Health Data and Information Ownership: Cybersecurity, Protection and Privacy Perspectives

Health data is being generated and collected by observing or measuring health and well-being status of a person. Nevertheless, is it not always obvious who actually owns the data. The topic of health data ownership belongs to the wider field of health data governance, and depends on the legislation in force, regulative applied to the health system the data generation and collection occurs within, and the procedural rules implemented in the information systems the data is being processed by. In order to secure and maintain proper health data ownership, while upholding a maximum level of personal data privacy, a variety of data protection and cybersecurity mechanisms have to be in place. This paper analyzes different legal, organizational, technical and practical approaches to health data ownership, as well as proposes a conceptual framework for health data and information ownership, by taking into account cybersecurity, data protection and privacy considerations. The analysis also includes the position of the European Health Data Space Regulation on health data ownership, as one of the newest legal acts adopted concerning optimizing the exchange of and access to health information within the European Union. The proposed conceptual framework consists of 5 pillars and 34 topics in total, that may guide future health data policies toward being more comprehensive, inclusive, and rights-based.