The risk depends on your countries health system, and how much you think you can rely on it staying as it is.

Consent for a university to look at drug/condition correlation - fine.

Consent for insurance company to do the same - not ok. Healthcare should not cost more because you have been unlucky… the ill health is cost enough.

[And talking of rare conditions, my consultants reckon I was probably case ~22 globally, of course I don’t count in those stats since the test wasn’t administered early enough to be convincing, but it’s still going to be a pretty small number]

I like the planned eAkte (electronic patient folder) in Germany. I'll get a request from a doctor or a researcher who wants access to information. I can decide if they get access, and what level of access.

Diabetes research? Ok, blood values etc. but not my prostate scan or operations for various things, for example.

If I go to a new doctor or specialist at the moment, I have to sign a release form that they can order my information from other doctors, which takes a while. With the new system, I can give the doctor access on the spot, and access to what is relevant.

how do you determine what information is important or relevant?

and why would you not want a medical professional who is treating you not to see all of your history?

It's not the proposed sharing of data vs cures.

The data ultimately will be for marketing.

It's not even marketing that worries me, it's being denied treatment.

But there is no reason not to have a setup whereby GPs get a request in standardised form to select patient data, and for that to get sent out to patients with a standardised cover form (so that I can say "always say yes to a university that is looking for data on " and "always say no to insurance companies"). Then I can get a weekly/monthly list of places that want access, and what to and I can say yes/no to each.

If I were in the same position as you, then yes, anyone and everyone who might possibly come up with a medical advance could have my data even if it were to come too late for me.

But with respect, that's not what the debate is about. That's you allowing your data to be used whether or not you have explicitly opted-in. What you've not said is whether you believe that others with similar conditions to yourself should have their data used even if they haven't agreed (merely failed to disagree).

Not wishing to speak on behalf of everyone, but I'd suggest the majority of people with a particular set of heath conditions would be happy to share their medical data with researchers and even companies who are explicitly investigating those conditions. But again, that's not what this debate is about. This is - perhaps slightly simplistically - about all your, and everyone else's, medical data being available to anyone for any purpose if you fail to opt out.

'I have no truck with anyone telling me, from the position of perfect health, what is in my interests'

Neither do I. Touch wood, my interaction with Health professionals is limited - though that is not the point.

That argument could be made on mandating vaccines in the US and other countries- but there you would be lambasted as an anti-vaxer.

But again, its not the debate.

'But the vast majority of us don’t bother to argue, bought off by getting free access to a digital world. We don’t, for the most part, anonymise ourselves with VPNs nor opt out of marketing cookies.'

A significant number of people do make the choice when given it. I routinely do. As do many others. I have read up on my rights and thus have informed myself.

You have obviously expressed an informed consent in having your data shared with whomever wants it and can make a case for it.

The question is - should that consent be assumed? I think not.

There is a point about who the data goes to. As one respondent put it: Universities - good, Insurance Companies - DoublePlusUngood (I paraphrase a tad!).

So forced sharing with folk who are interested (and can only be interested) in it as bulk, anonymous data is I think justifiable. But it must be kept out of the hands of anyone with an interest in de-identifying it and would very happy for swingeing fines to fall on organisations that did that - or obtained the results. Such as insurance companies, employers etc. Not sure about which side of the fence I would put big pharma, perhaps I would be cautious and start them off on the wrong side.

I'm not saying there aren't flaws in this argument, but could there be a middle way through here?

I agree one hundred percent: pooling health data will improve medical outcomes (I speak as one with a number of ongoing health issues) but the problem is it looks like it's all or nothing.

"Mr Barnes, would you like us to submit your medical data to this company for the express purpose of researching that condition? It will be fully anonymised and will go no further than the research analysis."

Well, yes, maybe... but wait, isn't that company part of a group which is a wholly owned subsidiary of an insurance company? I don't really want to tell *anything* to an insurance company. Or indeed, start receiving adverts for that stunning new medical magazine "So You Think You've Got Problems".

The very companies who are doing the research are likely to be sponsored by the very people I don't want to talk to.

No such thing as genuinely anonymous health data. We all have a unique breadcrumb trail. If even part of that is public, we can easily be identified within the anonymous data.

This is what converted David Davis to the data protection cause - his health data is easily identified as he is one of very few people to have broken their nose 5 times. No reason to hide the nose breaking, but who knows what else is in his health record that he'd want to keep private.

Indeed, and for those with relatively rare conditions it becomes rather trivial to deduce who is who.

Exactly, and I'd say a vast majority still aren't clear about what they are giving up, when they use free online services or free wi-fi, hey, its free!

The technicalities of what is happening are so complex that even IT professionals and lawyers struggle to get to the bottom of exactly what is going on.

To this guy the cost of his data being abused is a small one compared to the potential benefit of a treatment being found that saves his life.

To someone who illegally re-identifies his data which is then sold there is money to be made but there is little cost if this act is found; maybe at worse a fine for his corporation. If there were large personal fines then someone who re-identifies data might not do this. Part of the problem is that most re-identification is hidden behind corporate doors.

I wish you well with your type-1 diabetes but ML/AI/Data sharing is not going to help. Proper funded research will. The data they take will be used by insurance companies.

Exactly,

This particular use case could basically be summed up as..

Hey GP practice we will give you $$$$ if you can find xx individuals meeting yy conditions who are WILLING to PARTICIPATE in a study.

Diabetic nurses and GPS will not look at this data. They look at my blood glucose spreadsheet and say on you must be in IT. Hospitals are the same. If a hospital was doing research they can have the data confidentially. Otherwise they are not getting it.

GPs yes.

If He listened to me. I was saying I wanted to go on medication which worked for me. The only issue I had was that higher sugar in the urine had its complications. Plastic surgery fixed that.

AFAIK, the NHS cannot refuse to insure you based on your medical condition. Same in Switzerland and the Netherlands for the basic package.

Health insurance isn't the issue. Imagine your car insurance having free access to your medical information and randomly bumping up your premiums because their oh-so-clever data analytics have decided that a slight elevation in your blood pressure puts you into a high risk category.

Or you not being able to go to college because the bank doesn't think your a good loan risk based on your DNA.

Gattaca movie.

There's a "currently" missing between cannot and NHS. Legislation should always be made on the basis of what is the worst that could happen in future.

There has to be a way to efficiently share patient data with researchers, but not with insurers and marketers. If there isn't, we really ought to invent it.

Unfortunately, the incentives for governments like the British one are to offer an all-or-nothing deal, because without the sweetener of life saving nobody would accept the harms.

I'm a type 2 diabetic with (currently) well controlled blood glucose. Having gone through a number of years of trying to control blood glucose with insulin before discovering that I'm lucky enough to be able to control my blood glucose levels pretty well with Metformin and diet, I have nothing but sympathy for those of you that need supplementary insulin. I found controlling blood glucose with insulin and a blood glucose meter to be extraordinarily difficult.

But that's sort of beside the point. The issue is should my medical data be available to drug companies and medical researchers? Of course it should. I'd strongly prefer it be anonymized Insurance companies? For population studies and other meta-analyses? Of course. For setting my personal policy rates. Probably not. But there would seem to be some room for discussion there. Should it be available to scumbag marketers (is there any other kind of marketer?) Hell no. And speaking only for myself, I'm in favor of jail time -- lots of it -- for those marketing types who will inevitably try to pierce the veil of anonymity.

But there is bugger all that data sharing can do for type 2. A full on patient present study is what is needed.

If there was a tablet which could reduce the stranglehold on my pancreas I would be interested. Currently meds like Metformin don't help a great deal.

Researchers pay my practice to get me onboard.

But there is bugger all that data sharing can do for type 2

Perhaps not. On the other hand, there is are researchers who contend that "Type 2" is very likely a heterogenous group of people with differing glucose handling characteristics who need different (and possibly in some cases no) treatments and that the way to sort THAT out is to assemble Continuous Glucose Monitoring data from "Type 2 diabetics" plus a reasonable number of purportedly "Normal" individuals. The contention is that once there is sufficient data. a spectrum of conditions and treatment approaches may well emerge. Possible result -- better (and cheaper) treatments. Insulin is expensive. And somewhat dangerous.

Wishful thinking? Perhaps. But how can one tell without data?

I feel for the author of this article. And he makes a sound, if somewhat emotionally charged, point that research done for the public benefit by universities needs access to data. But this debate isn't about just giving data to university departments, and I contend that the solution to this specific use case isn't selling all our medical records down the river to anyone, but to properly fund University research teams. So yes, the author's risk is greater from his condition, than their individual risk from their medical data getting out, but what about my individual risk? What about the individual risk of every single person in the country? What about the risk to society of weakening data protection laws to allow the sort of wholesale access to medical records that is implied by the idea of "implied consent"?

I do not think selling the medical records of everyone who hasn't been given a realistic opportunity to ask what the data will be used for simply because they haven't objected yet is a public good. I do not think "implied consent" is consent. And this is before you get to the problems of trust, that result in people failing to seek required medical attention because they cannot trust what will be done with the data the medics will need to treat them.

I personally am very much against this motion.

I'm against being blown up by a car bomb.

Does that mean I have to accept the Special Reconnaissance Regiment killing defence solicitors ?

Argument from absurdity. I'm against being blown up by a car bomb, so I support the sharing of information that lets me not get blown up by a car bomb.

As the Op puts it, we already share data. Insurers already have data. They have your date of birth, they probably asked you your weight.. They know where you live ergo they know your likely income. If they really cared they could probably work out what you had for dinner last night by cross referencing your recycling bin weight to a Tesco club card.

Our data is already bought and sold for profit. And we love it.

Er, that would be a big no! I block 2.5M known tracking domains on my network. I have de-googled my phone as much as is possible and block all tracking on the device that I can, don't give permissions that I don't think are relevant to an app etc.

My wife is non-technical, but is paranoid about being tracked. Without prompting, she came to me one day and ordered me to "de-google" her phone.

There is a growing minority of people on the Internet that treasure their privacy and don't want to be tracked and prodded at every turn.

interact with our “free” social media accounts, when we walk down the street, through a shopping centre or log on in a coffee shop, our data is grabbed. We give it up for free Wi-Fi.

Yeah, uh, no! Not me. Facebook & Co. are blacklisted at Chez big_D. Never use open Wi-Fi. Don't use any loyalty cards or apps etc. when shopping.

"I block 2.5M known tracking domains on my network." If that list is available for others to also make use of I'm sure beer tokens could be sent to yourself or a suitable charity as means of appreciation....

It is a collection of different lists on GitHub and similar places.

If you look on the PiHole forums, there are often lists of recommended lists.

While I have sympathy and wish you well, the assumption sharing data = more research is a fallacious one. So fallacious one could even consider it an all-purpose weasel argument along the lines of "you cold-hearted bastards, would you deny me salvation?".

I'm sorry, but as others already said, sharing your data won't cure you, all it will do is increase your insurance costs and prevent you from getting credit. What would actually help you is research , but that's a wholly different kettle of fish and has nothing to do with selling out peoples' health records. Research doesn't suffer from lack of population data, it suffers from a lack of funds and, for the pharmaceutical industry, the corporate will to tackle the commercially less interesting conditions.

Don't let your concern blind you, you're betting on the wrong horse here. This is unfortunately not the hope you're looking for.

– have at it – find me a cure.

The problem is that finding a cure is not profitable. Big pharma can make much more money by selling you medication that you have to take every day for the rest of your life rather than one off treatment.

If they somehow get access to health record, you could be sure that they will work on how to get customers dependent on the on-going treatment for as long as possible.

It's also possible that they'll find a cure, patent some intermediate methods and then shelve it so nobody else could use it.

For those who work with I.T. we are aware of the data we generate, the systems we use, how that data is used, the risks and choices.

I would argue that a good portion of the population do not know this.

The population must be educated properly as to what this means, how it works and the impacts and risks before they can make an informed choice. Debates of this nature suffer a large stumbling block at this point before they even get started.

I know... and I've sat down with my Mother and talked with her about it. We both opted out.

"big pharma tends to ignore these orphan diseases. Why bother when so few patients – customers – will get the disease? There is no market."

AND

"no big pharma company will invest in researching new uses for these old drugs, because without IP rights there is no profit to be made."

...are simply the symptoms of the disease which is thinking that market forces can solve everything. At some level we all know that some things can't be fixed by a market - that's why public healthcare exists in the first place. But what's needed is more publically funded research into rare diseases and re-use of old drugs for other diseases. Opening up everyone's data will benefit above all those who can source/buy more data and pay for the infrastructure to examine it - ie tilt the playing field further towards big pharma

"Public sector researchers – universities, for example – are also stymied. To carry out research on the effects of a mass-use drug needs data from thousands, if not millions of people. They can’t afford to run such research. - Yet the data is out there. Millions of people already take these drugs and their data is sitting there waiting to be examined."

At least 1 Covid vaccine was pre-approved based on a sample of no more than 20,000 people receiving the test vaccine. I would bet there isn't a single drug on the market today that needed millions of research subjects to get approved. On the contrary, preliminary trials are usually carried out on hundreds rather than thousands of people. It surely would not be that difficult or onerous for researchers to find a few hundred suitable subjects even with a reduced dataset of only those willing to give their data voluntarily, especially taking into account that people such as the author suffering from such diseases might be much more likely to share their data.

And again, if the problem is funding, the government should supply special funding to public sector researchers as an investment in reducing future healthcare costs. Moreover, voluntarily shared patient data coming from public healthcare should only be shared with public sector researchers, or entities who agree significant royalty reductions on discoveries made through that data.

Just because the dot-coms are nasty little shits and some tick who prostitutes their browsing habits for kicks also happens to be diabetic, is no argument to share everybody else's medical data by default. For a start, in case you hadn't noticed, national governments around the world are starting to clamp down on the nasty little shits you get your kicks from.

Doctors have for thousands of years sworn to patient confidentiality - in countries such as the UK, even the Long Arm of the Law struggles to unlock their records on convicted or suspected criminals. There is a very good reason for this patient confidentiality. Knowing a victim's medical records can help the less pleasant among us take malicious advantage. If patients cannot trust doctors to keep quiet about their vulnerabilities or incriminating hurts, we will not go to them when we need them. And it's not good for them either, as the profession would fall into disrepute.

Look, if you have a medical condition and are willing to risk every quack and used ambulance salesman knowing about it, by all means opt to make your data available to folks you never heard of and for uses you are never told. But if you expect it to be the default for the silent majority, you can [REDACTED] off.

"And the risks of someone stealing my health data (and doing what with it?)"

Refusing insurance based on your supposed health issues - from medical insurance to mortgages, employment, and beyond. Thats just the obvious use of it. It's the none obvious uses that we don't know about that are more worrying.

"I have no truck with anyone telling me, from the position of perfect health, what is in my interests." whcih is fine until you realise that you are telling everyone else without knowing what their interests are, they they should give up all their privacy in order to potentially benefit you....

If you don't give us your patient data, they will have to cut off your arms and legs.

Sadly, the fear argument still works.

The writer makes much ado about sharing and consent, but completely fails to mention 'assumed consent' or even the difference between opt-in and opt-out - which is the whole point of the debate.

Completely useless article that will do nothing for the 20% or so who agree with the debate's argument.

For the avoidance of doubt, I am one of the 80% disagreeing.

Sharing our health data, which, unlike our digital data, will be automatically cleaned, will revolutionise our healthcare. It will not be cleaned. Saying it is 'clean' or 'anonymised' is false. I would say that it is born from ignorance, but the frequency with which it is repeated, such as with the previous author's 'FOR' argument, leads me to start thinking that at best it is willful ignorance.

It will include at least the patients postcode and date of birth. How many people in the one postcode do you think would have the same date of birth? Add in what medical conditions they are suffering from and their gender - the data is useless without knowing that! - you have an easily identified person.

I only have one qualm with sharing my health data, insurance. The US heatlthcare system rewards insurance companies that deny coverage and claims. They get greater profits if the find ways not to pay out. If there was a legally level playing field for insurance purposes, I'll post my data myself in hopes that it would save 1 millionth of a life (not even mine}. The value of my private healthcare data is not what it contains, but the economic impact of it's unintended disclosure. Fix the structural issue and share away in my opinion.

This debate is drawing interest and input, but leaving aside the page views for El Reg, I like that it's happening and that arguments are being made both for and against the motion - both in the articles, and in the comments.

It's a nice addition to the tech news.

If a cure for our diabetes comes from sharing our data, we went be able to afford it, and we'll never get health coverage. We can enjoy those amputations early by not being able to convince an insurance company to help pay for our insulin, I guess

I'm diabetic. I'd rather risk my shared health data being stolen than a double amputation

You want my medical records? Good, take them – now find me a cure.

That sounds very much like an argument for Op-in rather than op-out?

If it was possible to change the data so that no one could be identified, and still retain its usefulness, then it should be automatically shared with an opt out option.

But that's so unlikely to happen, there's been enough errors in the past not to trust anyone who says they can do it, and as we understand more about "big data" it seems the ability to do so will become impossible.

Honestly I don't have an issue with health data shared between providers who need access to it. Prompt access to the right information can save someones life. Relying on the patient to relay health information and medical history if riddled with problems. And as Dr. House said all the time, "everyone lies!" for what ever stupid reasons.

What I have a problem with is the drive to make all this now "hard copy" available electronically. Not the fact that is is being made available electronically but that A LOT of the companies creating the software and systems to do this are totally incompetent! I have read article after article about the health care companies trying to implement these systems and the software they are implementing is just a hot mess! The software is riddled with bugs and the software vendors are slow if not reluctant to fix them. Some of these problem go so far as when you request data on a particular patient you get data from some other patient! Updates are not in real time or don't happen at all. Some hospitals have had to resort to pulling paper copies of files to get the correct data. All this at the cost of millions, to the point that punting these failed software companies out is not an option as the cost would be far to high!