By Yuvraj Walia
A patient with sleep apnea receives a cloud-connected CPAP device. He’s told it will monitor his nightly use, he agrees, and life continues. But this consent has not actually given him meaningful control over his own data. Without any further action on his part, the device records and transmits the duration and pattern of his nightly use. Insurance companies check the data to decide whether to cover treatment. Manufacturers analyze usage patterns. Researchers might access his health data. Advertisers could profile him. And crucially, he cannot reasonably refuse monitoring if he wants the device at all.
This is the consent problem in modern health care. Traditional informed consent was designed for discrete encounters: a clinician explains a procedure, the patient decides yes or no, the event concludes. But health care no longer works that way. Consumer wearables continuously record physiological data. Fertility apps accumulate reproductive histories over months or years. Smart inhalers transmit usage patterns to remote servers. The patient becomes a continuously-measured object—hours, frequency, patterns of use all converted into data points for evaluation.
The Consent Problem
Philosopher Onora O’Neill offers a useful framework. She argues that consent only works as a specific waiver for a defined set of actions. Two questions matter. First, was the consent voluntary and informed? Second, what, exactly, did it authorize?
Voluntariness: When monitoring is bundled with necessary treatment, refusal isn’t really an option. A patient can technically decline the CPAP device, but only by also declining sleep apnea treatment.
Understanding: But even if a patient consents freely, they would lack true understanding of what exactly they have consented to. What inferences will be drawn? Who might access it? What happens after ten years? The information flows are unknowable because they don’t exist yet. Uses get invented after data are obtained, devised by companies the patient has never met. Users face information asymmetries they cannot overcome when evaluating the downstream consequences of sharing health data.
Scope: Consent to monitoring for treatment doesn’t authorize every downstream use. A patient who agrees to CPAP adherence tracking has not agreed to commercial profiling, cross-referencing with other datasets, or algorithmic inferences about his health. Yet standard informed consent theory treats it all as a single blanket waiver.
Crucially, health data can even reveal information about people who never consented at all. For example, genetic tests expose details about biological relatives. Behavioral patterns can generate inferences about entire groups. One person’s data becomes everybody’s, complicating questions of consent.
When Companies Break Trust
Continuous monitoring can genuinely improve care. Remote monitoring of CPAP use can enable timely clinical interventions. Smart inhalers can improve asthma medication adherence. These uses make clinical sense and deserve support. But, as the era of continuous monitoring looms before us, we must distinguish between ethical and corrupt uses of patient data.
The Federal Trade Commission (FTC), it seems, has been drawing that line. In 2021, the agency settled with Flo Health, a fertility app, for sharing reproductive data from 100 million users with outside marketing and analytics firms including Facebook and Google, despite promising to keep data private. In 2023, the FTC settled with GoodRx for $1.5 million, alleging that the prescription discount app shared health information with Facebook, Google, and other advertisers. The agency settled with BetterHelp for $7.8 million for disclosing therapy responses to Snapchat, Facebook, and Pinterest.
In each case, these companies ostensibly promised privacy, then sold patient data to the highest bidder. It seems monitoring itself isn’t a problem, but rather the lack of safeguards for consumer data protection.
Moving Beyond Individual Consent
If consent alone cannot protect patients, what can? Scholars like Helen Nissenbaum have emphasized contextual integrity as a cornerstone of privacy, arguing that downstream uses must respect the context in which the data were obtained. Data collected for clinical purposes should stay within clinical purposes—treatment, management, reimbursement, safety, legitimate research. Uses unrelated to those purposes should require independent ethical justification rather than relying on a patient’s acceptance of monitoring years earlier. In fact, Europe already has data protection laws that operate with such purpose limitations.
Legal restrictions on commercial health profiling can further close the gap. Washington State’s 2023 landmark My Health My Data Act extends privacy protections to health data in consumer apps, limiting the unmonitored flow of data.
Finally, scholars have argued that digital health companies should be treated as fiduciaries. When users face massive asymmetries in information and power, the companies holding data have duties of loyalty. A fiduciary duty would restrict uses that conflict with patient interests, adding legal backing to ethical principles.
Crossroads of Consent
Consent in traditional medicine worked because it was bounded: one clinician, one patient, one intervention, a specifiable set of risks. That world is gone. Health monitoring now runs continuously, across contexts, toward purposes nobody can predict.
The central ethical question should shift from “did the patient consent?” to “what exactly was the patient consenting to, and what responsibilities remain with the institutions collecting this data?” As the boundary between treatment and continuous bodily measurement becomes harder to identify, the answer will determine whether informed consent can remain a meaningful protection for patients.
Author: Yuvraj Walia
Affiliation: Department of Medicine, UCLA Health, University of California, Los Angeles, CA
Conflict of Interest: None to declare