When I entered pathology informatics in 1982, I was told, at least in Michigan, that patient's "owned" their health data but that the hospital owned the media on which the data was recorded. Media was defined as the medical record paper and film in the case of radiology images. This was an era in which data on paper, as opposed to electronic data, did not have great utility unless you could manually collect it, a laborious and expensive task. As you might imagine, this picture is getting much more complicated. Ownership of medical data was discussed in a recent article (see: Who Owns EHR Data?) from which I provide an excerpt below:
The owners of electronic health records aren't necessarily the patients. How much control should patients have?....Electronic health records (EHRs) have become invaluable collections of information used by a diverse group ranging from government agencies and disease researchers to marketing firms and for-profit data brokers. Government and for-profit businesses have long collected, parsed, and used collective patient data to track the path of chronic conditions and contagious diseases, follow the success rates of new and old treatments, develop new cures, and improve the quality of providers' services. But because today's electronic records are easily shareable...and have different rules depending on state and organization, some patients fear they have little to no control over the information that tracks their very personal health information....[A]s patients we want our data to be shared when needed, but then we're surprised at how quickly we lose control of how it's shared. Consumers don't "own" their health records any more than they own the vast troves of data that retailers, financial institutions, and government agencies collect about them....Instead of ownership, healthcare professionals and patients should discuss electronic patient data in terms of "stewardship,"....Although the creator of the record ...controls the record and data, patient data has multiple stewards. Complete records might well include a combination of handwritten medical notes scanned as PDFs into a patient's file; information manually or electronically entered from monitoring and collection tools such as stethoscopes and scales; and data entered directly into the EHR. And the picture is going to get more complex. Soon, electronic records might collect data from wearable devices ...that gather health data around the clock. ....With all this sharing, what if a patient has a diagnosis he doesn't agree with or doesn't want shared? Can he contest, say, a diagnosis of alcoholism?"
I have personally invoked the doctrine of stewardship many times in terms of the relationship of pathology to the huge amount of lab test information that we generate. My use of the term often involved disputes with the central IT department of my hospital regarding control of lab data. Although this notion of "stewardship" of data is an answer to the question of who owns patient data, it is far from an adequate one. There is lots of poor stewardship of data (see: UnitedHealth Settles Suit with New York Attorney General Cuomo) and many organizations may seek to profit from the sale of patient information. I suspect that what is holding back many such "stewards" of information such as hospitals and health insurance companies is fear of getting caught.
As healthcare reform and a reduction of payments for care gain traction, some healthcare organizations may begin to seek profits from the sale of patient information. The most flush, potential purchaser of such data is Big Pharma and they have not demonstrated in recent years much in the way of scruples in the way that they manage patient data (see: Using Aggregated Lab Test Results for Pharmaceutical Marketing and Research). EHR companies may be playing the same game (see: Practice Fusion Supported by Advertising and Owns Anonymized Data; Cerner Supplies Clinical Data for Research Project). The lesson here is that when an organization cites their admirable record of data stewardship, the proper response should be to say prove it.