Since 2020, 30 of America's largest hospital systems have pooled the de-identified clinical records of more than 130 million patients into a single for-profit entity: Truveta, Inc. Truveta's stated mission is to "save lives with data." The business model is a tad more specific: sell de-identified patient data to pharmaceutical companies, medical device makers, AI companies, and life science researchers. Truveta does not publicly disclose their pricing, but estimates provided for even 100,000 records from their corpus of millions is in the six-figures annually. A more cynical writer would now note that this effort began at the time when many hospital systems were financially struggling due to the effects of COVID-19 on high-margin elective procedures. But Truveta is hardly unique.
Discussions of patient data rights typically start and end with HIPAA. Yet, almost none of the 130 million patients in Truveta's dataset would know what the dataset is, what their data is being used for, or when any such paid transaction happens. None of them will receive a check. Data is this generation's oil, and we need a foundation that goes beyond right to access and fragmentation toward right to ownership and centralization.
HIPAA is Insufficient
Most patients assume their medical records belong to them. They don't. In the majority of states operating under federal default guidelines, the record belongs to the provider or facility that created it. What HIPAA confers is access: under 45 C.F.R. §164.524(a), "an individual has a right of access to inspect and obtain a copy of protected health information about the individual in a designated record set." Federal courts have been explicit, and hospitals would claim they are equally explicit: in Dinerstein v. Google, LLC, the Seventh Circuit affirmed on appeal that "state law doesn't grant property interest in medical records, which belong to the provider." The case referenced the University of Chicago's standard patient admission form, which says: "I acknowledge that such research by the University of Chicago Medical Center may have commercial value and, in that event, I understand that I will not be entitled to any compensation, regardless of the value of such research or any products or inventions developed therefrom." In practice, this admission fine print is mostly a nicety. Patient data can be licensed, sold, and shared with commercial third parties without patient notice, without any consent, and without any revenue participation. The key is de-identification. Once that threshold is crossed, the regulatory regime disappears: under the Code of Federal Regulations, "...do not apply to information that has been de-identified in accordance with the applicable requirements of §164.514." Strip 18 enumerated identifiers and what remains is no longer protected health information (PHI).
The law was designed for a different world. When HHS published the final Privacy Rule in December 2000, it framed the de-identification carveout as a mechanism to "strike a balance when public responsibility supports disclosure of some forms of data — for example, to protect public health." Regulators were thinking about cancer registries, public datasets, and epidemiological monitoring. Not a hospital system licensing a 40-million-patient EHR dataset to a company at nine figures. We now live in a time when AI's inferential power and real-time search capabilities mean it can easily cross-reference quasi-identifiers to re-identify patients, a striking departure from the total anonymity the law’s authors envisioned. As U.S. pharmaceutical companies' ad spend crosses $25 billion this year, de-identified datasets once meant for research could become a new source of targeting and intrusion into personal life.
The Feudal Arrangement
Significant trust is placed in the clinician-patient relationship to ensure good stewardship of data, and perhaps hospital systems may be able to ethically profit from that stewardship. Does this also extend to EHR companies? Since the end of paper charts, hospital systems have outsourced the processing and management of data to software companies like Epic Systems and Oracle. In 2019, Epic launched Cosmos: a dataset integrating charts from over 300 million patients at more than 2,000 hospitals. Five years later, the company launched Showroom as a new hub for third-party vendors after shutting down its earlier app market, Orchard. Access to either system requires full disclosure of one’s objectives to Epic, not the hospital, and is subject entirely to the former’s approval. Meanwhile, Epic is simultaneously building its own products and has a developer reputation for absorbing the ideas it encounters through its vendor relationships. What research can be conducted and what can be built for patients is being decided by an entity many would call an aggressive, controlling monopoly that formed mostly due to circumstance and chance. This can stifle innovation, and startups have had poor experiences with Epic in particular. A startup seeking to build a predictive sepsis model today must negotiate with individual hospital networks, purchase from brokers at commercial rates, or attempt access through a gate controlled by a direct competitor.
The result is a feudal arrangement. Health systems are the lords. EHR vendors are the overseers. Companies are the paying tenants. Patients are the serfs: the source of the raw material that powers the entire economy. Our federal laws and lack of patient rights encourage the hoarding and control of data in what the tech industry calls “walled gardens.” In addition to Truveta, there is Veeva Crossix, Symphony Health, and many more. The Mayo Clinic Platform is pursuing its own consolidation. During the COVID-19 pandemic, petabytes of crucial epidemiological data sat locked in siloed systems, and the value of speedy national access for data-driven public health insights became obvious.
Systems trained in these conditions pay the price. A tool built to detect pneumonia from chest X-rays with strong performance at Mount Sinai failed to generalize because it did not have data from other institutions, representing a real risk of harm. Pediatric, rural, and minority populations are systematically underrepresented. Our algorithms reflect the walled gardens that built them.
A National Data Trust
De-identified patient data represents the accumulated clinical record of America's lived health experience and can be made robust by being legally mandated to pool into a secure, federally administered National Health Data Trust. Think of it as a commons that enables research, discovery, and commerce. Every HIPAA-covered entity would be required to contribute de-identified records on a rolling basis. Qualified researchers, public health agencies, and academic institutions would receive direct access while commercial entities could receive tiered access with meaningful revenue share. The walled gardens built through consolidation, monopolization, and chance would be democratized and unlock major innovations. A startup in Omaha would have the same access to training data as a subsidiary of a major technology company in Silicon Valley. Models trained by researchers from different academic centers could now be directly compared. Competition would shift from who hoards the most patient records to who builds the best algorithm on top of them. And because the dataset would be mandated across all covered entities, even our largest academic centers today would benefit. The result would be the first genuinely representative training corpus for clinical AI in American history.
Licensing revenue from the Trust could fund a direct dividend to patients whose records contributed to commercial model development, or society-at-large. Research indicates that direct monetary compensation is a meaningful incentive for individuals to share high-quality, longitudinal health data, and that compensation is positively associated with data completeness and participation rates. This dividend could take several forms: direct payments, reductions in insurance premiums, or contributions to federal health program funding. Today, one startup is pioneering a private experiment on this idea, becoming a data vendor by paying patients directly for consented-to identified health records.
The Genome We Almost Lost
In the late 1990s, a private company called Celera Genomics intended to sequence the human genome before the publicly funded Human Genome Project. Driven by familiar concerns about a government process being costly, slow, and bureaucratic, founder Craig Venter aimed to assemble the entire genome by 2001 and lock the data behind subscriptions, patents, and paywalls. The public project and Celera raced, and Celera was able to patent a few hundred genes. The consequences of Celera's brief intellectual property hold were measurable. Genes initially sequenced by Celera and held under IP saw reductions in subsequent scientific research and product development on the order of 20%-30%. In March 2000, President Clinton and UK Prime Minister Blair jointly declared that the human genome sequence should be made freely available to scientists everywhere. Celera eventually donated its database to the public domain.
Our collective health records are America's digital phenome and are as foundational to the next century of medicine as the genome was to the last. Today, we are allowing that phenome to be enclosed by a consortium of hospital networks and EHR vendors who inherited this data through the accidents of market consolidation and political know-how, not through any act of discovery or innovation. The companies that built the modern EHR gave us a generation of administrative overhead that consumes nearly a third of every healthcare dollar. These are not the institutions we should trust to govern the AI infrastructure of American medicine. The genome fight was settled by political will, not by waiting for the market to self-correct. The clinical data fight will be too. The only question is whether the physicians, researchers, and patients who understand what is at stake are willing to say so loudly enough for Washington to hear — before the walls get any higher.
