licensing privacy consent hipaa unjust-enrichment
Licensing - can any intangible thing of value to which an individual holds exclusive rights be licensed?
<p>Provided an intangible thing is of value and an individual holds the exclusive rights to that thing of value, is there any limitation to what can and cannot be licensed? <strong>Can an individual license their consent for something that is usually freely given? Is prostitution a form of licensing of consent?</strong></p>
<h3><strong>Background</strong></h3>
<p>Through an usual set of circumstances, I recently stumbled upon something a health care provider is doing with the health information of its patients, including my own. These are the most pertinent details:</p>
<ol>
<li>What they are doing is probably unlawful to begin with</li>
<li>Without consent, they must delete the health information</li>
<li>Deleting the health information will cost several thousand of dollars per patient</li>
<li>These are very bad people who deserve what is about to happen</li>
</ol>
<h3><strong>Consent-based health information brokerage</strong></h3>
<p>This got me thinking:</p>
<ol>
<li>A patient could expressly refuse to consent to the use, requiring deletion of the health information.</li>
<li>The deletion will cost several thousand dollars</li>
<li>Rather than require the performance, the patient could sell a License back to them for say, 50% of the cost of deleting the records.</li>
<li>The health care provider will of course initially refuse this arrangement, but will eventually come around</li>
</ol>
<p>Obviously, the key issue here is express refusal without enforcement means consent has no licensing value.</p>
<p>The market value of a consent-based License being fixed to the cost of deleting the records. As a consent-based broker, I would charge a 10% brokerage fee.</p>
<p>Everybody wins, except the health service provider, who now learn a valuable lesson that just because they were getting something for free did not mean it was worthless.</p>
<p><strong>Is it possible for me to be a consent-based health information broker? That is, sell a consent-based Enterprise License back to a health provider so that they can <em>continue</em> to use people's health information?</strong></p>

<p>You could offer to sell your own consent to use your records to a healthcare provider, and collect if the provider agreed. But that wouldn't make you a "broker" as I see it, only a one-tiem seller. To be a broker you would somehow have to convincew many others to let you act as their agent in selling such consent to various providers,at some sort of commission. I don't see why anyone else would hire you to do that.</p>

<p>The value,of your records, by the way, would be not the cost of deletion (which would be rather small) but the potential income to be earned by retaining your records. But the incremental value of any one patient's records would probably not be large.</p>

<p>If the provider has used your information in ways that are unlawful, you could report this, and the provider might be fined. But that would put no money in your pocket. Offering not to report for a fee would be extortion (blackmail) a felony.</p>

<p>If the provider has de-identified (aka anonymized) records they may be used freely. Specifically, under the <a href="https://www.hhs.gov/hipaa/for-professionals/privacy/laws-regulations/index.html" rel="nofollow noreferrer">US HIPPA privacy rule</a>:</p>

<blockquote>
  <p><strong>De-Identified Health Information.</strong> <em>There are no restrictions on the use or disclosure of de-identified health information.</em> De-identified health information neither identifies nor provides a reasonable basis to identify an individual. There are two ways to de-identify information; either: (1) a formal determination by a qualified statistician; or (2) the removal of specified identifiers of the individual and of the individual’s relatives, household members, and employers is required, and is adequate only if the covered entity has no actual knowledge that the remaining information could be used to identify the individual.</p>
</blockquote>

<p>The HIPPA rule does not require a person's consent for that person's records to be de-identified, as the purpose of the rule is to protect the privacy of patients, not to allow them to make money from their information. Specifically, HHS says:</p>

<blockquote>
  <p>The Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”) establishes, for the first time, a set of national standards for the protection of certain health information. The U.S. Department of Health and Human Services (“HHS”) issued the Privacy Rule to implement the requirement of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).1 The Privacy Rule standards address the use and disclosure of individuals’ health information—called “protected health information” by organizations subject to the Privacy Rule — called “covered entities,” as well as standards for individuals' privacy rights to understand and control how their health information is used.  </p>
</blockquote>

<p>Moreover, PHI can be used without de-identification and without consent for severla purposes under the HIPPA rule, including "Health Care Operations" and "Public Interest and Benefit Activities". The rule says:</p>

<blockquote>
  <p>Covered entities may rely on professional ethics and best judgments in deciding which of these permissive uses and disclosures to make.</p>
</blockquote>

<p>I am not clear as to whether training employees on equipment so that they can treat patients would come under  "Health Care Operations" or "Public Interest and Benefit Activities", but it might.</p>

<p>The statements in the question about the cost of deleting a given patient's records are implausible. The exact effort required would depend on the design of the database system, but unless it has been designed in a highly inefficient way, a simple script that took as input a patient ID and deleted all records of that patient, could be devised once in a short time by a DBA or other database professional, and used without change thereafter. Even fully manual deletion would probably require no more than say 20-30 hours by an entry level tech, at a cost in salary of a few hundred dollars at most. De-identifing data is also not a high-cost operation -- I have had occasion to do it myself. One simply replaces in a copy of the DB each patient name with "TestPatient0001" "TestPatient0002" etc, and makes similar replacements for each of the other identifying indicators. A very repetitive and easy to program change.</p>

<p>In short, i don't think the prospect of getting a healthcare provider to pay a sizable sum for consent to use a single patient's data are large, although it would be legal to make an offer.</p>
