Keywords

1 Introduction

Who owns patient information, and perhaps more importantly, who should own it? This is a question that the research literature has so far failed to conclusively answer. Furthermore, the potential answers offered have mainly been derived from the field of jurisprudence (although authors tackling the issue are typically also knowledgeable about ethics and healthcare) and from the United States [1–4]. The paucity of academic discourse is interesting because of the topicality of the issue, and there is a strong global drive towards developing healthcare information systems. Cognisant of the differences between the legal tradition of the US and that of (particularly continental) Europe,Footnote 1 we need to engage in further discourse from academics with different backgrounds in terms of traditions and fields.

It appears that the ownership of patient informationFootnote 2 is a target of regulation that seems to have either failed or has not been accurately or explicitly defined in many countries [2, 3, 5]. Existing arguments or viewpoints arguably diverge in relation to how the issue of ownership should be solved or approached. The first view is that patient information should be publicly owned and regulated [3]. The second view is that the patient should have mastery over his/her information [5]. The third view holds that the propertisation of information is not a solution and actually leaves the problem unsolved [4, 6]. Common among all these views is the recognition that ownership or property rights is not easily implemented when it comes to patient information.

There seems to exist contradictory scenarios when it comes to patient information. The (lack of) regulation of ownership mentioned above, when viewed against the protection of personal information found in European Union directives, seems to be inconsistent [7, 8]. Koskinen et al. [5] show that by approaching the issue from the perspective of ethics, rather than from that of jurisprudence, the problems of unclear regulation become visible.

Koskinen et al. [5] propose a different approach to how the ownership of patient information is viewed. They note that the traditional view of property, or current immaterial property rights, is not a plausible solution because of the nature of patient information. The solution they propose is the use of a different definition of ownership, namely Datenherrschaft [9] – mastery over data – granted to patients to overcome the problem [5]. This definition seems more appropriate in serving the aim of controlling patient information because it takes greater account of the problems of property and ownership in this context.

This paper starts by analysing patient information from the viewpoint of ownership because there is an established practise as well as trends to propertise different kinds of information with immaterial property legislations. The academic discourse on what constitutes ownership has considered information about people in internet and company databases. This suggests that we are in an era in which the boundaries of our privacy and protection of personhood have been re-drawn. Patient information is at the core of this issue, or at least it should be – which is not currently the case. The legislative approach is essential because our societies are controlled through the use of legislation; thus, without clear legislation, rights become non-appealable, i.e. such rights can and will be ignored or deprecated. Of course, the approach could be other than ownership-based, for example, in Finnish legislation,Footnote 3 , Footnote 4 , Footnote 5 the aim has been to control and restrict the use of patient information with laws and regulations, not through ownership. However, with the ownership approach in focus, the issue can be clarified by analysing and stating who in the end should control and by ascertaining how patient information is used and by whom. Property rights do have a strong and fundamental position in Western countries, and this approach suggests that it is fruitful to have a strong offset for clarifying the patient’s position as well as rights that protect the patient’s information.

It is notable that in different countries there can be numerous ways of controlling patient information. However, it seems that a look at the Finnish legislation on the proper use and storage of patient information can lead to complex and case-specific legislation, which could be avoided with a focus on legislation based on ownership. In this way, the detailed practices – which must respect Datenherrschaft – could be regulated with soft law and could thus cope more easily with technological developments (see also Kainu and Koskinen [10]). With this, patients can thus control how their information is used (with some limitations, which are shown later on).

It seems that Datenherrschaft is an ethically justified way to regulate patient information, at least according to the Lockean [5] position. Nonetheless, we want to strengthen the ethical justification for Datenherrschaft with Kant’s categorical imperative(s). The Kantian view is relevant here because, as Wiesing [11] states, “In a time of rapid change, the concept of human dignity and human rights from the Kantian tradition serves at a certain level as a stabilizing anchor”Footnote 6. The Kantian tradition respects the value of humans differently than, for example, the utilitarian position. Utilitarianism seeks the most efficient outcome of good and can thus lose sight of humanity, an aspect of critical importance in the field of healthcare.

2 Datenherrschaft – Mastery Over Data and Information

This paper uses the concept of Datenherssaft in the same way that Kainu and Koskinen [9] defined it:

[Datenherrschaft is] the legal right to decide the uses of, in a database or another compilation, collection or other container or form of data, over a entry, data point or points or any other expression or form of information that an entity has, regardless of whether they possess said information, with the assumption that sufficient access to justice is implemented for a citizen to have this power upheld in a court of law.Footnote 7

Datenherrschaft differs substantially from property rights in four specific ways. First, when ownership of property can be moved from one party to another, it is not a case of Datenherrschaft. Datenherrschaft is irremovable from the individual who has it. This is similar to the aforementioned by Kainu and Koskinen [9]: an individual’s choice to participate, or not, in a criminal act is not removable from the actor – even though the driving forces behind the act can be interpreted and argued. Datenherrschaft can only be given to the person about whom the information is. It is notable that someone cannot give up his/her Datenherrschaft, even though he/she may wish to do so, as it is an integral part of who and what he/she is. This is what makes Datenherrschaft so unique. Even if there is a contract that limits one’s Datenherrschaft, it cannot be upheld in a court of law.

Second, the work done is seen as a justification for individuals to gain immaterial property rights. However, the context of healthcare differs substantially from the common creation of immaterial work. Immaterial property rights are seen as compensation to individuals for work done. However, in healthcare, income is salary based, and thus, there is no need for compensation [5].

Third, immaterial property rights are commonly passed on to other parties who have not done the actual intellectual work. This in itself is very problematic because, in many cases, there is no real possibility of possessing a right when another individual produces the intellectual work. This is so because of a weak negotiating position when rights are negotiated between parties. Instead, Datenherrschaft is non-transferable; it is a part of the patient in a similar sense as the criminal deed is bound to the person who commits the crime, as Kainu and Koskinen [9] show.

The last and arguably most fundamental difference is that whilst immaterial property rights are based on creative or artistic processes, work done by an individual in a healthcare situation differs substantially. Healthcare is based on evidence-based medicine – or at least it should be, or we are talking about snake oil or the art of performance. Healthcare professionals rely on science and knowledge of medicine and not on their artistic or creative ideas; therefore, property rights cannot be justified here.

The consent approach is arguably more plausible than Datenherrschaft as it has one major advantage – it is part of the prevailing legislation in many countries. However, Datenherrschaft reaches further than the consent approach. It changes the paradigm between the patient and healthcare – the patient is no longer the object of healthcare;Footnote 8 rather, he/she has control over his/her information, and he/she interacts with healthcare for some purpose. The consent regime aims to provide sufficient information to patients to make decisions regarding the medical issue at hand. The Datenherrschaft approach focuses on serving the need of the patient when he/she observes him/herself in a medical sense and, more broadly, in his/her life as a whole. Only patients can judge what are the relevant issues for them even if they may – and most probably do – need medical professionals to help them to gain an understanding of their patient information. Deber et al. [12] suggest that autonomous patients could be seen to mean people who wish to understand their disease and their possibilities even though they usually do not want to play the self-provider role in healthcare. The self-judging approach and the patient view of one’s own life plan is critical when we think of the problem of controlling patient information. Lee and Lin [13] show that the impact of patient centeredness – which should include respect for the patient’s goals and desires – in health outcomes is elusive. However, even if we find no indisputable evidence for health outcomes for patients from patient centeredness, it is not a sufficient reason to disclaim it. The health outcome is not only a relevant issue for the patient and perhaps not even the most important. Knowledge of one’s own situation is a core factor in gaining an understanding not only of the situation but also of the possibilities for one’s life. If we must rely on the judgement of healthcare professionals regarding what information is needed by us, it is not clear that we would necessarily be treated as ends in ourselves; rather, we could end up as mere means in the system. After all, we would be expected to accept doctors’ viewpoint like everyone should. This cannot be accepted if we wanted to be ends in ourselves and not reducible to mere means. To have a proper understanding of patient information for patients, there is a need for new patient information systems that would serve primarily the layman’s needs and not only those of professionals. Here, the aim of Datenherrschaft would be misplaced because the information may not be understandable or even accessible to patients.

The main practical contribution of Datenherrschaft is this paradigm shift – which it also supports from a legislative standpoint – and its strong support for patients’ sense-making of their health and life [14]. This is crucial in healthcare where healthcare professionals and especially doctors, rather than patients, have maintained control of the medical path and information [15].

Datenherrschaft would thus seem to be an appropriate solution by which to overcome the baggage associated with the term ‘property’ in general and especially with its economically weighted use in intellectual property rights. Datenherrschaft emphasises the right of the patient to be free from paternalistic control and speaks for the patient’s right to choose how his/her information is used and by whom.

Understandably, this mastery cannot be absolute and can be overridden if it conflicts with the fundamental (which are not property rights of any sort) rights of others, such as the right to life or health. Situations in which the patient’s rights are justifiably overruled would occur, for example, during lethal epidemics where others are in direct and grave danger [5].

However, the patient’s mastery can only be overruled temporarily and only with justifiable reason to protect the idea of Herrschaft. Information about overriding Datenherrschaft must be clearly reported to the patient [5]. Another critical issue to note is the use of patient information for research purposes. There are justified reasons – for example, the duty to preserve all of mankind – for collecting anonymised patient information for research purposes, but only that anonymised data can be accessed and not the original data [5]. However, this data should be collected within some common database(s) to which free access for research purposes would be available. This way, both the rights of individuals and their duty towards mankind would be served.

Health information technology is changing, and there is a need to analyse the idea of informed consent in the healthcare context [16]. Traditionally, paternalism has been justified due to the doctor knowing more than the patient about various medical conditions. This is no longer always the case, and patients are more capable of taking responsibility for their own condition/s. If, in this situation, the patient continues to be treated as a target for paternalistic handling, he/she is not considered an end but rather a means for the healthcare professional. Any use of power over another needs to be justified, and in the current situation, paternalism is no longer typically justifiable as in the traditional sense.

3 Kantian Autonomy and Rational Agents: Prerequisites for Patient Centeredness and Empowerment

Patient centeredness and empowerment are seen as important factors in today’s healthcare systems and thus need to be taken into account [17–20]. Empowerment is a multilevel construct whereby people, organisations and communities gain mastery in matters that concern them by having rights and needed resources [21, 22]. To be empowered, citizens require information while patient centeredness supports respect for patients and ensures that citizens’ needs are fulfilled. Without information, one obviously cannot have credible mastery or gain an understanding of one’s own health or treatment. This is where Datenherrschaft makes a difference in healthcare practice as it respects the autonomy of the patient and enforces the patient’s right to decide how his/her information is used by granting him/her mastery (compare this to empowerment as defined above) over his/her own information, thus reducing the possibility of healthcare professionals exercising paternalism over him/her.

Nevertheless, Sjöstrand et al. [23] show that there can be an acceptable level of paternalism if it enhances patient autonomy. Autonomy is constructed from at least three parts. First, there must be competence held by the individual who is exercising autonomy. Second, there should be the ability to make decisions aimed at realising desires, goals etc. Third, desires should be authentic, meaning that they should not be based on, for example, self-deception or coercion. The level of authenticity in desires varies; some desires are more authentic than others [23]. However, there can be situations in which paternalism is acceptable – for example, in cases of nervous breakdown and shock – but paternalism itself cannot be held as a universal law.

Although Kant did not take a stand on medicine, his influence has been strong in the medical field, especially in relation to autonomy and human rights [11]. Autonomy and the free will of actors are preconditions for duty, which is an essential part of Kant’s moral philosophy. Duty is something that can only be performed by rational agents, and actions can only be moral when conducted by rational agents on the basis of free will [23]. Forced ‘good’ actions cannot be moral because morality comes from people’s will, and the actions they undertake are just consequences of that will. The outcome is secondary or even irrelevant to the will and its goodness. Nevertheless, the will is a necessary but not sufficient condition. If the actor has not understood his/her duty, he/she can still act wilfully, but that action can be a bad action. Therefore, the universality of moral acts and taking each person into account as an end are also preconditions for moral action and essential parts of Kant’s moral philosophy, which becomes concrete in the three categorical imperatives that are, according to Kant, all modifications of the same moral law, just presented differently [24].

4 Datenherrschaft in Light of the Categorical Imperative(S)

There are three different forms of categorical imperatives identified in Kant’s Grounding for the Metaphysics of Morals, and there are also different translations from German to English, not forgetting other languages. Nevertheless Kant’s three categorical imperatives can be translated into English as [25]:

  • CI1: Act as if the maxim of your action were to become through your will a universal law of nature.

  • CI2: Act in such a way that you always treat humanity, whether in your own person or in the person of any other, never simply as a means, but always at the same time as an end.

  • CI3: An act is morally right if and only if the agent, in performing it, follows the law autonomously.

In what follows, the third categorical imperative is examined through the first and second formulations; it is visible throughout the paper and is, as Kant points out, directly connected to the other two.

4.1 Categorical Imperative 1

The first categorical imperative, ‘Act as if the maxim of your action were to become through your will a universal law of nature’, demands that the Datenherrschaft of patient information be formulated and legislated in such a way that it satisfies the requirements of being a universal law. Taylor [26] has analysed the paternalistic maxim and came to the conclusion that it is not acceptable for people to be treated in a paternalistic way. If a world in which the maxim of paternalism as a universal law is imagined, there would be situations in which people would not be able to truly exhibit self-control. The paternalistic maxim converts rational agents into less autonomous beings and diminishes their capacity for self-control, which is a precondition for the potential to effectively will any action. Thus, by willing the paternalistic maxim as a universal law, one takes away this capacity and leaves that will to face a collision with itself. Therefore, paternalism cannot be held as a universal law [26].

Koskinen et al. [5] argue that the patient should be held as the possessor of Datenherrschaft whereby the solution to the problem of paternalism is reached by giving the patient control over his/her information. However, the patient’s Datenherrschaft cannot be absolute without violating the first formulation of the categorical imperatives. There are occasions when healthcare professionals or other authorities must have access to patient information, for example, in situations concerning disease epidemics or when access to patient information is crucial for some other individual. It appears likely that European Union legislation will increase the problem of using information for the purposes of healthcare if amendments to the Data Protection Directive (DPD) are implemented as written whereby privacy will have greater value over health [8]. In some situations, information is a premise for securing the lives of others, and so, withholding that information – as the DPD would – cannot be seen as an act of universal law. Likewise, the aforementioned anonymised patient information used for research purposes seems fitting as a universal law as it makes possible the curing or saving of people in the future. In addition, the literature (though limited) indicates that patients consider the use of their information for research and public health proposes to be legitimate (see e.g. Spriggs et al. [27]).

Thus, our suggestion for a universal CI1 is: Patients should have mastery over their information, thus granting them as widely inalienable a mastery of their patient information as possible, but not exclusive control of use, thus granting the possibility of using the data in exceptional situations, such as in cases of pandemic or when information is crucial to save the lives of others or to secure their health from serious danger. Likewise, access is permitted for research purposes when properly anonymised.

The first categorical imperative clearly brings out the advantages of Datenherrschaft because it avoids the flaws inherent in paternalism compared to a situation in which citizens are without mastery of their own patient information. However, the limitations and use of anonymised information for research purposes seem to be exceptions that should be catered for. Thus, Datenherrschaft fulfils the first formulation of the categorical imperatives if those restrictions are added, as proposed by Koskinen et al. [5].

4.2 Categorical Imperative 2

The second formulation of Kant’s categorical imperative states: ‘Act in such a way that you always treat humanity, whether in your own person or in the person of any other, never simply as a means, but always at the same time as an end’. Thus, people should always be treated with respect by virtue of their humanity and not in an arbitrary manner. Each person should be honoured because he/she is a human being and not only because he/she is something that serves some personal end or goal [24]. Therefore, citizens cannot be bypassed in deliberations on patient information. The contrary suggests that people are treated only as means.

Kant places greater emphasis on the motivation – good will – behind actions than on the outcome. Thus, following Kant’s deontological approach, a situation in which the outcome would be good is unacceptable if the moral codes are neglected or given less weight on utilitarian grounds. This makes a position in which people’s liberty or other personal rights are limited by others very problematic. Thus, through the paternalistic actions of some other party, we can lose the autonomy of patients, which is seen as one of the core values of medical ethics [28, 29]. Hence, paternalism violates the second categorical imperative. It is obvious that solely restoring a citizen’s health or curing his/her disease does not sufficiently fulfil the second Kantian formulation, thus nullifying it as a basis of how people are treated in a healthcare system. In that case, people would be treated merely as objects by the healthcare system as well as by healthcare professionals carrying out their care or medical treatments, and that would be unacceptable.

This point of objectification needs to be noted in situations where a holder of Datenherrschaft over patient information is proposed to be some party other than the patient. If some party other than the citizen is granted Datenherrschaft, the patient, as a human being, is not honoured as an end in him/herself. Accordingly, if the patient is set aside from other Datenherrschaft candidates – who have their own goals (even though these goals can be similar to those of citizens) – we do not respect people’s autonomy and liberty when we choose how their information (which is an extension of themselves) is used or not used. Even though the goals might be similar to those of citizens, the outcome is not the point; the main point is the moral motive which satisfies respect for the patient as an end in him/herself.

Even though many (probably most) healthcare professionals do consider the patient as an end, not all of them necessarily do. Thus, as we cannot be sure of this, we must design systems that at least ensure that the system supports treating the patient as an end. Manson [30] shows that even though patients seem in many cases to be unwilling to participate in decision-making, they can have different requirements for information. By according mastery to patients, we ensure that they have all the necessary information when they want or need it, and we do not rely on the hope that healthcare professionals will treat patients as ends in and of themselves.

For example, people are not necessarily treated as ends if healthcare professionals have mastery over their patient information and thus have a paternalistic hold over them. In a paternalistic relationship, healthcare professionals can decide how information is used and what is best for the citizen without knowing the personal needs of the patient [30]. The problem is that the biomedical worldview focuses on medical consequences; this collision of worldviews (deontological vs. consequentialist) is problematic and can generate conflicts if not taken into account. Thus, the citizen’s humanity as a person with his/her own will and opinions about his/her life can be lost through someone else’s power over this citizen. Even though the intentions are good, the paternalistic approach itself can easily lead to loss of a person’s control over his/her own life. If the possessor of information is an institution (such as the state, a healthcare organisation or a company), the problem is actually worse since institutions can and usually do treat citizens as only part of a bureaucratic process, without a trace of humanity (see, e.g. Wiesing [11] for the view that the Kantian tradition functions as a stable anchor for humanity).

5 Conclusions

The clear regulation of patient information seems to be missing in several legal systems or traditions of jurisprudence. While patient information obviously plays an essential part in modern healthcare, there must be a wider discourse on the issue than there is at present. The proposal that patient information should be regulated in such a way that it gives patients the strongest possible rights over their information is ethically justified from a Kantian perspective. Other viewpoints from different perspectives and traditions are needed to elaborate Datenherrschaft in such a way that it fulfils the ensuing transdisciplinary demands.

This proposal also has the advantage of being free from the baggage of previous legal solutions. It responds to the problems of current views on property and respects the privacy and autonomy of patients. Likewise, the proposals note the right of public healthcare authorities to access and use patient information in situations deemed necessary to protect the life and health of others, for example, in the case of epidemics. Future research should evaluate what kinds of changes are needed in information systems and healthcare practices if Datenherrschaft is implemented.