No Free Lunch: The Hidden Value of “Free” Data Sharing Arrangements

Few industries have been spared from the disruption of technology. Healthcare, arguably one of the last holdouts, has increasingly come into play in recent times. Alphabet, parent company of Google, is no stranger to testing out the waters of various industries, seeing if its penchant for data analytics can unearth new profitable opportunities.

In 2016, Google’s eyes turned to patient health. Could Google develop models and algorithms to predict health outcomes for patients? Or better yet, could Google use data and health professionals to design treatment plans to improve patient health? Google’s ambitions in the healthcare space are clearly outlined in a 2019 press release[1] by Mr. Tariq Shaukat, Google Cloud President. Although Google’s core businesses are undeniably built on algorithms, a treasure trove of health data would be needed to develop and train models for these noble goals. Health data is the fuel that feeds algorithms, trained and predictive models, and artificial intelligence. With the advent of electronic health records, there has never been a better time to attempt this feat.

In 2016, Google entered into Data Use Agreements with at least two hospitals: University of California-San Francisco (“UCSF”) and the University of Chicago (“UChicago”). In each of these agreements, the hospitals agreed to supply patient data so Google could develop and train models that could predict patient readmissions, deaths, and other outcomes. Public reception of these agreements has, so far, been mixed. As of April 2020, UChicago faces a classaction lawsuit stemming from the alleged lack of patient consent and privacy violations.[2] While the alleged violations of Health Insurance Portability and Accountability Act (“HIPAA”) are decided in the judicial courts, hospitals are attempting to mitigate the damage in the court of public opinion. HIPAA plays an important role in the advent of data use agreements; such restrictions make health data more difficult to obtain, thereby increasing its value. The question of a patient’s right to control their data, and how much control they should rightfully exert, will be a critical development in determining the balance of power (and value) in data sets.

Numerous news stories and published articles have suggested that patient data was provided by the hospitals in such agreements for no consideration in return. The authors of this article would contest this latter point—from a valuation standpoint, it appears non-monetary consideration was received in exchange for patient data as illustrated in Figure 1. That is, health systems do not appear to be giving something away without obtaining something of value in return (e.g., see Figure 2). In exchange for approximately 1.4 million patient records, UCSF primarily received publicity benefits, as well as the opportunity to send internal data scientists to Google’s facilities for educational opportunities. By contrast, UChicago retained a perpetual license to utilize the “Trained Models” and “Predictions.” Should the models prove even somewhat effective, UChicago could benefit from improved patient health forecasting. Future monetary benefits could range from increased reimbursement from insurance payors for achieving quality goals (or sidestepping penalties) to avoiding costs associated with prematurely discharging flagged high risk patients. Even absent these value components, we have observed that providers will pay explicitly for trained models.

Possibly the most publicized story regarding the sharing of health data regards “Project Nightingale” between Ascension Health System and Google.[4] Recently, U.S. senators have demanded information from Ascension and Google detailing exactly what information was provided and what services Ascension expects to receive in return.[5]

We may soon have a better idea of what sort of healthcare data is available to technology companies. On March 9, 2020, the Centers for Medicare and Medicaid Services (“CMS”) released its Final Rule related to Interoperability and Patient Access (“IPA”). These sweeping regulations would require healthcare systems, hospitals, and other providers to implement and maintain a secure database, built on standardized platforms, where patients can access their own data—free of charge. This regulation threatens healthcare providers’ current status as sole gatekeepers of patient health data, as patients would be free to easily share their standardized data with whomever they please. While similar regulations have been proposed before, IPA arguably goes further than past proposals in promoting access to data. The timing may be perfect; with the current events surrounding COVID-19, there has rarely been a stronger desire to push forward healthcare goals at the expense of historical bureaucracy, testing and vetting processes, or other traditional safeguards. Nevertheless, COVID-19 has also driven CMS to delay implementation and enforcement of certain components and provisions of IPA, insulating healthcare providers from the democratizing effect of this new change for a while longer.

While the above agreements may invoke controversial feelings, we are observing big data being deployed in light of the COVID 19 pandemic to achieve multiple goals. Providence and Microsoft are leveraging their existing relationship to map out immune responses to COVID-19, and to assist in the development of a vaccine.[6] Big data is also being used to forecast afflicted populations, which will help healthcare providers anticipate demand for beds, supplies, and workforce.[7] Other applications of big data can evaluate the effectiveness of social and public health measures (e.g., social distancing) in the fight against COVID-19.[8] Our firm previously explored the topic of data set valuation in our article titled, “Bytes to Bucks: The Valuation of Data.”[9] Data set transactions can be subject to Stark Law, Anti-Kickback Statute and/or Private Inurement regulations (for non-profit hospitals), depending on the circumstances of a particular transaction. Some state-level equivalent statutes can be more stringent than federal ones—California is a notable example of this.[10] Healthcare systems should be cautious when entering into data use agreements, as electronic health data may intrinsically have value, even in absence of an exchange of cash. In the hands of technology companies, datasets will need to be accurately appraised, especially since scrutiny of these agreements may continue for the foreseeable future. On the other end of the transaction, the resulting trained models, artificial intelligence, or licensing agreements derived therefrom should also be carefully appraised, to ensure the intellectual property exchanged represents equivalent, fair market value.