What Happens To Your Medical Data After You Die?

“Almost no one has thought about what is going to happen to all of the medical records that sit around after people die,” said Jon Cornwall , senior lecturer in the Centre for Early Learning in Medicine at the University of Otago in New Zealand. Indeed, even if death is one of the most certain things in life, we have little control or knowledge about what happens to our collected health data after that point.

To see for yourself, you could try answering those following questions. How familiar are you with your digital health data footprint? Do you even know about the kind of health data generated about you and where it ends up? And what happens with this ever-growing pile of information after you die? Who owns this data and who can get access to it? Why could this even be interesting and for whom??

With the advent of digital health technologies such as chatbots , fitness trackers and direct-to-consumer genetic tests , that amount of health data soars to new heights with more individual and precise data piling up day by day. It would thus make sense to be able to donate such data; in similar ways we can donate our bodies for science. But it’s not as straightforward as it sounds, and such valuable individualised data are preyed upon by companies.

We dived into the mainly overlooked area of posthumous medical data and almost got lost. Here are our findings; but just a heads up: it’s messy and complicated.

Little digital breadcrumbs everywhere

Just as Hansel and Gretel dropped little breadcrumbs along the path in the forest to find their way back home, we leave tons of tiny digital breadcrumbs about ourselves in the digital universe. Facebook posts, e-mails, signing up to newsletters, cookies following our search history, interests, and preferences. The data piles up to form a unique digital identity. In a few decades, it is even expected that the number of Facebook profiles belonging to dead people will outnumber those of living users. The online space stores everything and never forgets.??

And what happens with the digital identity after someone’s death? As it certainly creates awkward moments when Facebook signals the birthday of a deceased friend, for example, more and more people realise that the digital era has reached a point where we also have to deal with the digital afterlife. However, so far, it has only created weirdness and confusion. You have online memorial services; companies who help you plan your digital death and afterlife; or even re-create algorithms to make a “digital back-up of their mind”.

Such endeavours bring us closer to a reality akin to the "Be Right Back" Black Mirror episode where the protagonist “resurrects” her deceased lover in virtual form based on his online communications and profile. Already, social network ETER9 promises to give users “cyber eternity” by pairing them with their A. I. counterparts, which learn their online behaviours and interact on their behalf, even after their demise. It’s still in Beta mode with over 100 000 registered users. The Eternime project also offers something similar with nearly 47,000 subscribers, but a?lack of funding put it on hold.

Who might not be short on funds is a Big Tech company like Microsoft. The latter was recently granted a patent to develop a chat bot that converses “in the personality of a specific person” based on social data. The company further contemplates pairing the technology with a 2D or 3D model of that person. But it’s still “only” a patent, with practical applications, if ever, remaining to be seen.

Nevertheless, the Black Mirror vibe is here and gives us much to contemplate about. Think about it: your grandchildren could converse with the online version of you 40 years from now. And it also raises a host of privacy concerns , now that data is the new oil. Moreover, the digital breadcrumb trail further extends beyond the social media space and into the healthcare space.

Dr. Frankenstein stitching your medical data

Similarly to the digital identity feeding off the breadcrumbs you drop off every time you use the Internet, an ever-growing Frankenstein’s monster evolves out of your medical data. Such data are collected from your birth; but in most cases - and surprisingly enough - this pile of information doesn’t belong to you. Moreover, you don’t have the chance to control it. If you look at the amount of data in question, you will realise the vanity of such an enterprise; and that this is not a far-fetched claim.

You get into the universe of medical administration the moment you are born. When you end up in a hospital, medical professionals use charts containing notes and information for diagnosis and treatment. These get into your (electronic) medical records ; and every private or public hospital or medical facility where you receive treatment will preserve some medical records of you. These generate general health records accessible by healthcare professionals; as well as personal health records with details like immunisation history, family medical history and past diagnoses meant for access by patients.

Now add to that the daily data gathered from digital health technologies from your phone to your smartwatch and the amount gets staggeringly huge. For example, the Marshfield Clinic health system in Wisconsin is on track to store more medical records from deceased patients in its data repository than of living patients by 2056 . ?As a result of this, millions of posthumous medical records are and will keep sitting around in digital and analogue systems; and that already massive volume is only going to grow. So how do countries deal with those data?

The lifetime of health records

Looking at this Mount Everest of data and the divergent spaces where it can end up, it seems to be very difficult to take ownership of it – even if you’re alive. The specifics vary from country to country. Moreover, there is no proper framework in place for one to pass their health data the way that they wish it to be.?

Currently, record-holders (whether an heir or legal representative) can easily sell such health information to companies interested in mining medical records for their own business interests; they only need to remove certain details from the records: such as Social Security numbers, names and detailed addresses to protect people’s privacy. Thus, your anonymized medical records can easily end up in a major pharma company’s hands that aims to profit off of real-world evidence for the efficiency of the drugs you happen to use.

So what could happen when you are already dead? That’s even more complicated and messy – no matter whether you live in Europe, in the U.S. or in India. Let’s see some examples.

1. The U.S.

The situation is the most complicated in the U. S. as there’s no federal law settling even that seemingly simple question: "who owns the patient’s medical records?". In the States, HIPAA ensures accessibility of health records for 50 years after a patient’s death. However, the usual time frame that record-holders keep them for is much shorter and range around 5-10 years after death . The law further enables the use of that data, with the access granted by the representatives of the deceased.?

2. The U.K.

In the U.K., after someone dies, their health records go to the Primary Care Support England for storage; generally for 10 years. Up until that point, personal representatives or someone who has a claim resulting from the death can apply to see the medical records of a deceased person. The NHS can further grant researchers access and use of anonymized health records upon request, while also giving patients the option to opt-out. However, it’s not a law but rather an institutional policy, notes Edina Harbinja , a senior lecturer in media and privacy law at Aston University in Birmingham, England.

3. Hungary

In Hungary , medical records have a relatively long lifespan; as long as 30 years. Discharge summaries' storage goes for even longer, at least for 50 years. Furthermore, their preservation can extend for even longer if it’s justified by scientific research. When a patient dies, their legal representatives, legal heirs, or close relatives have the right to access their medical records – upon written request. This allows them to know the cause of death or the specificities of their treatment.

4. India

However, if you look at India , upon the demise of the patient, inactivation of records usually happens after three years and archived permanently. They also note that with the rapid decline in costs of data archiving coupled with the ability to store increasing amounts of data that may be readily accessible, continued maintenance of such data in archives does not lead to any difficulties or disturbances – thus records may be kept indefinitely. That might be a direction that other countries and electronic health records storing systems also take up in the future.

What about tracker data or information from genetic tests?

While now you can designate a legacy contact on Facebook , you don’t necessarily have that option when it comes to your genetic data. One of the most direct-to-consumer services, 23andMe , previously said that they can provide genetic data about a deceased person only to an Executor, Personal Representative or Beneficiary of the deceased’s estate. They also highlighted that those requesting such information must provide evidence and legal documentation indicating they are authorised to act on behalf of the deceased individual.?

But 23andMe also signed a $300 million deal with pharma giant GSK for drug development. This deal leverages 23andMe’s substantial genetic resources made possible through its customers, who were oblivious that such a deal was in the pipeline. Whether or not such partnerships use the data of deceased customers is unknown.

Beyond the difficulties of obtaining a deceased person’s genetic data, there are also still many questions about its ownership. Is it shared property as we have a lot in common with our parents or grandparents? Is it legal to take genetic information to the grave if we consider the impact it might have on the life of our descendants? Lawyers and researchers have to figure out many issues around genetic data as it becomes more and more widespread to have a genetic test.

Regarding fitness trackers, health sensors, or wearables, the issues are very similar. Usually, the user has the option to share their data with one or more persons whom they designate while alive. But usually, they don’t have an option to name a legacy contact. Fitbit’s privacy policy says nothing about what happens upon death; only that you can delete your data. However, it may take up to 90 days to remove all your information.

Can you donate your health data?

Unlike organ donation, ownership of medical data rests in the hands of healthcare providers; without any way of knowing where that ends up. With the detailed, individualised data made available through digital health technologies, there’s scientific value to be had in it. It could help better assess public health issues that require health data over a long timescale. For example, the effect of certain working conditions on the ageing process; or the effects of long term exposure to pollutants.

“We didn’t find any systems where you could actively give your data,” said Jen Krutzinna , a bioethicist and a member of the Digital Ethics Lab at the Oxford Internet Institute. “There’s no way to pass it on in a proper way.” Krutzinna is part of a team at the Oxford Internet Institute working on a proposed “Ethical Code for Posthumous Medical Data Donation ”. The framework emphasises that, similar to organ donation, posthumous health data should not be commercially exploited; but rather employed for the common good.

The Oxford team's proposed ethical code aims at setting the pace for a process that has yet to materialise. However, it is one that would allow researchers to take advantage of the health data that people leave behind, says Krutzinna. In fact, in focus groups conducted by Jon Cornwall , participants would agree to have their posthumous medical records handled by the government (rather than private companies); didn’t want the data to be sold; and were also concerned about hacking. “They want anonymity and privacy but want their descendants to have benefits as well,” Cornwall said .

In a similar way, as it gets hard to track where our health information ends up during our lifetime, the issue persists even after our demise. With our increasing digital health data footprint, clear regulations must be set up so that individuals are aware of the options. This also enables them to make informed decisions regarding their medical data after their death. As Edina Harbinja puts it : “We should be able to choose how we dispose of our digital self.”