EU plans allow Big Tech to exploit your medical records, without permission

The EHDS would make physi­ci­ans and other medi­cal profes­si­o­nals compli­cit in the forced commer­ci­a­li­sa­tion and mone­ti­sa­tion of every aspect of your health without ever asking for your consent. It would destroy the Hippo­cra­tic oath of confi­den­ti­a­lity by which every medi­cal profes­si­o­nal is suppo­sed to be bound.

In May 2022, the Euro­pean Commis­sion propo­sed the Euro­pean Health Data Space (EHDS) in an attempt to improve the ways in which people’s sensi­tive medi­cal data is made avai­la­ble for vari­ous kinds of uses.

That inclu­des the ability for hospi­tals and physi­ci­ans to share infor­ma­tion about current pati­ents with expert colle­a­gues abroad. For exam­ple, it’s suppo­sed to make it easier for a GP in Sweden to receive a digi­tal copy of their Roma­nian pati­ent’s CT scan results from the radi­o­lo­gist in Roma­nia in order to conti­nue treat­ment.

The EHDS also propo­ses to legally compel hospi­tals or physi­ci­ans to hand out your medi­cal records to a newly crea­ted govern­ment agency, which in turn, can allow access to anyone who claims a rese­arch inter­est. That inclu­des not only acade­mics but also phar­ma­ceu­ti­cal compa­nies, well­ness app star­tups and even data harves­ting Big Tech corpo­ra­ti­ons like Google and Face­book.

Your medi­cal records include details of physi­cal, mental and sexual health, drug and alco­hol history, and any family and work-rela­ted problems that you thought you’d disclo­sed in confi­dence to your physi­cian only. What’s worse is that the infor­ma­tion in medi­cal records is almost impos­si­ble to effec­ti­vely anony­mise, meaning it’s rela­ti­vely easily iden­ti­fi­a­ble as yours.

That is why 75 percent of Euro­pe­ans said in a recent Ipsos poll that they are only willing to grant rese­ar­chers access to their medi­cal records if they have been asked for their expli­cit consent, and that’s what the EHDS should require.

Big Tech is on the move

Without such a consent requi­re­ment, Google, for instance, could obtain access to the details of your cancer treat­ment or the results of your last psychot­he­rapy session to train its new AI for some well-being app. And the outcome of that might feed into the company’s adver­ti­sing busi­ness.

If you don’t like that, you are in bad luck: the EHDS does not fore­see pati­ents being asked for their permis­sion; it does not even include a right to object to this kind of exces­sive data sharing.

Your medi­cal records contain infor­ma­tion about all aspects of your life. From the moment you were born, through child­hood, puberty, and every sick leave, mental challenge, and other health issues you ever had. You should be the one in control of it.

More than a dozen orga­ni­sa­ti­ons repre­sen­ting pati­ents, medi­cal profes­si­o­nals, persons with disa­bi­li­ties, consu­mer and digi­tal rights orga­ni­sa­ti­ons, as well as workers and trade unions have writ­ten to members of the EU Parli­a­ment, urging them to intro­duce the consent requi­re­ment in the health data propo­sal. This is crucial for protec­ting pati­ents’ rights and ensu­ring that they have control over the use of their private medi­cal records.

Bye bye Hippo­cra­tic oath

The EHDS would make physi­ci­ans and other medi­cal profes­si­o­nals compli­cit in the forced commer­ci­a­li­sa­tion and mone­ti­sa­tion of every aspect of your health without ever asking for your consent. It would destroy the Hippo­cra­tic oath of confi­den­ti­a­lity by which every medi­cal profes­si­o­nal is suppo­sed to be bound.

The global tech industry is only waiting for the oppor­tu­nity to get their hands on Euro­pe­ans’ medi­cal data. Apple alre­ady has an exten­sive “digi­tal health” offer and, in 2020, Google paid over $2bn [€1.82bn] to acquire health device maker Fitbit in an attempt to enter the health data market.

Google’s acqui­si­tion of Fitbit demons­tra­tes the huge mone­tary value health data has, even to compa­nies who do not contri­bute to public inter­est medi­cal rese­arch, and why it should never be shared with third parties without your consent.

Not forget­ting govern­ments and cyber-crimi­nals

Your medi­cal records are not only of inter­est to corpo­ra­ti­ons. Once stored in central, state-run data centres as the EHDS propo­ses, they could just as well be misu­sed by your own govern­ment.

In Janu­ary 2023, Polish police raided a private gyna­e­co­lo­gist office in the city of Szcze­cin. The prose­cu­tor clai­med that “crimi­nal acts” had been conduc­ted in the form of medi­cal abor­ti­ons reques­ted by pati­ents. Poland has a de facto ban on abor­tion. During the raid, medi­cal records dating back as far as 1996 were confis­ca­ted.

Just imagine how easy it would be for the Polish govern­ment to perse­cute any woman whose medi­cal records contain the sligh­test indi­ca­tion that she might consi­der seeking an abor­tion, if every­body’s medi­cal data was held in a central data­base run by that same govern­ment.

And there is more: forcing the medi­cal records of milli­ons of people into a centra­li­sed data­base crea­tes an incre­dibly attrac­tive target for mali­ci­ous hackers around the world.

With this kind of inti­mate infor­ma­tion, common crimi­nals can extort ransom from you by thre­a­te­ning to expose your medi­cal details. Just last year, a crimi­nal ransom­ware gang broke into the medi­cal data­base of a health­care systems provi­der in the US and star­ted publis­hing nude pictu­res of female breast cancer pati­ents on the inter­net after the provi­der refu­sed to pay the ransom.

Medi­cal rese­arch is incre­dibly impor­tant and often relies on access to such data to deve­lop new medi­ca­tion and advance our unders­tan­ding of the human body. But whoe­ver wants to do that rese­arch must always ask for your permis­sion to use your data first. Ideally, they should be obli­ged to rele­ase their rese­arch results back to the public, so that it can be of maxi­mum common value to us all.

EU lawma­kers there­fore must amend the EHDS in that sense, so that we can conti­nue to entrust our physi­ci­ans with the most inti­mate details of our physi­cal, mental and sexual health.

This arti­cle was first publis­hed here by EUob­ser­ver.

Contri­bu­tion by: Jan Penfrat, Senior Policy Advi­sor, EDRi & Dr Silke Lüder, Deputy Chair of the Asso­ci­a­tion of Inde­pen­dent Doctors Germany (Freie Ärztes­chaft e.V.)