2.1. Provenance, Property Rights, Agency, and Stewardship

Institutions often exercise patient data governance from the perspective of institutional data ownership, which often complicates and impedes institutional and patient participation in clinical trials. Agency translates to who gets to decide how data is used; this is usually the institution within the confines of the consent the patient or research participant provides. The institution tends to view data stewardship as a liability, so there is a strong aversion to sharing. Importantly, the institution supersedes patient agency in that the institution often directs and restricts data use, regardless of the wishes of the patient. This reality limits developing a data commons of our healthcare systems across the world [14]. Due to a focus on ownership and control instead of the many social and medical benefits inherent in sharing medical data, institutional stewards get caught up in a protective stance ensuring absolute privacy. Health data stewards emphasize the protection of the institution from the real and substantive liabilities associated with the Health Insurance Portability and Accountability Act (HIPAA) and the real and perceived privacy risks for patients. In fact, it has been argued that HIPAA is heavy on accountability and light on portability [15]. Another legal framework involves the Genetic Information Nondiscrimination Act (GINA), a law designed to provide guidance on consent and privacy requirements for genetic data in the United States [16]. Research participation, consumer genetic testing, and the inherently relational nature of genetic information increase the vulnerability of prevailing privacy preservation practices for genetic data [17]. Use of genetic data in health models presents challenges requiring highly specialized skills that transcend law, medicine, science, and information technology. Institutions recognize the risks in this realm of health AI, and thus, it is fraught with risk aversion tactics that severely limit scientific progress. A full accounting of the implications of GINA in the health data AI value chain is beyond the scope of this paper, but several reviews cover the topic well [16–19]. As we demonstrate below, there are jurisdictional considerations impacting health data available on platforms like Kaggle and the Cancer Imaging Archive [20]. The General Data Protection Regulation (GDPR) in the EU and HIPAA and GINA in the United States involve very different compliance implications. Tracking the provenance and appropriability of health data is going to be increasingly necessary to navigate these legal ecosystems and make audits practical.

Those that have negotiated contracts to get access to patient data from a hospital system, insurance company, or a pharma company sponsoring a clinical trial appreciate the fact that patient data stewardship is a multiagency problem. First, the property rights of the institution come into play with the legal issues inherent in laws, policies, and common practices in institutional stewardship of patient data. Second, sometimes such data may involve third-party rights if obtained through work with a payer/insurer, a health information exchange (HIE), clinical trial sponsor, or a data clearinghouse such as the All Payer Claims Database. Third, patient agency also comes into play in the form of ensuring the patient has provided informed consent for the intended use of data. Informed consent involving genomic data that is coupled to patient-level medical record data (clinicogenomic data) involves many thorny issues associated with secondary use, and some statutory safe harbors for clinical care (quality improvement) [21] and secondary research use [22], with patient [22], researcher [23], and institutional stewardship [24] considerations.

2.2. The Knowledge Base and Complexity

The canonical genetic code has four deoxyribonucleotides and four ribonucleotides, encoding 26 amino acids that can be assembled into an unlimited number of proteins with an almost limitless diversity of functions. This diversity of biomolecules also entails a number of regulatory domains ranging from genetic, epigenetic, translation, posttranslational, cellular, structural, and integrated signaling. The structure of biology in general results in five domains of high dimensional complexity [25]: epigenetic, sequence, functional, structural, and environmental domains.

In medicine, the knowledge bases used to train AI models are vast. LLMs have proven transformational in accelerating human utilization of the vast and exploding scientific literature. In essence, LLMs have enabled a massive and powerful pattern recognition tool as a viable alternative to trying to simulate and computationally interpret the complexities of biology de novo. The expanse of the medical literature is unknown, but NSF estimates range from over 3.3 million to over 37 M citations in PubMed. Importantly, the medical knowledge base reflects a rather limited human understanding of the interplay of biological factors (genetics and epigenetics) with the environmental components (nonbiological determinants of health). Nonbiologic determinants of health reflect interactions with the healthcare system and broader social domains such as occupation, geography, environment, and behavioral factors and finally inherent biologic determinants. A recent axiom in public health has emerged: The zip code is a more significant contributor to health outcomes and life expectancy than the genetic code [26]. So the models based on observations of past patient and disease case studies, going beyond biologic and mechanistic considerations, are proving of greater utility than models predicated purely on the biology knowledge base.

2.3. Appropriability

One of the most frequently used tools to navigate the multiagent patient data problem is deidentification of health data. The 18 identifiers enumerated by HIPAA are removed from the health data being shared with the intention that such data would no longer be able to be traced back to an individual patient. It is questionable whether the removal of HIPAA identifiers is truly privacy preserving [27], especially when genetic data are involved. Indeed, genetic information can be used to link sequences to the faces of individuals [28]. The public benefits versus privacy trade-offs of genomic databases are illustrated by law enforcement use of these databases to link evidence from crimes to individuals. This is an example of some of the practical, social, and policy countercurrents at odds with the intention of absolute privacy preservation with health data [29]. Whether absolute privacy is an immutable human right or is even achievable is beyond the scope of this concept paper; however, it is clear that the concept of patient-centric data agency is an increasingly important and unaddressed policy consideration in health data stewardship.

Deidentified patient data that finds its way into a database, data commons, data fabric, or knowledge base is largely devoid of economic appropriability. Appropriability is an economic concept where a contribution to a social benefit can be attributed directly back to an individual or organization. In science, this is achieved by citation; in innovation, this is achieved by patents; in business, this is accomplished with financial securities; in real estate, this is achieved via a deed. By definition, privacy preservation generally forecloses backtracking the provenance chain of a data element to the patient it came from originally. The paradox of openness states that innovation requires openness, but commercialization requires property rights protections [30]. This is a challenge that very much vexes the application of AI to healthcare. Patient data is an increasingly important contributor to the innovation ecosystem as a byproduct of healthcare services, clinical trials, and biomedical research [31]. Some of the great economic thinkers of the last century, Joseph Schumpeter and Elinor Ostrom, have done foundational scholarship on the concepts of appropriability and the role of a public commons in innovation ecosystems. In many respects, the private property rights associated with appropriability (i.e., patents and copyrights) may seem at odds with the notion of a public commons.

This is certainly true with a finite resource such as an aquifer or a limited term monopoly for a drug (i.e., a patent) introduced into a rare disease market. William Press, in his 2013 Presidential Address to the American Association for the Advancement of Science, makes elegant arguments that appropriability and intellectual capital are increasingly important co-contributors to the scientific advancement and economic development associated with heavy-tailed advances in medical science [32]. By heavy-tailed events, Press means infrequent events with outsized impact such as the discovery of a new molecule such as an immune checkpoint inhibitor like pembrolizumab (Keytruda) that would require hundreds of millions of dollars to test in clinical trials. Appropriability enables a means to recover those investments and thus serves as an incentive for those investments. Ostrom published a framework in 1990 for Governing the Commons [33], which provided eight parameters for successful community-based resource management (actor group boundary clarity, social-ecological fit, external recognition, multiple levels, commons boundaries, proportionality, participation in rulemaking, environmental monitoring, self-monitoring, self-sanctions, conflict resolution, and the Ostrom principles). However, data is not a depletable resource, and its use to build predictive models for medical care is really an example of the economic concept of coproduction, as described by Ostrom [34, 35]. When Ostrom introduced the concept of coproduction, it established the basis for public–private partnerships in economic production. In the realm of health data, an example is Medicare or the Veterans Administration working with health insurers and pharmacy benefit managers to collectively produce adherence and utilization data that has enormous value to train AI models. Yet the increasing economic utility of benefits derived from data and models does not flow back to patients because maintaining appropriability of that data across the data journey is currently administratively intractable. This is in large part due to the multiagency problem and privacy preservation impetus of health data practices and policies [15]. Blockchain technologies that enable granular data agency through tokenization have unlocked emergent data economics in financial technology (i.e., Chainlink DECO) [36, 37], oil and gas (i.e., Data Gumbo) [38], music (i.e., Napster 3.0) [39], and even incentivizing hyperlocal weather forecasting through tokenized weather data (i.e., WeatherXM) [40, 41]. These use cases portend an emerging data economy for personal health data. In his theories on creative destruction and monopolistic practices, Schumpeter offers thoughts on how the inertia of the status quo impedes the deployment of new commodities (i.e., data) and new technologies (i.e., AI models) by deploying protective devices that preserve advantages for economic incumbents and defer the erosion of monopolies by innovators. An example of this in healthcare would be policy advocacy (lobbying) against new payment models for telehealth to preserve the number of hospital encounters for a healthcare system with a large real estate footprint. It can be argued that innovation in the healthcare industry is vulnerable to such tactics as health data becomes an increasingly important contributor to innovative advances and the commercial toolkit. While companies in the health informatics arena have done much to advance cancer care by collecting and aggregating data, for example, in cancer clinicogenomics [15, 31, 42–44], the US healthcare system data mesh lags behind others like the United Kingdom (UK Biobank) [45], Taiwan (Taiwan Biobank) [46], and even Estonia (Estonian Biobank) [47] in access to population-scale datasets. Industries reliant on health data benefit from economies of scale and network effects, especially in clinicogenomics [48].

The powerful network effects enabled by digital aggregation of consumer data at population scale by the Siren Servers represent a model for collection and curation of consumer data in exchange for free services. Siren Servers is a business model term coined by Jaron Lanier, named after the Sirens of Odysseus from Homer’s The Odyssey. Network effects have benefitted the corporate stewards of social networks and digital communications companies such as Google, Meta. In healthcare, Foundation Medicine and Flatiron Health (initially founded and funded by Google executives) are examples of networks enabling population-scale curation of molecular diagnostic data in cancer patients [49]. In the Siren Server model, consumers share their data in exchange for free services. In healthcare, there really is no such model where free healthcare services are achievable for sharing one’s health data. Lanier argues that the more consumer-centric (or in this case, patient-centric) the model, the more it can return social benefits, agency, and even wealth to the masses in exchange for the data they share. In Radical Markets, Microsoft economists Posner and Weyl further the argument for a more decentralized data ecosystem in liberating data stewardship from institutional practices that are designed to maintain the status quo. Posner and Weyl’s work is predicated on the idea that property rights are inherently monopolistic, and they put forth a new concept of partial common ownership as an alternative to corporate, state, or social ownership to maximize economic utility of an asset. This is similar to Ostrom’s concept of coproduction. Such a paradigm has great potential to address inequities and disparities in healthcare and allow the power of the network to empower the healthcare consumer, not the private owner of the network (in Lanier’s example, the Siren Server businesses dominating an industry niche sector). This framing is not intended to be pejorative with respect to industry practices, only to illustrate the tensions and trade-offs between shareholder versus social benefits of different data stewardship models and the inherent incentives for centralized versus decentralized models of stewardship. To be clear, private investments in tumor sequencing companies have provides a large net social benefit [15] and contributed to remarkable improvements in cancer survival [44].

In Read, Write, Own, venture capitalist Chris Dixon makes a compelling case that in the Web3 paradigm, the network effects of data contributions by creators to the data fabric have great potential to accrue directly to the creator [3]; in other words, Web3 enabled appropriability. Credit bureaus, genetic testing companies, social media companies, and even the companies who curate warranty cards have managed data networks with sensitive consumer data. These firms have been entrusted with stewardship of sensitive consumer data for many years, sometimes with social benefit, occasionally with privacy breaches, and sometimes at odds with consumer or societal interests and agency. Dixon argues that Web3 architectures might enable sustainable decentralized data networks and incentivize righteous and decentralized scaling of these networks. That is, noncorporate, nongovernmental, patient-centric [15, 50] population-scale medical data collections can be self-sustaining and feasible using Web3 governance frameworks. Indeed, blockchain ledger technology was designed to make work done on networks (i.e., data creation, computation, and validating disintermediated transactions) directly attributable and appropriable to creators (i.e., a bitcoin miner or data contributors). See proof-of-work versus proof-of-stake for a deeper perspective on appropriability with respect to data and computational work [51]. A patient-centric data commons fits this paradigm of creative contribution to the network.

Blockchain ledgers were designed purposely to layer an immutable property right on a piece of data. That data can be a bitcoin, a nonfungible token, or my genome sequence (or a fraction thereof) that has inherent value if used in accordance with my wishes [52, 53]. The ideal is a data commons where all stakeholders in the multiagency problem of health data sharing have a property right and incentives to share [15] and curate [35]. There are nuanced considerations regarding whether blockchain networks for certain uses should have public, private, or semiprivate ledgers, proof-of-work versus proof-of-stake models, and the computational throughput of the Layer-1 platforms on which they reside (i.e., Ethereum, Hyperledger, Solana, and Sui). However, blockchain ledgers provide a technology architecture and a practical means to impact appropriability to health data throughout the data journey [52]. The idea that blockchain ledgers undermine privacy is a misnomer and false attribute—private blockchain network functions are purely at the discretion of network governance and can be as private or open as desired. These architectures are however decentralized and thus immutable by design [54], so trust of institutions or stewardship is not necessary for the platform to provide a trustless data transit. Trustless means: No trust of intermediaries is required to transact, as would be the case in current models of health data sharing where there are large trust barriers between institutional stewards and data users. Importantly, new technologies are being developed that connect the provenance and lineage of data elements used to train an AI model with cryptographic validation at all points in the model lifecycle and across the data governance continuum [55]. These technologies provide powerful tools to manage model quality and decay over time. In effect, provenance of the data and provenance of the model are both increasingly important in the implementation of individual health data into AI models. Indeed, Dixon argues blockchain networks are a new and specialized type of large-scale computer that keeps track of data use and data users in an immutable, distributed ledger across time. A patient’s health data is many things: It is intellectual property, it is a commodity, and certain packaging and validation metadata around it make it comparable to a security; for these reasons, health data becomes valuable property. As such, Web3 architectures can be a tool to help enable disintermediation of data governance, privacy preservation, and demarcate intellectual property rights simultaneously, perhaps unlocking the paradox of openness. These exciting new technologies can soon allow any one of us to share our genomic data, when and with whom we choose, for purposes we can know a priori, and follow where the data contributed to AI models, scholarly results, and other social goods that we care for as a consumer, a patient, and a citizen.

There are only a few instances of blockchain technology being deployed for health data management [56]. The most prevalent use cases explored to date have been internet of things for medical sensors, genomics, and medical records [56]. Blockchains provide tools for governance and provenance of data, but are not inherently privacy preserving by themselves. Encryption technologies are a nice complement that can enable computing on encrypted data (i.e., homomorphic encryption) [57, 58]. Nebula Genomics and LunaDNA pioneered the use of blockchain technology to enable patient-centric genomic data sharing for their sequencing business and as a means to provide rewards and compensation directly to consumers sharing data [59]. Zenome [60] and Genecoin [61] both represent examples of the data economics token business model GitHub and blockchain ecosystems about with health data sharing projects and networks [56]. Most of these examples are on private blockchain architectures, restricted to validated, credentialed, or authenticated users. Such an approach has been developed for clinical research achieving somewhat limited achievement of FAIR (findable, accessible, interoperable, and reusable) principles [62].

MedRec was a concept paper using proof-of-work data economics to reward data sharing from medical records [63, 64]. There is no indication of successful implementation of this approach in the scientific literature. Moving data from medical records is particularly challenging in the United States compared to nationalized health systems like the United Kingdom or Canada. In the United States, many different hospitals and health systems hold stewardship over data from the patient journey. Each of these organizations has different practices for managing compliance and different data standards and ontologies, which collectively impede incentives for interoperable data sharing. However, the potential for blockchain-based data governance models to remove governance barriers to data sharing adds to the impetus to address standardization and interoperability barriers.

The distributed ledger ensures an immutable and tamper-resistant record of data transactions in support of provenance and transparency [43]. This can provide greater transparency and enable dynamic consent management where patients can provide or revoke access. Smart contracts can automate and digitally enforce data use agreements, solving the multiagent problem in health data. Blockchain architectures can enable tokenization, monetization, and other reward structures for sharing data and doing computation work (using proof-of-work [65] or proof-of-stake [66] frameworks).

There are two significant hurdles to using blockchains for stewardship of health data. The first is getting health data out of traditional stewardship silos in health systems that lack incentives and have strong disincentives to accommodate patients’ sharing of their health data. A second constraint is specific to high-density data like image data and large-scale genome sequence data. The throughput of blockchain networks in validating transactions using smart contracts is dependent on the amount of data in a block and is impeded by large blocks of data such as .bam.dicom, and .vcf files. Off-chain storage and object-oriented ledgers provide mitigation strategies (see review by Kasyapa for more details on constraints and mitigation approaches) [67]. Recent efforts to implement data standards and application programming interfaces (APIs) have been guided by the need for continuity of care documentation using HL7, FHIR frameworks with structured data formats (JavaScript Object Notation [JSON] and Representational State Transfer [RESTful]), and APIs [68]. The myriad data schemas and standards entering practices are reviewed thoroughly elsewhere [69]. The maturation of these standards is increasing uniformity across the health ecosystems of the United States, and as HIEs achieve scale in the tens of millions of patients [70] and consolidate, barriers to data linkage for research and analytic applications are lessened.

2.4. Democratizing AI and Distributed Computing

AI models are not new. The use of citizen science models to build, validate, and train AI models is also not a new practice. Before the LLMs were announced with much fanfare in 2021, the Rosetta Project and Folding@Home achieved exascale (a billion, or 10¹⁸) operations per second by recruiting personal computers and gaming consoles into a massive, distributed computer to computationally fold proteins to optimum thermodynamic stability. Folding@Home has been an ongoing project for nearly 25 years (since 2000) [71]. These are examples where citizen science has primarily been limited to the use of distributing computing resources coupled with public databases about protein sequences and thermodynamics. An emerging opportunity is for blockchain to help accelerate innovation by making it easier to obtain data from distributed sources, including real-world case-level patient data for the design of machine learning models that are personalized and inform precision medicine practices. Put another way, citizens can contribute their health data to scientific enterprise at the intersection of open data and citizen science. A distributed data fabric that can instill agency and privacy for patients for health data is crucial to unlock this resource but is within reach.

An example of citizen science is a high school demonstration project [72], with students participating virtually from around the world, to build a convolutional neural network (CNN) to classify oral squamous cell carcinoma (OSCC) from magnified histopathology images of the epithelium of the oral cavity using machine vision (surface images of the oral cavity). Computational resources, pre-existing code from foundational models, and guidance were readily available. Obtaining the necessary data became the most limiting part of the project. It is not unusual for data scientists to lack expertise in medical science and vice versa.

A limited dataset from Kaggle [73] was utilized to build the network. This dataset included 89 images at 100× magnification of OSCC samples and 201 images at 400× magnification of the normal epithelium of the oral cavity, in addition to 439 images at 100× and 495 images at 400× magnifications of OSCC [73]. As is typical for publicly available deidentified datasets, not much additional information was available, and important variables such as the stage of cancer for positive samples, whether the cases were successfully treated or whether the lesions had metastasized, were missing. Importantly, an inherent limitation of such public, deidentified databases is that the researcher cannot go back to obtain additional information that may help improve the model.

The images were collected using a Leica ICC50 HD microscope from hematoxylin/eosin (HE)-stained tissue slides from a total of 230 patients, prepared, and cataloged by experts [73]. How would this model or classifier perform with images obtained using different optics? Is the training data biased, such that images from a different pathology lab source or different optics might not be classified appropriately? Ideally, for most models, additional information about the patient and the methods of sample acquisition would be useful to validate model performance and address biases inherent to the model. But for deidentified data, working backwards in the data journey is not possible.

Images were used to train three models: a VGG16 CNN [74], a Resnet50 CNN [75], and an InceptionV3 CNN [76] that were imported from the DL framework libraries TensorFlow [77] and Keras [78]. The imported models were refined to ensure compatibility with the histopathology dataset [73]. The corresponding accuracies of each of the models in detecting the presence or absence of OSCC from histopathology images of the epithelium of the oral cavity were 85.18% accuracy, 58.41% accuracy, and 80.91% accuracy for the VGG16 CNN, the Resnet50 CNN, and the InceptionV3 CNN, respectively. Additionally, a standard CNN [79], an EfficientNetB3 CNN [80], a VGG16 CNN [74], and an LSTM CNN [81] were designed using a previously existing oral cancer repository from GitHub [78, 82]. The model was tweaked to ensure compatibility with the data and then trained using data from another dataset containing 87 images of oral cancer and 44 images of the regular oral cavity [83], with the goal to detect OSCC using images from the oral cavity. The images were captured in various hospitals in Ahmedabad, India, and classified into cancerous or noncancerous groups [83].

The corresponding accuracies of each of the models in detecting OSCC from images of the oral cavity were 66.67%, 66.67%, 62.15%, and 63.33% for the standard CNN, the EfficientNetB3 CNN, the VGG16 CNN, and the LSTM CNN, respectively. After training and testing was completed, the accuracy of each model was tested using the T4 GPU cloud computing option in Google Colab. The most accurate model and dataset combination was the VGG16 CNN [74] with the histopathology dataset [73] with an accuracy of 85.18%. This level of performance is likely not adequate for most diagnostic or prognostic clinical use and leaves significant uncertainty unresolved. Larger and better annotated datasets are required to train and validate such models, putting some applications just out of reach of the citizen scientist, motivated student, or researchers in developing nations. Cloud computing has enabled people to work collaboratively in teams to create and improve models, thus harboring and promoting innovation. While one of the models was accurate when tested to detect OSCC on the images from the histopathology dataset [73], the model accuracy of the model was limited, especially for patients outside of the dataset.

In this example, laptop computing was inadequate, but resources on Google Colab platform were leveraged to train and validate the model. Google Colab is the most frequently used among several cloud computing services, offering scale and compute throughput advantages compared to localized machine computing. Colab “enables resource sharing on cloud systems, allowing different functions to operate simultaneously across multiple different platforms” [84]. The datasets used do not represent the diversity of OSCC in the human population. The demographic and clinical details of the provenance of these data are mostly unknown (see Kaggle depository) [73, 83]. Pigmentation, shapes of lesions, depth of lesions, stage of lesions, image capture technology for photographs, lens optics, and staining technology for micrographs are all factors where variation is unlikely represented in such a small sample set. However, as blockchain technologies advance and are further integrated into society, such data will be easier to access (interoperability), data will be of higher quality (immutability), and data will be more comprehensive (trustless networks). Trustless networks and smart contracts will allow for a more extensive user group to view the data and ensure control over the data and more providers of data to share data [85]. Data immutability will allow for higher quality data by ensuring no data manipulation and allowing for the viewing of previous versions of the data for more control in the design and reliability of a model over time. Interoperability will allow for the facile aggregation of different data elements from more patients and incorporate more inputs in the design of a model. The control that blockchain affords ML models has the ability to significantly increase both the number of ML models being designed and their accuracies.

A note of caution with the open data governance architectures presented is warranted. The private sector undoubtedly plays an important and indispensable role in the data ecosystem [15, 86]. Investment incentives for collection, curation, validation, and quality control of knowledge bases are functions that the private sector is well-suited and highly capable of cultivating for societal benefit. In 2021, DeepMind’s AlphaFold made a breakthrough enabling it to produce folded protein structures highly concordant with ground truth (x-ray crystal structures), in contrast to the thermodynamic functions of the Folding@Home project. Over 200 million protein structures are now available from the DeepMind knowledge base in the public domain. Both AlphaFold and Folding@Home have made distinct, large, and transformational contributions to biomedical science. Contrast this example of citizen science involving limited data with the UK Biobank’s recently announced largest ever functional study of the human proteome [87] that goes beyond the structural information of AlphaFold and Folding@Home. This vast dataset has revealed over 14,000 associations between genetic variants and plasma proteins from analysis of over 3000 proteins in the blood of 54,000 research participants. In addition to whole genome sequences, these patient samples have deep clinical annotation including details about the diseases individuals have reported, their socioeconomic and demographic details, and even MRI scans. The work was funded by 13 biopharmaceutical companies and conducted by over 20,000 scientists in over 50 countries. Imagine a ledger schema where contributions of research participants, funders, and researchers can be attributed to instances of data use, publication, and discovery of new biomarkers and drug targets. Web3 makes a benefit and attribution sharing waterfall for this kind of network appropriable and practicable, and privacy need not necessarily be surrendered to operationalize it.

Unlike the biological knowledge base surrounding these examples in protein sequence and thermodynamics, largely in the public domain and available for citizen science, such a crowdsourced approach to health data is impeded by the lack of a case-level data commons. The All of Us program has provided a roadmap for many of the impediments to research and modeling with health data [88]. However, the data sharing procedures (by necessity) are still reliant on manual and laborious trust vetting steps for users. The gene expression classifier for pulmonary hypertension published by Bull et al. [12] 20 years ago still cannot be deployed in a dynamic, longitudinal format like a digital twin because moving patient-level data across organization boundaries, whether in a research context or a healthcare context, entails a formidable multiagent challenge. There are ethical, economic, and medical imperatives for the use of information technology to remove frictions, enable trustless collaboration (i.e., federated learning), and instill individual agency (and address multiagency impediments) in data throughout the data journey. Right-sizing the role of institutions as an intermediary in data governance can address disparities in access to data for scientists in developing countries to the corpus of AI technologies in healthcare. However, technology adoption is going to need to overcome legacy practices ossified with regulatory doctrines whose risk–benefit balance has been significantly shifted by social and technological change. Data governance practices need to change and delegate some of the privacy risk to patients themselves to unlock the social benefits of the health data armamentarium.