Health data research yes – but with data protection, please!

A difference of opinion on government policy? There doesn't seem to be one when it comes to the question of how health data should be used for medical research. And that is a bad thing! Black-Red and former Federal Minister of Health Jens Spahn pursued the same plans as the previous traffic light coalition with Minister Karl Lauterbach. It is foreseeable that a future federal government will not pursue any other goals: Our health data generated by doctors, hospitals and other healthcare professionals should be able to be used for so-called secondary purposes – Patient confidentiality or not.

Eine Einschätzung von Thilo Weichert

Aktuell ist Thilo Weichert Co-Vorsitzender des Vereins Digitalcourage und engagiert sich für den Datenschutz. Von 2004 bis 2015 war er Landesdatenschutzbeauftragter von Schleswig-Holstein.

The Ministry of Health has presented a draft "Ordinance on the Implementation of Procedures at the Health Research Data Center" (Health Research Data Center Ordinance – FDZGesV), in which data protection and patient confidentiality fall by the wayside.

The legal basis for this regulation is the Health Data Utilization Act (GDNG), which came into force in March 2024. This GDNG is based on the European Health Data Space (EHDS), which was agreed by the EU Council, Parliament and Commission in trilogue.

The basic idea behind the regulation is a paradigm shift in patient confidentiality: whereas health data could previously only be used for secondary purposes in exceptional cases or with the patient's consent, it is now to be made available to third parties without the patient having to be asked.

To protect this data from misuse, the data will be made available in a pseudonymized form, rather than with real names, in a Health Research Data Centre (FDZ) under the responsibility of the Federal Institute for Drugs and Medical Devices (BfArM). As basic data, the FDZ will initially store all billing data of the health insurance companies from their legally insured patients. Data from the electronic patient file (ePA), which will be introduced across the board from January 2025, will be added to this, unless patients object.

Masses of highly sensitive data will be stored centrally in the RDC. Comprehensive protective measures are therefore essential. These are not provided for in the EHDS and GDNG. Therefore, these laws are guaranteed to be repealed in the event of a review by the European Court of Justice or the German Federal Constitutional Court due to violations of fundamental rights. Anyone hoping that these deficits would be at least partially remedied by the implementing regulation will be disappointed:

1. Among other things, the following billing data is stored for each person with statutory health insurance: year of birth, gender, zip code, need for care, health insurance fund, insured days and status, treating doctor or facility, treatment type and date, admission and discharge date and reason, diagnosis, operation date, appointment referral, medication and prescription date, dialysis, delivery date. 92 characteristics are provided. Even with effective pseudonymization, a data record can be reassigned to the patient with little additional knowledge.
2. Data use is not only permitted for research purposes, but also for the development and testing of drugs, medical devices and treatment methods, even for training artificial intelligence, for political planning or for profitability analyses.
3. Applicants are granted access to data without having to provide proof of qualification, as are associations, the BMG or the pharmaceutical industry.
4. The application for data access only requires a few pieces of evidence; a data protection concept and information on the scientific methodology are not required. The non-profit nature of the data analysis cannot be established in this way.
5. Approval for data access is granted by the Federal Institute for Drugs and Medical Devices, which is also responsible for the FDZ. This is not an independent, specially qualified body, but an authority that is subordinate to the BMG and receives instructions from there.
6. The approval procedure is not transparent. From an application register to be published, patients cannot even begin to recognize whether their data is affected by data evaluation.
7. There is even no provision for subsequent independent monitoring of the access granted –, for example by data protection authorities –.
8. The accountability of data users is minimal: the results of a research project are only to be published in general form two years after its completion.
9. In the event of data misuse, access may be blocked for a maximum of two years. Possible criminal proceedings are dependent on an application by the patients. However, they cannot become aware of any misuse.
10. It is planned that more and more health data can be added to a personal data record, in particular data from the electronic patient file. There is no provision for patients to be able to obtain information about their data.
11. – In contrast to data held by doctors –, there is no right to refuse to give evidence and no protection against confiscation for researchers. Law enforcement authorities can make extensive use of this if necessary.

The draft regulation was published by the Federal Ministry of Health (BMG) without attracting much attention. However, a broad discussion about the plans for our health data is urgently needed.

Health data research should actually be welcomed

The idea of using our health data for medical research purposes is actually to be welcomed. Since coronavirus, we have known that there is not enough qualified data available for medical research. I would actually be happy to make my data available for this purpose. What would be needed is my certainty that it will not be misused. The draft FDZGesV justifies the fear that this will happen.

Since the state is not even beginning to fulfill its duty to protect, the only protection available to patients is to at least object to the transfer of data from their electronic patient file, as provided for under European law and by law.

The BMG can and must create the conditions for trusting the secondary use of health data by massively improving the regulation. This would not only be in the interests of the patients concerned, but also in the interests of medical research.

(olb)