Provided an intangible thing is of value and an individual holds the exclusive rights to that thing of value, is there any limitation to what can and cannot be licensed? Can an individual license their consent for something that is usually freely given? Is prostitution a form of licensing of consent?


Through an usual set of circumstances, I recently stumbled upon something a health care provider is doing with the health information of its patients, including my own. These are the most pertinent details:

  1. What they are doing is probably unlawful to begin with
  2. Without consent, they must delete the health information
  3. Deleting the health information will cost several thousand of dollars per patient
  4. These are very bad people who deserve what is about to happen

Consent-based health information brokerage

This got me thinking:

  1. A patient could expressly refuse to consent to the use, requiring deletion of the health information.
  2. The deletion will cost several thousand dollars
  3. Rather than require the performance, the patient could sell a License back to them for say, 50% of the cost of deleting the records.
  4. The health care provider will of course initially refuse this arrangement, but will eventually come around

Obviously, the key issue here is express refusal without enforcement means consent has no licensing value.

The market value of a consent-based License being fixed to the cost of deleting the records. As a consent-based broker, I would charge a 10% brokerage fee.

Everybody wins, except the health service provider, who now learn a valuable lesson that just because they were getting something for free did not mean it was worthless.

Is it possible for me to be a consent-based health information broker? That is, sell a consent-based Enterprise License back to a health provider so that they can continue to use people's health information?

  • Your inquiry/description is vague and unclear from several angles. Examples: your mention of "very bad people who deserve what is about to happen", or what exactly did you discover a health care provider is doing with your information. It is also inaccurate to presume that deletion of records costs "several thousand dollars", since everything (including selective redaction of records) is increasingly susceptible of being automated. To be honest, I think the business initiative of "consent-based information brokerage" will get you nowhere. Dec 9, 2018 at 13:11
  • manually deleting records from 1,300 datatables x 3 databases. they cannot selectively redact your records if you expressly refuse to de-identifying your health information.
    – faustus
    Dec 9, 2018 at 13:14
  • @IñakiViggers as for what they did: they took 6 million records, used them unlawfully to train some 50,000 people on how to use their eMR including how to search for patient records, handed out throwaway login credentials for the training e.g. user101:password101, had logging disabled and never audited the system, then tried to cover it up, twice.
    – faustus
    Dec 9, 2018 at 13:17
  • 2
    (1) A database professional can implement scripts to automate massive or selective deletion of records (these deletions occurring in cascade so as to take care of dependencies, orphan records, and database integrity), whence manual deletion is very unlikely at an institution with database models of that size. (2) The assumption that a patient can preclude anonymization of his data is mistaken. (3) You might be unable to convince them (or even the court) that their eMR training is unlawful, but that is a separate issue with little-to-no bearance on the idea of brokerage you outline. Dec 9, 2018 at 13:45
  • @IñakiViggers you make some good points. BTW the manual deletion is something i was told was required by someone from the agency i randomly bumped into in the street. as for anonymisation, this is something that will be heard in court.
    – faustus
    Dec 9, 2018 at 13:53

1 Answer 1


You could offer to sell your own consent to use your records to a healthcare provider, and collect if the provider agreed. But that wouldn't make you a "broker" as I see it, only a one-tiem seller. To be a broker you would somehow have to convincew many others to let you act as their agent in selling such consent to various providers,at some sort of commission. I don't see why anyone else would hire you to do that.

The value,of your records, by the way, would be not the cost of deletion (which would be rather small) but the potential income to be earned by retaining your records. But the incremental value of any one patient's records would probably not be large.

If the provider has used your information in ways that are unlawful, you could report this, and the provider might be fined. But that would put no money in your pocket. Offering not to report for a fee would be extortion (blackmail) a felony.

If the provider has de-identified (aka anonymized) records they may be used freely. Specifically, under the US HIPPA privacy rule:

De-Identified Health Information. There are no restrictions on the use or disclosure of de-identified health information. De-identified health information neither identifies nor provides a reasonable basis to identify an individual. There are two ways to de-identify information; either: (1) a formal determination by a qualified statistician; or (2) the removal of specified identifiers of the individual and of the individual’s relatives, household members, and employers is required, and is adequate only if the covered entity has no actual knowledge that the remaining information could be used to identify the individual.

The HIPPA rule does not require a person's consent for that person's records to be de-identified, as the purpose of the rule is to protect the privacy of patients, not to allow them to make money from their information. Specifically, HHS says:

The Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”) establishes, for the first time, a set of national standards for the protection of certain health information. The U.S. Department of Health and Human Services (“HHS”) issued the Privacy Rule to implement the requirement of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”).1 The Privacy Rule standards address the use and disclosure of individuals’ health information—called “protected health information” by organizations subject to the Privacy Rule — called “covered entities,” as well as standards for individuals' privacy rights to understand and control how their health information is used.

Moreover, PHI can be used without de-identification and without consent for severla purposes under the HIPPA rule, including "Health Care Operations" and "Public Interest and Benefit Activities". The rule says:

Covered entities may rely on professional ethics and best judgments in deciding which of these permissive uses and disclosures to make.

I am not clear as to whether training employees on equipment so that they can treat patients would come under "Health Care Operations" or "Public Interest and Benefit Activities", but it might.

The statements in the question about the cost of deleting a given patient's records are implausible. The exact effort required would depend on the design of the database system, but unless it has been designed in a highly inefficient way, a simple script that took as input a patient ID and deleted all records of that patient, could be devised once in a short time by a DBA or other database professional, and used without change thereafter. Even fully manual deletion would probably require no more than say 20-30 hours by an entry level tech, at a cost in salary of a few hundred dollars at most. De-identifing data is also not a high-cost operation -- I have had occasion to do it myself. One simply replaces in a copy of the DB each patient name with "TestPatient0001" "TestPatient0002" etc, and makes similar replacements for each of the other identifying indicators. A very repetitive and easy to program change.

In short, i don't think the prospect of getting a healthcare provider to pay a sizable sum for consent to use a single patient's data are large, although it would be legal to make an offer.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .