Nelson Advisors Big Questions in HealthTech Series: Who really owns patient data once an AI agent has touched, transformed or generated it?

Nelson Advisors
51 minutes ago
16 min read

The Property Right Fallacy: Legal Frameworks Governing Raw versus Derivative Patient Data

The rapid integration of artificial intelligence into clinical workflows has exposed a fundamental mismatch between traditional legal concepts of property and the realities of modern health data processing. As machine learning models, autonomous clinical agents, and natural language algorithms ingest electronic health records (EHRs), generate predictive risk scores, and synthesize novel patient profiles, a central jurisdictional conflict emerges regarding who legally owns this transformed data.

Across major Western legal systems, statutory mandates and common law precedents largely reject the concept that raw patient health information constitutes personal property capable of individual ownership. Instead, the legal landscape operates through a fragmented framework of regulatory custodianship, privacy entitlements, and intellectual property enclosures.

In the United States, judicial decisions consistently resist establishing direct patient property rights in health data. Under federal jurisprudence, courts have rejected theories asserting that patients possess an inherent proprietary interest in their diagnostic records or medical histories. A landmark illustration of this judicial skepticism is Dinerstein v. Google, LLC, where a patient filed a class action against the University of Chicago and Google following the transfer of hundreds of thousands of de-identified patient EHRs to develop predictive medical software. The plaintiff alleged that the disclosure violated express and implied contractual terms regarding privacy and asserted that he was entitled to financial restitution on the ground that the commercial monetization of his health data depleted its intrinsic economic value.

The United States District Court for the Northern District of Illinois dismissed the breach of contract and common law claims, ruling that the plaintiff failed to establish a concrete pecuniary injury or a recognized property interest in his health data under an overpayment theory. This ruling was affirmed by the Seventh Circuit Court of Appeals on standing grounds, solidifying the principle that a breach of privacy or contractual duty regarding health data does not, absent concrete economic harm, equate to a conversion or theft of personal property. This aligns with common law traditions governing biological materials and derivative research, where courts, such as in historic tissue repository disputes—have held that individuals generally relinquish personal property claims over excised tissues and their downstream derivative data once integrated into institutional research programs.

To evaluate whether an intangible asset such as clinical data can qualify as property, US courts frequently reference multi-factor tests derived from commercial law, such as the three-part framework articulated in Kremen v. Cohen. Under that standard, an intangible asset must represent an interest capable of precise definition, be capable of exclusive possession or control, and be supported by a legitimate claim to exclusivity. While raw clinical observations and AI-derived mathematical representations (such as vector embeddings) can be precisely defined, they fail the exclusivity requirements. Health information is inherently non-rivalrous and contextual; conferring strict property rights on raw data would grant individuals absolute exclusion rights that severely disrupt public health surveillance, comparative clinical research, and scientific progress.

In the United Kingdom, English common law maintains a clear doctrine that information per se cannot be the subject of property. Under English jurisprudence, health information is protected not through property rights, but through non-proprietary legal mechanisms, primarily the equitable cause of action for breach of confidence, supplemented by statutory data protection legislation.

Judicial markers establishing property rights over intangible assets, such as the criteria established in National Provincial Bank Ltd v Ainsworth, require certainty of subject matter, stability, and public notice. Health data fails these criteria due to its dynamic, evolving nature across different care contexts. Consequently, while NHS Trusts or clinical software developers may hold physical or digital custody of the servers and databases housing patient records, neither the institution nor the patient possesses absolute property in the underlying data.

The European Union's General Data Protection Regulation (GDPR) deliberately bypasses property frameworks altogether, establishing a fundamental rights-based regulatory model. Under Article 4(1) of the GDPR, health data is categorised as personal data concerning health, a special category of personal data under Article 9, defined strictly by its linkage to an identified or identifiable natural person (the data subject). Rather than treating data as a commodified asset subject to transfer of title, the GDPR grants data subjects specific personal rights, such as the rights of access, rectification, portability and erasure, while assigning strict operational duties to data controllers and data processors.

This distinction reveals a critical second-order insight: the refusal of legal systems to grant property rights to patients does not create an open data commons. Instead, it establishes institutional custodianship. Hospitals, technology firms, and clinical AI developers leverage possessory control, contractual licensing, and technical architecture to exercise de facto exclusivity over both primary EHRs and derivative datasets, while patients retain only passive rights of non-interference or statutory opt-outs.

Legal Framework / Jurisdiction	Statutory Scope & Primary Mechanism	Data Ownership Status	Patient Rights Recognised	Breach Notification Window
United States (HIPAA / Common Law)	Protects Protected Health Information (PHI) held by Covered Entities & Business Associates.	Rejected per se property rights; custodial model by institutions.	Access, amendment, accounting of disclosures; limited right to erase.	Up to 60 calendar days from discovery.
European Union (GDPR / EHDS)	Protects all personal data of EU residents; includes special category health data.	Non-proprietary; fundamental rights model assigned to data subjects.	Access, rectification, erasure, portability, restriction, opt-out of secondary use.	Within 72 hours of becoming aware.
United Kingdom (UK GDPR / Common Law)	Protects personal health data via equitable breach of confidence and UK GDPR.	Information per se is not property; custodial control by healthcare trusts.	Access, erasure, rectification, portability, breach of confidence claims.	Within 72 hours of becoming aware.

Intellectual Property Enclosures in Derivative AI Workflows

The transformation of raw clinical information by AI agents creates a multi-layered data lifecycle. This progression originates with unstructured inputs, such as physician narrative notes, digital pathology slides, and genomic sequences. These inputs are subsequently processed into intermediate computational representations, including normalised feature vectors, embeddings and latent space matrices. Finally, the workflow culminates in generated outputs, such as synthesised diagnostic summaries, predictive risk alerts, or fully synthetic EHRs. Each successive stage of transformation alters the applicable legal protections, shifting the primary governing regime from privacy law to intellectual property (IP) law.

At the initial ingestion tier, raw clinical observations, such as a patient's vital signs, blood pressure readings, glucose levels, or unedited pathology scans are fundamental factual statements. Under established copyright doctrines worldwide, raw facts, biological metrics, and unadorned medical occurrences lack original human authorship and are strictly excluded from copyright eligibility. Consequently, neither the individual patient whose biology generated the physiological signal nor the attending clinician who recorded the entry holds a copyright in raw medical facts.

When AI agents ingest these facts and translate them into intermediate computational representations, such as high-dimensional vector embeddings or normalised training matrices, the legal framework grows increasingly complex. While specialised database rights, such as the sui generis database right in the European Union, protect substantial investments in obtaining, verifying, or presenting database contents, these rights vest in the institutional database maker (such as the health system or software developer), rather than the individual patients whose records comprise the database. In the United States, where sui generis database protection does not exist, establishing protection over compiled datasets requires proving a minimal degree of creative selection or arrangement under the Feist doctrine, a standard that automated or standardised clinical compilations rarely satisfy.

At the output tier, where an algorithmic agent transforms clinical inputs into newly synthesised records, diagnostic risk scores, or fully synthetic datasets, questions arise regarding whether these derivative outputs generate new intellectual property, and which entity holds title to them. Under current copyright frameworks across the US, EU, and UK, copyright protection strictly requires human authorship. Generative AI outputs produced autonomously by machine learning models without direct human creative control enter the public domain from an intellectual property perspective. While human prompt engineers, data scientists, or clinicians who exercise creative command over model architecture and output curation may claim copyright over specific original diagnostic narratives or bespoke selections, the underlying statistical models and raw computational data remain un-copyrightable.

Because copyright and patent laws offer limited mechanisms for securing exclusive rights over raw or derivative health data, commercial health technology providers rely heavily on trade secrecy and contract law as primary strategies for proprietary enclosure. Trade secret protection applies to information that derives independent economic value from not being generally known or readily ascertainable, provided the holder undertakes reasonable efforts to maintain its confidentiality. Healthcare organisations and AI vendors enclose derivative clinical assets, such as refined algorithmic weights, curated training cohorts, and pre-processed feature maps, by classifying them as proprietary trade secrets.

This strategic reliance on trade secrecy creates a structural disconnect between healthcare providers and patients. While patients are regularly requested to provide broad authorisation or consent for their health records to be used in institutional research or operational improvement, the downstream commercial transformations of that data are subsequently shielded behind trade secrecy assertions and complex Business Associate Agreements (BAAs). The patient's initial data contribution, transformed by an AI agent into a commercial clinical decision support engine or generative model, becomes a proprietary trade secret asset owned exclusively by the technology developer or health system.

Furthermore, explicit statutory exceptions for text and data mining (TDM) in jurisdictions such as the EU and UK permit research institutions and commercial developers to mine large clinical datasets without infringing copyright. These TDM exceptions facilitate the extraction of latent statistical patterns from patient data while insulating developers from copyright liability, leaving patients with no structural mechanism within IP law to claim royalties, financial returns, or ownership stakes in derivative commercial software.

The Consent Imperative and the Emergence of Synthetic Clinical Data

The transformation of patient data by AI agents challenges traditional models of informed consent. Historically, medical consent operated on a point-in-time, purpose-specific model: a patient consented to a specific diagnostic procedure, therapeutic intervention, or defined research study. In contrast, AI workflows require continuous, high-volume ingestion of non-standardised clinical data across diverse patient cohorts to train, validate, fine-tune, and monitor machine learning algorithms.

This friction between static consent models and continuous data ingestion is addressed differently under US and EU privacy frameworks. Under the US Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, Covered Entities (such as hospitals and healthcare providers) are permitted to use and disclose Protected Health Information (PHI) without explicit patient authorization for core operations defined as Treatment, Payment, and Health Care Operations (TPO). Health Care Operations encompasses internal quality assessment, protocol improvement, and the deployment of clinical software tools.

Consequently, health systems can deploy internal AI agents or transfer PHI to third-party Business Associates to optimise clinical workflows under the operations exception without obtaining direct patient consent. However, if the primary purpose shifts from internal operations to commercial software development or external sale, HIPAA mandates explicit, signed patient authorisations, a requirement that is often operationally unfeasible across millions of patient records.

Under the EU GDPR, processing special category health data requires satisfying both an Article 6 legal basis (such as explicit consent, performance of a task in the public interest, or legitimate interest) and an Article 9 condition (such as explicit consent or processing necessary for scientific research or public health). The GDPR enforces strict purpose limitation principles, requiring that data collected for direct patient care cannot be automatically repurposed for commercial AI development without a separate, valid legal basis or fresh consent. Moreover, Article 17 of the GDPR grants individuals the right to erasure (the right to be forgotten), creating technical challenges for AI pipelines. If a patient revokes consent or demands data erasure, removing that individual's contribution from an already trained neural network, a process known as machine unlearning, is mathematically difficult and operationally complex.

To navigate these consent restrictions and cross-border data transfer liabilities, healthcare institutions and AI companies are increasingly utilising synthetic health data. The pipeline for creating compliant synthetic data involves selecting a source patient cohort, pseudonymising identifiers, and passing the pre-processed records into a generative architecture (such as Generative Adversarial Networks or Variational Auto Encoders). By injecting differential privacy noise during generation, the system outputs an anonymized synthetic dataset that preserves population-level statistical traits without copying individual patient records. Proponents argue that synthetic data provides privacy by design, eliminating personal identifiers and operating outside regulatory boundaries like HIPAA or the GDPR.

However, emerging legal guidelines and cryptographic privacy research indicate that synthetic data is not automatically anonymous or exempt from privacy regulations. Creating a synthetic health dataset requires ingesting real patient records to train the underlying generative model. This initial ingestion constitutes processing of personal health data, requiring a valid legal basis, purpose limitation compliance, and appropriate data protection impact assessments under both HIPAA and the GDPR.

Furthermore, standard synthetic data generation remains vulnerable to advanced re-identification attacks. The primary vulnerability stems from Membership Inference Attacks (MIAs), wherein an adversary with query access to a synthetic data generator or synthetic dataset uses statistical inference tools to determine whether a specific real individual's record was included in the original training cohort. If a generative model overfits on rare disease profiles, unique drug interaction histories, or granular demographic combinations, the resulting synthetic dataset preserves unique mathematical signatures that allow adversaries to reconstruct real patient attributes.

This reality has led to tighter regulatory standards. The European Data Protection Board (EDPB) established strict anonymisation guidance requiring that re-identification must be reasonably impossible, taking into account all means reasonably likely to be used by third parties, including sophisticated adversarial membership inference attacks. Under this standard, synthetic data generated without formal mathematical privacy guarantees fails to qualify as anonymous data and remains fully subject to GDPR enforcement.

Similarly, under US law, synthetic health data derived from PHI must satisfy either HIPAA's Safe Harbour method or the Expert Determination method to be recognised as de-identified data. Because synthetic datasets maintain granular statistical correlations across complex clinical variables, they often fail the Safe Harbor standard. Consequently, health organisations must engage qualified statisticians to conduct formal risk evaluations under the Expert Determination method, verifying that the probability of re-identification via linkability or membership inference remains minimal.

To satisfy both US and EU regulatory standards simultaneously, state of the art synthetic health data architectures implement formal cryptographic privacy frameworks, primarily Differential Privacy combined with pre-generation pseudonymisation. By injecting bounded mathematical noise during generator training, Differential Privacy guarantees that the presence or absence of any single patient record in the training set has a strictly bounded effect on the output distribution. For clinical AI applications, differential privacy budgets set between 3 and 10 have been shown to preserve clinical utility for diagnostic validation while mitigating membership inference vulnerabilities.

Synthetic Data Tier	Statutory Scope (US / EU)	Anonymisation & Regulatory Standard	Dominant Vulnerabilities	Technical Architecture & Mitigation
Unbounded Generative Synthetic Data	Ingestion phase regulated; output may remain PHI/Personal Data.	Fails EDPB All Means test; fails HIPAA Safe Harbour.	Membership Inference Attacks (MIA); attribute inference; model overfitting.	High statistical fidelity; zero noise bounded safeguards; vulnerable to extraction.
Expert-Certified Synthetic Health Data	De-identified under HIPAA Expert Determination; conditional under GDPR.	Requires formal statistical certification of low re-identification risk.	Linkability with external public datasets; rare disease profile reconstruction.	Statistical auditing; Wasserstein distance validation; membership inference testing.
Differentially Private (epsilon-DP) Synthetic Data	Exempt from GDPR/HIPAA if $\epsilon$ budget is provably bounded.	Satisfies EDPB reasonably impossible re-identification standard.	Utility loss in rare disease cohorts if privacy budget (epsilon) is over-constrained.	Pre-pseudonymisation, bounded DP noise injection, isolated entity mapping.

Litigation Precedents, Enforcement Trends and the European Health Data Space (EHDS)

The friction between commercial health AI deployment, statutory privacy frameworks, and patient consent has triggered a wave of litigation and regulatory enforcement actions across the United States and Europe. These actions establish clear boundaries regarding unauthorised data transfers, commercial tracking tools, and institutional non-compliance.

In the United States, privacy class action litigation has increasingly targeted the undisclosed interception and transmission of patient portal interactions to third-party advertising platforms. In In re Meta Pixel Healthcare Litigation, pending in the US District Court for the Northern District of California, plaintiffs alleged that healthcare providers integrated Meta's proprietary tracking code (the Meta Pixel) into patient portals and scheduling web properties. The software contemporaneously intercepted and redirected sensitive health communications, including patient portal login events, appointment requests, diagnostic searches, and physician choices, to Meta Platforms for monetised target advertising on Facebook and Instagram without patient knowledge, authorisation, or valid HIPAA disclosures.

The federal court rejected Meta's motions to dismiss key counts, allowing claims brought under the Electronic Communications Privacy Act (ECPA), state wiretapping statutes (such as the California Invasion of Privacy Act), and common law breach of contract to proceed. The court rejected Meta's defence that tracking pixel interactions on public-facing hospital pages were exempt from privacy rules, establishing a legal precedent that contemporaneous interception of patient portal interactions constitutes an actionable violation of federal wiretapping and medical privacy standards.

Concurrently, the Federal Trade Commission (FTC) has expanded its regulatory enforcement against digital health applications using its authority under Section 5 of the FTC Act, prohibiting unfair or deceptive commercial practices and the Health Breach Notification Rule. Enforcement actions against entities such as GoodRx, BetterHelp, and Premom established that sharing sensitive user health metrics, prescription histories, or fertility tracking data with commercial advertising networks without explicit, affirmative consumer consent constitutes an unfair and deceptive trade practice. The FTC forced these entities to pay substantial civil penalties, mandated the permanent deletion of unlawfully gathered data and derivative algorithmic models, and prohibited the disclosure of health data for advertising purposes.

In the United Kingdom, early efforts to commercialise patient datasets for AI development ran afoul of common law confidentiality rules. A prominent precedent occurred when the UK Information Commissioner's Office (ICO) investigated the transfer of 1.6 million full patient records from the Royal Free NHS Foundation Trust to DeepMind Technologies (a subsidiary of Alphabet) to develop the Streams clinical alert application. The ICO determined that the Royal Free Trust processed patient records without a valid legal basis or adequate statutory authority. The regulator emphasised that storing, structuring, and formatting trust-wide patient datasets for commercial software development could not be justified under implied consent for direct patient care, establishing that secondary AI development requires explicit legal authorisation, statutory grounds, and transparent patient notice.

To resolve these regulatory bottlenecks and establish a structured pipeline for medical innovation, the European Union enacted Regulation 2025/327, creating the European Health Data Space (EHDS). Published in the EU Official Journal on March 5, 2025, and taking effect on March 26, 2025, the EHDS introduces a binding statutory regime for both primary clinical care (EHDS1) and the secondary reuse of electronic health data (EHDS2) for scientific research, public health, regulatory assessment, and health AI development.

The EHDS framework restructures European health data governance by establishing public sector bodies known as Health Data Access Bodies (HDABs) across all EU Member States, connected through the cross-border digital infrastructure HealthData@EU. Under this regime, designated Health Data Holders, including hospitals, clinical research institutions, biobanks, and electronic health record software manufacturers, are legally obligated to make their electronic health datasets available for permitted secondary uses. When an HDAB issues an approved data permit, the data holder must provide the requested health data within three months. Failure to comply exposes health data holders to administrative fines of up to 4% of their annual worldwide turnover.

Data access under the EHDS is tightly controlled through a secure processing pipeline. Commercial AI developers, life sciences companies, and academic researchers acting as Health Data Applicants must apply to an HDAB for a specific data permit. Processing occurs exclusively within cloud-based Secure Processing Environments (SPEs) managed by HDABs. Data applicants can execute analytical scripts and train AI algorithms inside the secure environment, but they are strictly restricted to downloading non-personal, fully anonymised statistical summaries or synthetic outputs. Permitted secondary purposes include scientific research, public health monitoring, treatment optimisation and validating AI systems, whereas commercial advertising, marketing, re-identification, or adjusting insurance risk models are strictly prohibited.

To balance innovation with individual autonomy, the finalised EHDS text grants EU citizens a statutory right to opt-out of having their personal electronic health data used for secondary purposes. Once an individual exercises an opt-out, their personal health records cannot be processed for new secondary data permits approved after the opt-out date. However, to maintain research integrity and prevent dataset bias, the opt-out right does not apply retroactively to datasets that have already been anonymised or where the data holder cannot link the opt-out register to pseudonymised records. The EHDS thus creates a public access gateway that bridges privacy protection and commercial data access, mitigating the liability risks that historically hampered health AI innovation.

Strategic Perspectives and Institutional Implications

Synthesis of Ownership Dynamics

The legal reality surrounding AI-transformed clinical data demonstrates that traditional concepts of individual patient data ownership do not exist in modern legal systems. US common law, English equity doctrines, and EU statutory privacy frameworks consistently decline to confer tangible property rights in raw or derivative health data onto individual patients. Instead, functional control concentrates among institutional data custodians, hospitals, academic medical centres, and cloud technology companies, that leverage physical database possession, contractual licensing, trade secrecy and technical access controls to exercise de facto commercial exclusivity over derivative clinical datasets and algorithmic weights.

Raw patient observations cannot be protected by copyright, as physiological signals and clinical facts lack original human authorship. Furthermore, because copyright law mandates human creative contribution, pure machine-generated outputs produced autonomously by AI models fall into the public domain. As a result, healthcare institutions and technology firms rely on trade secrecy and contractual enclosures to protect derivative clinical assets, shielding their commercial AI products behind non-disclosure agreements, Business Associate Agreements, and proprietary platform architectures.

Traditional models of point-in-time informed consent are fundamentally ill-suited for continuous health AI workflows. While US HIPAA frameworks grant health systems latitude to process PHI for internal quality operations without direct authorisation, commercialising that data externally requires explicit authorizations that are often operationally unfeasible across large populations. Conversely, European frameworks reject broad consent, enforcing strict purpose limitations, data minimisation principles and rights to erasure that complicate standard machine learning pipelines.

Furthermore, synthetic health data does not represent an automatic privacy workaround. Generative models trained on real patient records remain vulnerable to Membership Inference Attacks and statistical re-identification. Regulatory guidance from the European Data Protection Board enforces a strict all means test, mandating that synthetic datasets remain subject to full GDPR oversight unless protected by formal mathematical guarantees, such as Differential Privacy (\epsilon -DP) and certified under rigorous audit protocols. Regulatory policy is consequently shifting from localised private licensing toward centralised, state-governed health data architectures, as demonstrated by the European Health Data Space.

Operational Strategies for Clinical AI Stakeholders

Health AI developers and enterprise healthcare providers must adjust their operational compliance frameworks to address these legal realities:

Health AI developers utilising synthetic datasets must embed Differential Privacy directly into generative model training architectures and perform empirical Membership Inference Attack audits to ensure compliance with EDPB and HIPAA Expert Determination standards.

Healthcare networks and commercial AI vendors should transition away from direct dataset transfers toward Secure Processing Environments (SPEs) and federated learning architectures, ensuring that third-party developers only access non-personal, aggregated algorithmic outputs.

Global life sciences companies and health technology vendors must harmonise their internal data catalogues and compliance protocols with EHDS secondary-use requirements under Regulation 2025/327, preparing for mandatory data provision rules and structured opt-out management mechanisms.

Finally, healthcare institutions must eliminate ambiguous data ownership terminology from vendor agreements, replacing broad proprietary claims with precise contractual terms governing possessory rights, trade secret boundaries, permitted operational uses, and intellectual property allocations for downstream algorithmic derivatives.

Nelson Advisors > European HealthTech, MedTech, Digital Health Investment Banking

Nelson Advisors specialise in Mergers and Acquisitions, Partnerships and Investments for Digital Health, HealthTech, MedTech, Health IT, Consumer HealthTech, Healthcare Cybersecurity, Healthcare AI companies. www.nelsonadvisors.co.uk

Nelson Advisors regularly publish Thought Leadership articles covering market insights, industry trends, deal commentary, market analysis & predictions @ https://www.healthcare.digital

Nelson Advisors publish Europe's Leading Healthcare Technology Investment Banking Newsletter every week, join 5000+ HealthTech and MedTech subscribers today! https://lnkd.in/e5hTp_xb

Nelson Advisors pride ourselves on our DNA as ‘Founders advising Founders.’ We partner with entrepreneurs, boards, corporates, venture capital and private investors to maximise shareholder value and investment returns www.nelsonadvisors.co.uk

#NelsonAdvisors #HealthTech #MedTech #DigitalHealth #HealthIT #Cybersecurity #HealthcareAI #FemTech #ConsumerHealth #Mergers #Acquisitions #Partnerships #Growth #Strategy #NHS #UK #Europe #USA #Canada #Commonwealth #CorporateDivestitures #VentureCapital #PrivateEquity #Founders #SeriesA #SeriesB #Founders #SellSide #TechAssets #Fundraising #BuildBuyPartner #GoToMarket #PharmaTech #BioTech #Genomics