Private Law Theory

ABSTRACT
Health data systems routinely collect, share, and derive commercial value from patient information while providing patients with little transparency, control, or accountability. Existing frameworks (including privacy law, dataveillance theory, and blockchain-based technical architectures) address portions of this problem but fail to enumerate the full set of rights patients hold over their data, and fail to address the central issue: that these rights, even when recognized in principle, are almost entirely unenforceable in practice. This paper introduces the Unbanked Patient framework – named for the condition of patients who generate extraordinary data value but have no institutional infrastructure to protect their stake in it – derived from a structural analogy between frontier and modern economies: health data today resembles money in a pre-institutional economy, valuable, exchangeable, but unprotected by any accountable infrastructure. We enumerate seventeen individual rights organized into four clusters and add an eighteenth right: the right to organize collectively. We propose the health data cooperative as the institutional mechanism through which individual rights become practically exercisable, and identify the cooperative as the technical infrastructure provider for the population-scale notification architecture the framework requires. The framework incorporates every right established in the OECD 1980 Fair Information Principles, GDPR, and PIPEDA, and adds rights not found in any existing unified framework: affirmative economic rights, directed altruistic donation, individual accountability grounded in professional licensing infrastructure, and the right to object to automated decision-making.

Keshavjee, Karim, The Unbanked Patient: Rights Without Remedy in Health Data Governance (March 18, 2026).