Skip to main content Skip to secondary navigation
Main content start

Michelle Mello: Patient privacy and the law are on a collision course

A rapidly shifting legal debate is raging in healthcare over patient data and privacy. One legal expert says that even though regulations have lagged, a reckoning is due.

What’s in those files? | ScienceSource/Christopher W. Morrow

What’s in those files? | ScienceSource/Christopher W. Morrow

How much control should patients have over who sees their medical records?

How readily should researchers share patient-level data from their clinical studies? In today’s world, should the answers to these questions depend on whether the data are “anonymized?”

These are but a few of the ethical and legal conundrums that Michelle Mello, Stanford professor of law and of health research and policy, grapples with on a daily basis. She says that rapidly evolving ways to gather and share medical data are exposing the limitations of laws that protect patient privacy.

Meanwhile, the value of sharing patient and clinical data is growing by the day. Data from multiple studies can be pooled to study subgroups or explore rare conditions that were once out of reach. It could help lower drug prices, too, or identify ways to treat patients with greater precision and efficiency. Mello says that reaping these benefits will require a national conversation about what patients are willing to trade off in terms of privacy and control over their personal health information.

Join Michelle Mello and host Russ Altman for a wide-ranging discussion of the ethical and legal challenges in healthcare on Stanford Engineering’s The Future of Everything.

Embed Code


Russ Altman: Today on the “Future of Everything,” the future of health and law.

The first thing many people think about when they think about how law and health intersect is malpractice. Physicians getting sued because patients feel that they suffered because the physicians did not provide appropriate care or did not deliver it in an appropriate way. Indeed this is an important area of the intersection between the legal world and the healthcare world.

But there’s much more, what are the best ways to regulate health insurance? What should we expect of our health insurers? How can we ensure that drugs and medical devices are safe and effective and get to patients in a timely manner? How can we create rules to guide the advertising about these drugs and devices so that people are aware of them but we don’t unduly influence their use? How do we guide biomedical research so that it is performed ethically and with the full consent of patients? How do we define the rules for sharing patient data so that we can benefit the healthcare system while also respecting the privacy of the participants? And how do these relationships all change in the era of the internet, digital devices and social media?

These issues all demand kind of a balancing act between the needs of individuals, the patients, the needs of the business concerns and the industrial players and of course the needs of society at large, particularly the government which serves as a major payer through government healthcare systems and also as a regulator.

Professor Michelle Mello is a professor of Law and Medicine at Stanford University. Michelle, you have addressed many of the issues at the intersection of law and health and one recent issue that you’ve published about is the attitudes of clinical trial participants towards sharing their personal data, how did this issue come to your attention and what did you find out about data sharing?

Michelle Mello: Well there has been a real movement within science to make sure that we get every possible bang for the buck that we spend on biomedical research. So there’s been a push by funders of biomedical research, by the journals, and many other forces to make sure that scientists are sharing their data with other scientists.

There’s been a sort of a backlash within some quarters, though, about the implications of that move for patient privacy and a lot of that opposition has been voiced by the pharmaceutical companies that sponsor a lot of clinical trials. They typically couch their objections in terms of wanting to protect the participants in their clinical trials, but it wasn’t clear to me what those participants actually want. Because no one had ever asked them.

Russ Altman: I see and so what did you do about that gnawing feeling that you had that this might not be the whole story?

Michelle Mello: We surveyed 771 current or recent clinical trial participants in three academic sites across the country we wanted to know how they felt about expanded access to their participant-level clinical trial data and what they perceived as the risks and benefits and overall were they willing to engage in that practice, having already volunteered for the clinical trial.

Russ Altman: And what did they say?

Michelle Mello: What surprised me was how overwhelming the support for this practice actually is among people who have volunteered for clinical trials.

Russ Altman: So specifically the practice of sharing the data?

Michelle Mello: Of sharing the data and what we’re talking about here is not sharing results of course everybody wants results to be made available. We’re talking about sharing the participant-level data after their name and certain other identifiers have been removed, and we asked them about a variety of people that might receive this data from other drug companies to academic scientists to members of the public who might be able to download it and a variety of ways in which it would be used and 82% of the sample felt that the positives associated with all these types of data sharing outweighed the negatives. Only 8% had a negative view. 93% were willing to share their own data with scientists in academic settings, and 82% with scientists in drug companies.

Russ Altman: Now of course when a drug company or anybody does a trial there’s a consent procedure and many times I hear people referring to the consent as one of the barriers. When you looked back at the consents that they had signed, were they in retrospect perhaps overly restrictive compared to what the patients would have agreed to?

Michelle Mello: We didn’t actually look at the consents that these patients had signed but having served on institutional review boards for clinical trials. I know that the practice has long been to assure participants that their data will only be viewed by members of the clinical trial team and certain people who are entitled to have disclosures made to them like government regulators.

That clearly needs to change and is already beginning to change to contemplate the sharing of the data much more broadly. In part because I think for scientists the main reason has been because the journals require that as a condition of publication.

Russ Altman: Right so just to step back a minute. Let’s go over why you would wanna share this data. So presuming that, let’s say the drug companies although I know this is also an issue for academic clinical trials as well, presuming that they disclose their findings and that we don’t believe there is fraudulent data going on. Is this checking to be sure that their calculations are correct? Or are there other unanticipated potential uses of this data, how should we think of the opportunity associated with the data if they were to be shared?

Michelle Mello: So I think there are two main opportunities, one is along the lines of checking to make sure it’s right. Interest in this area really began after the scandals about 10 years ago over Vioxx and a couple of other drugs. Whereupon a second look at the data it became apparent that the drug was actually a lot less safe than the pharmaceutical sponsor had let on and in some cases, there were some pretty glaring statistical deficiencies in the work and the feeling was if other scientists had had access to those data we could have prevented harm to patients much earlier.

Since then there’s a feeling that those practices have probably improved a bit. But there’s a broader concern within science about the ability to replicate studies. The so-called replication crisis in science. Where more and more it is being revealed that even good quality work by honest scientists often can’t be replicated when others try for one reason or another, and so this leads to a —

Russ Altman: And you don’t mean replicate as in reanalyzing the data you mean to try to do the same type of trial with a new set of patients?

Michelle Mello: Certainly that but also just reanalyzing the data sometimes we fail to reproduce the results. So again, there’s a feeling that if these data were more broadly available it might lead to greater confidence in the results that the public is relying on and maybe better practices in terms of statistical analysis and reporting.

So that’s one group of uses, but the second and maybe more exciting group of uses for patients has to do with exploring new questions. Pooling data across clinical trials for example to do more analysis of subgroups that were too small in any one trial to really learn anything about them. Or pooling data across trials to learn about rare conditions that aren’t possible to explore in a deep way in any one trial. So it’s the prospect of accelerating scientific discovery by making use of what we already have.

Russ Altman: Now when you talk to these folks, and I think you said 92% were pretty okay with it, 82% and even more were generally okay. Did they understand how restrictive the data agreements that they participated in were? And were they surprised that these things were not happening or did they not find that surprising? Or did you even address that issue?

Michelle Mello: We didn’t ask that directly but interestingly we did give them an opportunity to just write in comments at the end of the survey and over and over we heard things like, of course, they should be shared. If you don’t like that you shouldn’t be participating in clinical trials in the first place. That’s what I’m here for. So that reminds us that in some sense this is maybe a select group, these are already research volunteers and if you’re a person who really, wants to keep your data close to the chest you probably don’t volunteer for a trial in the first place.

But given that you are a research participant, I don’t think it came as much of a surprise to them that scientists would want to make maximal use of their data and indeed one of the most important functions of data sharing for them was making sure that their own sacrifice as a research participant, lead to some good.

Russ Altman: This is the “Future of Everything,” I’m Russ Altman, I’m speaking with Professor Michelle Mello about data sharing of clinical trials and patient attitudes towards it. What about let’s go down to the nuts and bolts of sharing. You can just put it on the web and let people download it but there must be other levels of security and I’m wondering particularly the different entities and if they should all be treated the same, and let me just be specific.

You said a pharmaceutical company runs a trial and they have some data, they could share it with academic researchers and there’s, patients might have some response to that idea. They could also share it with other companies either in the health space, but increasingly we know that these big tech companies that are not traditionally associated with being in the tech space. Also may have an interest in health as a new market for them, so what is the landscape of how sharing does work and perhaps how should it work.

Michelle Mello: Well here we’re beginning again I think to step out of the specific context of clinical trials because the issue you raise affects every single one of us as patients.

Our data has long been shared with a variety of companies without really our express permission, but they’re being shared in new ways and specifically more often with identifiers attached to them and more often in de-identified form with companies that are making radically new use of them particularly for the development of artificial intelligence in medicine.

Russ Altman: Right so, now help me I just want to make sure that we don’t get confused. The first part of our conversation was about companies saying we don’t wanna share the data, we have all these agreements that we won’t share it. But now you’re also pointing out that there’s often for healthcare in general, broad sharing. What are the differences and why do those two seemingly opposite situations, why are they both happening at the same time?

Michelle Mello: Good question, well in the first context, the situation is a drug company is trying to develop something new that it can sell and make a great deal of money on. Of course, it wants to preclude competitors from figuring out what it’s doing. They are racing to get to the patent office first and its interest is in not sharing data, with competitors at least until it has obtained patents around the world.

In the second instance, the data suppliers that we’re talking about are mostly not drug companies. It’s mostly hospitals, universities like Stanford and others around the world that have the one thing that tech companies can never beat them at which is access to patients. They, tech companies may be better than you and me at data analysis and analytics. Although probably not better than you Russ —

Russ Altman: Oh, they’re very good.

Michelle Mello: But they will never have access to patients and so they need hospitals and healthcare organizations and the question is what’s in it for the healthcare organizations. The answer may be money, but it may also be the development of new technologies that can help patients.

Russ Altman: Somebody listening to this might be very surprised to know that their data from a recent hospital visit may have been sold, should people assume that that is the case or are there protections? You know every year we get piles and piles of mails. About all the different companies that are so worried about our privacy that they are sending us email and hard copy mail you know outlining all the processes they undergo.

What do you tell somebody about the inherent privacy of their medical data at a hospital or at a clinic?

Michelle Mello: It may well not have been sold, but it very likely has been shared and again that has always been the case. Because hospitals have always needed the help of third-party companies to do business. Billing companies, process patient bills. Supplier companies and so forth and so the law. Our federal privacy statute called HIPAA allows those relationships to form pursuant to contracts called business associate agreements and once you have one of those contracts in place you can transfer patient data with names and all kinds of other data attached and the idea this is how we make, how healthcare organizations run.

Russ Altman: And so this is definitely facilitating care in a way that is reasonable and defensible.

Michelle Mello: That’s right, and what’s novel is two things that kind of maybe sit outside the intent of that federal privacy statute. One is the sharing of de-identified data, so as long as you strip out a bunch of information about us as patients that data sets are no longer covered by anything and you can do with it whatever you like. We know however that it’s increasingly easy to re-identify patients now with the computing capabilities that we have, and HIPAA simply didn’t anticipate that problem, the second thing that’s novel is the use of these business associate agreements. For all kinds of new partnerships aimed not at just processing bills or studying efficiency within the hospital, but at developing new kinds of products and algorithms that might improve care.

Russ Altman: And so there’s a gray area there where we’re slipping out of routine business use to new opportunities, and this might be with novel companies that are not traditionally in the healthcare business and may have a different sensibility about patients and what the business opportunities are?

Michelle Mello: Yeah I think that’s one way of looking at it. You know healthcare organizations may view things differently and say look we have always been in the quality improvement business and this is just a 21st-century form of that.

Russ Altman: This is the Future of Everything I’m Russ Altman I’m speaking with professor Michelle Mello. We’re getting a little bit into privacy rules and you mentioned the HIPAA Act which is an act in the U.S. governing this and I’m not sure we want to go into the details of that, although I’m sure it’s fascinating but what has also come to a lot of people’s attention is that Europe has introduced similar but I think more strong legislation, and there are mumblings about similar things coming out at the state level including California so what, how rapidly changing is the regulatory and governmental approach towards patient privacy and really individual privacy? It goes beyond health records.

Michelle Mello: I think it’s beginning to change. You know the Europeans as in most things are ahead of us in terms of anticipating social needs and responding to them with regulation.

But here in California too we’ve begun to evolve our law a new statute called the CCPA was passed in 2018 and it gives consumers the right to own their data and to opt-out of various uses of their data by other companies and to know the uses to which their consumer data are put. It only applies to large companies and companies that make a lot of use of patient data. But it still is kind of a paradigm shift from the old world in which if you as a business collect data, that data those are yours to do with as you wish.

What we haven’t seen a lot of movement in, is at the federal level, changing HIPAA for example. There have been some kinds of tweaks and clarifications. But I think the momentum for a federal privacy statute is just sort of beginning to bud.

Russ Altman: What do you tell, you mentioned something about an increasing move towards patient ownership. I’m sure people are still confused about this. Do I own my medical records? Can I request a copy of them? Is that the same as ownership, and how clear is the law about those types of issues? Because I think that especially in independent America we like to think this is our data, and we can control it. To what degree is that true?

Michelle Mello: Well HIPAA’s very clear about that and what happens when a state comes in with a law that says something different can be tricky. But you know in general, your healthcare providers are the owners of your data but you have an absolute right to access them, again you might have to pay five bucks for your copies but you’re meant to be able to get them without any interference.

Now in practice, we know that healthcare providers, all the time throw up the word HIPAA as a reason not to provide patients with information or to make them jump through all hoops and it’s mostly out of ignorance in low-level people within those organizations that are responding to these requests.

Russ Altman: So there’s a certain institutional perhaps inertia, or obstruction whether on purpose or not that makes it difficult sometimes to get this data, but you should be able to get it.

Michelle Mello: You should be able to.

Russ Altman: So, I want to go next to this idea of — and I know you’ve published about this. The advertising by the pharmaceutical industry. It’s a little bit of a switch but let’s say they do get clinical trials they either share their data, or they don’t share their data, and then there’s an issue of their role in advertising drugs and as I’m sure many people know for many years this was not allowed at all but now every morning, on the morning news you can see lots of commercials. What is the situation with that, and how fluid is it?

Michelle Mello: So we and New Zealand are the only industrialized countries in the world that allow direct to consumer advertising of drugs.

Of course, everybody allows advertising to physicians and that’s still the most important form of advertising that drug companies do.

But as we all know because we watch television, there’s a lot of direct to consumer advertising. It’s about a $6 billion a year industry, and it works, there’s a —

Russ Altman: It drives me crazy. As a physician I must say every morning I’m shouting at the TV because they say, ask your doctor if you have and then they list these incredibly technical things which it is precisely, no they say, tell your doctor and it’s like this is the doctor’s job to know and so it just irritates me but I’m, excuse me for that outburst.

Michelle Mello: A lot of physicians feel that way as they’re already dealing with the constraints of a 15-minute office visit and now some of that has to be devoted to explaining to the patient why they shouldn’t have expensive advertised drug X instead of an older generic alternative.

Russ Altman: This is the “Future of Everything,” I’m Russ Altman more with professor Michelle Mello about direct to consumer advertising and other health and legal interactions next on SiriusXM.

Welcome back to the Future of Everything, I’m Russ Altman I’m speaking with professor Michelle Mello from Stanford University and we were just starting to talk about this odd, at least it’s odd, except for New Zealand and the United States, the idea of directly advertising medications and medical devices to patients. So why did that change happen? And is there any data suggesting it was a good idea, bad idea or that everybody just ignores it and goes to their physician and talks about whatever they want to talk about.

Michelle Mello: Well drug companies were really pressing on the FDA and Congress to allow this because of two things that were going on. One is really a feeling that they needed another way to get information out there, and the second was in my view increasing signals from the court that so-called commercial speech. Speech about products and services that someone would like to sell you enjoys first amendment protection and restrictions on it would be unlikely to survive a legal challenge. I think those two forces together lead to a reconsideration of the traditional ban.

Russ Altman: And I guess it’s been 15, 20 years.

Michelle Mello: It’s been a while now yeah.

Russ Altman: Do we know if it has, they continue to do it so I’m going to assume that it has worked out financially for them and I’m sure they pay attention to this.

Michelle Mello: Yeah we know it works and they know it works. It has both beneficial and deleterious effects. The benefits are that it alerts patients to symptoms that they may not be aware have a treatment available now, in my view that’s a benefit that had more importance in the pre-internet era than when we can all type in our symptoms and get a range of medical information and treatment opportunities pushed right out to us. The deleterious effects have to do with encouraging patients to get on to expensive branded, meaning on-patent drugs. Where there are other alternatives available that have been in use longer and are much cheaper and probably as effective.

Russ Altman: And although this began as a radio and television thing. Because that’s what we had available, I think we all see these now direct to consumer includes internet and social media. Are there special considerations because then you could imagine that the search algorithms will target patients who are doing certain kinds of searches, it could be very precise the marketing. This could be a good thing because it could get the news to precisely the people who need it, what’s your sense of that?

Michelle Mello: Yeah it’s an interesting question, I mean legally there’s nothing particularly special about it but yes we’re moving into a world where when you post on Facebook about your gout acting up you are going to get advertisements for gout related products and services and that, like many other forms of targeted adverting just has a creepy factor for a lot of people.

Russ Altman: So this leads to the, and right before the break you actually mentioned that people are now coming in saying hey why aren’t I on this drug, Mr. Doctor or Ms. Doctor? And then the question is is there any evidence that this is causing problems in the patient-physician relationship? I think you mentioned that the physicians have a very short time they wanna address the real problems of the patient they are usually perfectly aware of all of the medical choices that they have. I know you’ve written about patient trust in physicians has that come into the dynamic or is it mostly about other things?

Michelle Mello: My sense is and you probably know better as a clinical physician is it’s mostly about time pressure and how the physician would choose to allocate the scarce minutes available in an office visit versus what’s on the patient’s priority list. When you’re already rushed through a visit to have to explain why the newest and greatest drug is not better than what the patient has been taking at a fraction of the price that’s probably not great for the physician.

Russ Altman: Yeah and there is an insidious, in some types of medical care there’s a terrible tradition that the interaction is not over until the physician writes on a little piece of paper or types on the computer I’m gonna give you this medication and that’s like a sign that the visit is over and that’s not very good because that’s not a good way to have to end the interaction.

In fact, it would be even better to say the good news is I don’t need to write you a prescription and we’re not gonna add any pills to your mornings and evenings, but that’s not the case. So this issue of advertising and really I think plays right into a very hot topic. Which is the affordability of medications and I know you’ve also written about that.

From a legal perspective, as you approach these issues, what are these issues about affordability and has there been any progress in trying to think about new ways to price drugs. We all know that we’re not allowed, I think we’re not allowed to go to Canada to get our drugs, so, where are we?

Michelle Mello: There’s been a huge amount of thinking about what to do about this issue. It was as of two years ago maybe one of the only issues where there was broad bipartisan agreement. I mean we’re talking about a congress that can’t agree on whether the planet’s warming right? But they agreed that something had to be done about this issue and so there really has been a very intense amount of work both within the congress, within agencies and outside in universities and other places and lots of great and interesting ideas on the table now, not much progress yet.

Russ Altman: Can you tell me what are the fundamental tensions? I think a simple-minded would be well the drug companies want to make as much money as possible, and other people wanna pay as little as possible. There are issues I know of incentivizing innovation for new drugs, there have been in the last few years, the introduction of truly amazing drugs.

Two examples would be we now have for many people with hepatitis C we have a perfectly good curative agent, which is priced in the hundreds of thousands of dollars. That’s on one end of the extreme, for a pretty common disease hepatitis C.

At another extreme, there are these very rare childhood diseases that are fatal. Where we now have million-dollar treatments, I’ve heard people say that society will go bankrupt if the drug companies continue being this creative and successful in creating treatments. What is the set of more sophisticated considerations to create an ecosystem that really works?

Michelle Mello: The central trade-off or tension that you’re raising here is between innovation and affordability or between affordability and availability, so there’s no doubt that at some level this has to be right. That if you eliminate financial incentives to develop new drugs for-profit companies and the investors that back them are not gonna be interested in pouring as much money into it.

The problem is we don’t really know how to quantify that trade-off. When a drug company says oh you know you can’t possibly reduce my margins, all innovation will cease!

That doesn’t seem plausible but I can’t give you a beta coefficient if you reduce profits by this much we’ll see this much less innovation, and then the other problem is even if I could you and I might not agree about what we’d be willing to trade-off so I’d say I’d give up three new drugs a year if it meant that every American can access the ones you have and you might disagree. We’ve got both an empirical problem and a normative problem.

Russ Altman: This is “The Future of Everything,” I’m Russ Altman. I’m speaking with professor Michelle Mello, now about drug prices. and so this is a hard problem. Does anybody take it as their problem to solve, so you pointed at Congress is it basically an act of congress or are there other more subtle ways that I don’t know the FDA or other federal agencies underneath the congress could make progress in this area?

Michelle Mello: I think everybody could make progress in this area if we want very large changes to the way our federal programs pay for and acquire drugs. It will take an act of congress usually, but there is a lot that can be done through administrative regulation in the FDA. Changing the way drugs get approved, how much that costs and so forth within the centers for Medicare and Medicaid services, what types of experiments they allow, and so forth.

I think it’s also important to note that there is a lot that can be done without law, you know, for example, one of the most important problems in my view is that at the point of prescribing physicians have very little information about the relative cost of the different drug choices that they have available.

Russ Altman: Yes, and particularly how much it’s going to cost that specific patient because of if their insurance —

Michelle Mello: Because as you know there’s not one price per drug everybody pays a different price depending on who their insurer is and what kind of plan they have from that insurer, so one thing that the market has begun to supply is products within the electronic health record that can tell a physician. Here’s the choice set, here’s what it’ll cost your patient today and here’s what it’ll cost their health plan today, and that could become part of the prescribing conversation.

Russ Altman: And as a physician, I would be happy to have that information, and I am positive it would increase the quality of my relationships with my patients. If they were on board with the idea that I was making these decisions not only to optimize their care but also to minimize the impact on their wallet.

Michelle Mello: You know physicians I think are often reluctant to bring cost into the conversation in part feeling the sting of the managed care backlash from the 1990s where they felt like they were under attack personally for not having their patient’s interest at heart. Patients want cost to be part of the conversation, they want physicians to acknowledge that that is a real barrier for them accessing medication.

Russ Altman: Thank you for listening to the “Future of Everything,” I’m Russ Altman if you missed any of this episode, listen any time on-demand with the SiriusXM app.


Related Departments