What rights do and should stakeholders have for medical data? A survey of patients, physicians, and hospital administrators

AbstractWe propose beliefs about legal ownership are informed and biased by intuitions about and cues that imbue psychological ownership--knowledge, control, and self-investment. We test our theory in the context of legal ownership of medical data in the United States, which is determined by property rights afforded by HIPAA to three stakeholders: patients, medical providers, and health systems. We theorize that stakeholders underestimate patient rights and overestimate provider rights afforded by HIPAA because patients are perceived to have less knowledge, control, and to have invested less in their data. As predicted, all stakeholders underestimated patient rights and overestimated provider rights afforded by HIPAA in a nationally representative sample of patients (N=300) and convenience samples of medical providers (N=114) and health systems administrators (N=100). All stakeholders agreed that patients should also be afforded more rights by HIPAA and fewer rights should be afforded to health systems. We find additional evidentiary support for our process account in three experiments (N=1195) in which we manipulated the perceived knowledge, control, and self-investment of patients, which modulated the degree to which patients underestimated rights afforded to them by HIPAA. Our findings illustrate how intuitions about psychological ownership inform and bias judgments of legal ownership, and reveal a consensus of stakeholders agree HIPAA should be reformed to expand patient rights. Public significanceThis study suggests that beliefs about legal ownership are informed and biased by intuitions about and cues that imbue psychological ownership--knowledge, control, and self-investment. It shows how patients, medical providers and health systems administrators underestimate patient rights and overestimate provider rights afforded by HIPAA, and reveals additional patient rights that all stakeholders agree should be afforded by HIPAA.