[ska]

The core of this idea is good; The tricky part about it is both technical and legal impediments to abuse. Specifically as an individual I should be able to share medical history with you (individual/corporation/government/whatever) in a way that is completely granular (I decide what you see and don't), revocable, and non-transferable.

[breck]

> I should be able to share medical history with you (individual/corporation/government/whatever) in a way that is completely granular (I decide what you see and don't), revocable, and non-transferable.

I agree 100% with the granular.

For "revocable, and non-transferable" I'm not sure how you would do that without making it not worth the trouble, but maybe I'm just not seeing something.

One thing I think solves a number of problems is what we call the "synthesize test". An EHR should be able to synthesize as many medical records as a researcher needs with 1 click. Then you could design software against lots of synthesized records, and move the compute of actual real patient records to the edge, on their devices. Maybe you could do something like that for the "revocable/non-transferable" thing. Patients submit their records to a machine with a ticking expiration, that does the training and emits the trained model and destroys the training data (assuming we can prevent leakage of sensitive info into the model).

[ska]

re: revocation, non-transferable, etc.

What I am suggesting is that data/learning companies need to start thinking of this sort of data differently, that what you are negotiating is access to the data under certain terms not ownership of the data.

If the individuals retain ownership, we the company should not be able to say sell that access on to a third party (c.f. Cambridge Analytics), or use it in a different way than negotiated for. If the company does not live up to the terms negotiated, the individual should be able to revoke the permission. There are various ways to do this, one being something like you describe.