How Health Care Data Acquisitions Could Affect Patient Privacy

A private equity firm is buying the data core divisions of IBM’s Watson Health.

You’re likely wondering, “why does this matter, and why should I care?” So let me explain.

Watson Health was put together in 2015 with the acquisition of Phytel and Explorys, two leading health care databases, followed by the purchase of medical image company Merge Healthcare and Truven Health Analytics.

The goal was to create an industry-defining approach to health care by combining the best health care databases with the power of IBM’s artificial intelligence division known as “Watson.”

Selling its core health care data division seems odd at a time when IBM’s competitors are buying up health care software firms. Oracle is in the process of buying Cerner and Microsoft is attempting to acquire Nuance Communication. Both deals are awaiting federal approval.

Whatever the reason for IBM’s decision, Francisco Partners is allegedly planning on using these assets to create a new standalone company. The deal will give Francisco Partners ownership of five significant health care information databases.

Few people outside of the health care industry will be aware of any of these companies and even fewer know the name MarketScan, but more of us should pay attention.

MarketScan is a decades-old database of health care information. It was originally created by Ernie Ludy, a former executive of Blue Cross Blue Shield, to help private self-insuring companies manage and reduce employee health care costs in 1981.

Ludy’s original goal was to create the most trusted name in health care information. To create the database, he collected anonymous patient data from employer’s insurance billing and claims reports and then developed a broader view so the company could make appropriate decisions about coverage and how to promote employee wellness.

Chevron, Ford, Hewlett Packard, General Electric and Walmart were some of the first companies to sign on. Today, MarketScan’s databases contain the health care data for over 270 million Americans. That is over 80% of the population.

The collection of patient data has been going on for decades, so why should we be concerned now? In short, the technology industry has exploded with mass amounts of data and the use of predictive analytics since the 1980’s.

Back then, it was easy to de-identify health care data from a patient’s personal life. Now, there is a whole industry of health care data mining companies that make connections to patient’s daily lives so businesses can market directly to patients.

In some cases, health care data mining enables companies to create dossiers on patients which can be sold for profit. If mass databases like MarketScan are added to this process, then any expectation of patient privacy could become obsolete.

MarketScan was created to help companies make better decisions for their employees while protecting health care privacy. Yet, it has been sold multiple times since its founding. Each time a company changes hands, there is the possibility of drifting from its historic values, thus opening the door to misuse.

The public assumes that under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) that health care information is private, but HIPAA typically applies to health care providers and insurance companies.

De-identified anonymous aggregated data is not fully protected under HIPAA. Thus, a company can attempt to mine data to make connections between the anonymous data and real people.

While Francisco Partners appear to be run by people with the intention of promoting the public good, what happens if MarketScan is sold again? On another front, Francisco Partners owns shares in GoodRx, so what would prevent mining MarketScan data for prescription-marketing purposes?

Considering these complexities and concerns, several actions need to be taken.

First, the health care information industry needs to be transparent and open with the public about how our data is being used and who might be buying it.

Not only does the industry need to be forthcoming but the public also needs to become better informed and pay closer attention. We must begin asking companies questions about how our data is being used and for what purpose.

Second, federal regulators and Congress need to work together to set up rules for how companies can use these databases.

MarketScan is not the only substantial health care database, and there is currently very little government regulation for what kind of research and marketing can be done with them.

In addition, policy makers need to evaluate how this data is traded and sold to ensure the industry is not taking advantage of vulnerable patients.

We are seeing health care information companies bought and sold at a staggering rate, with the Global Big Data Analytics in Healthcare Market projected to be worth more than $79 billion by 2028, which would be a nearly $60 billion increase from its 2021 valuation.

Everyone acknowledges the ongoing challenges with health care and no one wants to slow down progress toward solutions, but policy makers need to take a serious look at what is going on before the industry runs amuck.