# The Need for Machine-Processable Agreements in Health Data Management +
## 1 Introduction  
Data sharing in health data management is often a tedious and manual process. In different organisations there are usually processes in place so that physicians can share data regarding a particular patient (e.g., a diagnosis, or medical tests' and results) with other medical professionals that care for the same patient. Medical data sharing, either for patient care or for clinical research, requires bilateral, custom-crafted, lengthy data access agreements, written in natural language, and set between clinicians, researchers, and the health institutions. These agreements leave very little space for customisation. More importantly, individual patients have very little voice in how their data isused and shared beyond a high-level consent form that states data may be shared to other consultants. At best, patients are offered a few opt-in/out choices on coarse-grained features of the sharing. This landscape becomes much more complicated due to the nature of medical data, especially in medical genetics where the boundaries of ownership and control of data are blurry and where additional people not initially involved in the clinical process might have an interest or even a right to obtain information and data. For example, the English case of [PERSON] vs. St George's NHS Trust and others was discussed in the High Court in November 2019. The patient ([PERSON]) received a diagnosis of [PERSON]'s disease (HD) - a hereditary condition with a 50% chance of passing it on to offspring - with no cure and likely early death. The patient's pregnant daughter ([PERSON]) did not know of [PERSON]'s condition and that it was heritable, and his clinicians discussed whether she had a right to know. They discussed this with [PERSON], who refused consent for [PERSON] to be told as he was concerned she would terminate her pregnancy. [PERSON], who was later tested and found to have inherited the gene mutation for HD, claims that [PERSON]'s clinicians were neglectful for not communicating his diagnosis to her. Situations like this case will occur more often as genetic testing and genomic medicine is adopted more widely in general medical practice, highlighting the consideration of if and when it may be appropriate to make relatives aware of risks discovered through the testing of a single person, which can be done without breaching confidentiality and without the patient's consent [1]. To address such complex scenarios and requirements, in this paper we advocate the need, and present an initial approach, for machine-processable data sharing agreements in the health data management domain. This paper includes and extends [2]. We evaluate several related approaches and languages for expressing privacy preferences, sharing policies and consent on data-sharing. We find that most of these approaches specify coarse-grained policies, using predefined options, present mostly \"accept/reject\" agreements that do not offer flexibility for partial access, and, most importantly, do not capture the pragmatic necessities that we identify in health, and particular genetic data sharing. A simple scenario which is not expressible in other approaches, and that we would like to capture, is the fact that clinicians might _suggest_ or _advise_ patients to share their data with relatives but the final choice usually lies with patient. People who have genetic tests for hereditary diseases are advised to inform close relatives who may also have inherited the same condition. However, up to 42% of relatives remain uninformed [3; 4; 5; 6; 7]. The result of an individual's genetic test can suggest that close relatives may have the same result, and with this information they can make informed decisions about their own testing, screening programs, or preventative treatment. To understand the processes that take place, we have developed an application, myKinMatters, that allows us to explore how users can specify permissions and consent.