Who Controls Health Data? HIPAA, De-identification and Research Consent

Data access is not the same as unrestricted ownership

The HIPAA Privacy Rule provides an individual access right to protected health information in a designated record set held by covered entities, subject to exceptions. That right is important but not a universal guarantee to every dataset, proprietary analysis, research model, or derived statistic. It also does not mean every company holding wellness information is a HIPAA covered entity.

Any legislative effort promising that participants 'own their data' needs to translate that idea into specific rights: access to defined records, portable exports, control over particular uses, auditability, limits on onward transfer, or compensation and remedies for misuse. Otherwise ownership can become a slogan without an accountable counterparty.

Pseudonymization is not automatically de-identification

Replacing a person's name with a code, token, or account identifier can be valuable for confidentiality. But whether information meets a HIPAA de-identification standard requires the applicable method and assessment, not simply a new identifier. HIPAA guidance recognizes expert determination and the Safe Harbor method, with additional rules for certain re-identification codes.

Genetic variants, dates, rare conditions, and linked behavioral records may create re-identification risks even when direct names disappear. A publicly readable blockchain should not be assumed to be a safe place for raw genomic or biometric information. An architecture can preserve an auditable permission receipt without storing identifiable health data on an immutable public ledger.

What happens after de-identification?

HHS guidance explains that properly de-identified information is generally no longer protected health information under the HIPAA Privacy Rule. That can create a gap between what an individual expects a research platform to honor and what HIPAA itself requires of a downstream recipient. Contractual duties and other applicable laws may still apply.

This is why a Right to Research proposal interested in continuing participant control needs to consider obligations that follow data transfers, permitted research purposes, recipient accountability, and possible restrictions on commercial training. The platform's technical ability to record choices and the law's ability to enforce those choices are separate design problems.

A more realistic architecture for participant choice

A promising model separates identity custody, study-specific research data, permission receipts, and access credentials. Sensitive observations can remain encrypted off-chain, while authorized researchers receive access for defined projects. An optional local biometric unlock could protect access to a participant account without turning a fingerprint or face into a public research identifier.

Withdrawal should have intelligible limits and provide meaningful forward-looking controls. A system may stop future sharing or model training under an enforceable agreement while retaining safety records or being unable to unpublish third-party copies. The Hypatia and hyJournal concepts on this site are design proposals, not claims that such a regulated platform is already operating.

Questions people ask