The Council of Europe invited us to address a meeting of the Steering Committee on Bioethics and to talk about the processing of patient data. The main point at issue was to determine whether it was necessary to have a regulatory framework, and if so what kind. Our position is that handling health data without a valid set of rules is not in the interests of a national health system.
There is widespread interest in health data. A number of institutions want to have access to such data, and present various arguments to justify their claims. Some of these claims are in competition with one another, and patients sometimes derive no benefit. There are two essential aspects that need to be borne in mind when assessing the need for a regulatory framework. The first is the motivation behind the interest. The second concerns the degree of health data detail which is needed to respond to the different requests.
Motivation may be of a medical or a non-medical nature. If the motivation is essentially medical, the primary concern will be to prevent any impairment to the health of the individual or group of people, or to eliminate it. The non-medical motivation involves the development of products, processes and systems which promote and support all activities that are carried out in the interests of the individual's health. Although the boundary between the two is fluid, most institutions operating in the Swiss health sector can be allocated to at least one of these motives. A doctor who diagnoses and treats a case of flu is acting for medical reasons. An IT company which develops and markets a patient data management system is acting for non-medical reasons. A health insurer in most cases would belong to the second category, since it is not actually providing the patient with medical treatment, but it is responsible for financing that treatment. However, insurers are increasingly insisting on the right to determine the kind of treatment to be provided with a view to optimizing costs. This example demonstrates that the same institution may be acting for both medical and non-medical reasons when it tries to access health data.
The second aspect concerns the level of detail or volume of health data required. This is far more difficult to determine. There are of course justified claims, just as there are unnecessary interests. Although essential data may be acquired for a very specific purpose, enormous efforts are made to hoard a vast amount of dispensable and superfluous data, for the simple reason that reducing the amount of data to what is really needed is either time-consuming or involves a loss of prestige. Data processors, whether they are a member of the health staff, an IT company or a health insurer, should restrict themselves to collecting only the amount of data that is truly necessary for their specified purpose. This limitation, however, must be transparent both for the data processor and the patient, and must not be applied in an arbitrary manner.
If society is not prepared to allow access to health data to be restricted to those who are persistent enough to demand it, we need to have binding rules establishing the rights and obligations of those involved in the processing of particularly sensitive health data.