How health data gets bought and sold — and what you can do about it

Every time a prescription is filled, a claim is submitted, or a symptom-tracker app records a bad night, a small fact about a person's body is created. Most people assume those facts stay between them and their clinician. A great many of them do not. They are aggregated, de-identified, packaged, and sold into a market most patients have never heard of and cannot see into — a market that is, for the most part, entirely legal.

Understanding how that market works is the first step to deciding whether you are comfortable being its raw material.

The shape of the market

Health data is bought and sold through a layered supply chain that turns clinical exhaust into licensable product. At the top are the original collectors — pharmacies, labs, insurers, electronic health record vendors, and app makers. In the middle sit data brokers and analytics firms that buy, clean, link, and repackage. At the bottom are the buyers: drug companies sizing markets, insurers modeling risk, advertisers targeting conditions, and researchers building cohorts.

The volumes are not marginal. Large health-analytics companies describe holdings covering hundreds of millions of patients and billions of prescription and claims records, assembled over decades. A single de-identified prescription dataset can describe, in aggregate, what a whole country is taking and for what. None of this requires your name. It requires your patterns, and your patterns are valuable precisely because they are real.

The buyers are not all sinister. Some of this data genuinely powers safety surveillance and legitimate research. But the patient — the person whose body produced every data point — is the one party in the chain who is neither asked nor paid, a lopsidedness we take up directly in should patients be paid when research uses their data.

The de-identification loophole

The legal engine of this market is a single move: de-identification. Under HIPAA, once data is stripped of identifiers to a defined standard, it is no longer "protected health information" — and data that is not protected health information is no longer regulated by HIPAA at all. It can be sold, combined, and resold with no further obligation to the patient.

This is not a scandal hidden in fine print; it is how the rule is designed. The HHS de-identification guidance describes two lawful methods, Safe Harbor and Expert Determination, for declaring data de-identified, and we walk through both in HIPAA Safe Harbor vs. Expert Determination. The catch is that "de-identified" is not the same as "anonymous." De-identification reduces re-identification risk; it does not zero it, especially as the auxiliary datasets a broker can buy keep multiplying. The famous cases — re-linking supposedly anonymous records to named individuals — are catalogued in re-identification attacks, and the reason the words matter so much is unpacked in de-identified, anonymized, pseudonymized.

So the loophole is twofold. Data can be sold the moment it is declared de-identified, and "de-identified" is a probabilistic claim, not a guarantee.

The data that was never protected at all

A second, larger category never enters HIPAA's orbit to begin with. HIPAA regulates specific entities — health plans, clearinghouses, and providers who bill electronically, plus their business associates. It does not regulate health information as such.

That distinction has enormous consequences. A wellness app that logs your menstrual cycle, a search engine you ask about symptoms, a wearable counting your steps, a fitness forum where you describe a diagnosis — none of these is typically a covered entity, so the intimate health data they collect was frequently never protected health information at all. Enforcement actions in recent years against telehealth and prescription-discount services for sharing user health data with advertisers turned on consumer-protection law, not HIPAA, precisely because HIPAA did not reach them.

State legislatures have started to close the gap. Washington's law on consumer health data is the strictest example, requiring genuine authorization before such data can be sold; we cover it in Washington's My Health My Data Act. But the patchwork is uneven, and the default in most of the country remains: if a non-covered app collected it, the law is mostly silent.

Why opting out rarely works

Opt-out is the remedy patients are usually offered, and on paper it sounds sufficient. In practice it is structurally weak, for reasons that have nothing to do with anyone's good faith.

The core problem is visibility. You cannot opt out of a transaction you cannot see, conducted by a company whose name you will never learn, involving data already several hops removed from you. Opt-out asks the person with the least information and the least leverage to police the entire chain after the fact.

What a patient-mediated alternative looks like

The fix is not a better opt-out. It is a different default. In a patient-mediated model, your records are not in a pool that researchers buy access to; they sit with you, and nothing leaves without a specific, revocable permission you grant for a specific study. The question flips from "how do I claw my data back?" to "what, exactly, am I willing to lend, and to whom?" — which is really the old question of who owns your medical records, answered in favor of control.

This is the model Mithras Health is built on, and the structural commitment underneath it is blunt: the platform never buys or sells data. Its revenue comes from charging researchers for scoped, IRB-approved access, while patients are paid fair-market participation fees that post only on approved research-use events. No broker sits in the middle, because there is no resale to broker. When you withdraw a grant, future provisioning stops; the data was never pooled into a product, so there is no product to recall.

That arrangement does not abolish the data market, and it does not pretend to. It does something narrower and more honest: it removes the patient from the part of the market where they are sold without being asked, and puts them in the part where they decide. The difference between those two positions is the difference between being the product and being a party to the deal.