used for the benefit of the entire population. The current German government has recognised this potential and is now trying to harness it. To achieve this, however, concepts must first be drawn up in cooperation between government, research and industry, and legal and technical framework conditions must be created. The high sensitivity of the data calls for sound concepts that continue to prioritise data privacy without creating excessive bureaucratic hurdles. And, last but not least, it is essential to convince people of the benefits for each individual and for society as a whole, as well as to create a framework that allows for the collection of a well-defined but sufficiently broad treasure trove of data.

You will find more exciting topics from the adesso world in our latest blog posts.