Heart Data Belongs to Patients: A Policy Position

Note from the President

February is Black History Month and it is American Heart Month, and both observances sit alongside the work of the Caribbean Association of Cardiologists, whose annual congress was held in Port of Spain last week. I attended part of the meeting. The conversations there, particularly the public one between regional cardiologists and the AI vendors now offering cardiac decision support tools in our hospitals, were among the most useful I have heard in a year.

Andre Beaumont has written a piece that sets out, in plain terms, the policy position CAIRA will take this year on cardiac AI and patient data. The piece is being read, in advance, by our Working Group on AI in Health and by several of the regional health ministries. The Charter framework supports the position. The policy detail has, until now, been left open. We are closing that gap.

A short note. CAIRA's Spanish language edition launches next month, with the Dominican Republic chapter taking the lead. The French language edition follows in May. Both are commitments I made in last August's letter. The work has taken longer than I hoped and arrived approximately when it was always going to.

Adrian Dunkley Founder and President, Caribbean AI Association

---

Feature

Heart Data Belongs to Patients: A Policy Position

By Andre Beaumont

The AI tools entering Caribbean cardiac care in 2026 are not the AI tools that were entering Caribbean cardiac care in 2024. They have advanced in capability and they have advanced in commercial deployment. The current generation of AI-assisted electrocardiogram interpretation, AI-assisted echocardiography, AI-supported risk stratification, and AI-augmented remote cardiac monitoring is no longer a research curiosity. It is, in 2026, present in at least nine of the major hospitals in the region, in the working contracts of at least three of the regional insurers, and in the procurement plans of at least eleven health ministries and parastatal health authorities. The deployment is happening. The policy is, in many of our member states, still catching up.

This piece sets out the position the Association will take in our submissions to the regional Caribbean AI Coordinating Council in the second quarter, and in our advice to member states implementing the Charter. The position is, in summary, that the data generated by patients in the course of cardiac care, including the data generated when AI tools are used in that care, belongs to those patients, and the legal, technical, and operational arrangements around its use should reflect that ownership in a way our current frameworks do not yet do.

I will explain what this means in practice, why we believe the case for it is strong, and what specifically we are asking our member states to do.

The shape of the problem.

The cardiac care pathway, in 2026, generates a substantial volume of data per patient. The resting electrocardiogram is a structured, machine-readable signal. The exercise stress test generates several minutes of continuous physiologic data. The echocardiogram produces a video and a structured set of measurements. The CT and MRI imaging produce high-resolution image stacks. The continuous monitoring devices, which an increasing share of Caribbean patients are now wearing for periods after a cardiac event, produce continuous data over weeks. Each of these generates value to the patient when interpreted in the patient's care. Each also generates value, separately, to anyone who can aggregate the data across many patients.

The questions our existing frameworks do not adequately answer are several. Who owns the data. Who has the right to copy it. Who has the right to share it onward with third parties. Who has the right to use it in the training of new AI models. Who has the right to combine it with the patient's other clinical data, or with data from outside the clinical context. What happens to the data when the patient changes providers, or when the AI vendor's commercial circumstances change, or when the hospital's contractual arrangement with the vendor changes, or when the patient dies.

In the absence of clear rules, the practical answer to these questions, in many of our member states today, is set by the terms of the commercial contracts between hospitals and AI vendors, signed in language that the patient has not seen and the patient's clinician has often not read carefully. The patient's data is, on these arrangements, owned in some functional sense by the institution that holds it and used, with the institution's consent, by the vendor that processes it. The patient's role in the arrangement is to consent to whatever the institution presents, at the point of care, in a form the patient is in no position to refuse.

This is not, on its face, a unique problem to AI. Caribbean patients have lived with imperfect arrangements around their health data for decades. The reason it has become more pressing now is that the value of patient data, in the AI era, is materially higher than it was, and the asymmetry between what the patient gives and what the patient gets in return has, by our estimation, widened.

The position.

CAIRA's position, in the policy paper our Working Group has drafted, is built on four points.

First, the data generated in the course of a Caribbean patient's clinical care, including the data generated by AI tools used in that care, is the patient's data. The institution, the clinician, and the vendor are custodians of it under defined terms. They are not, in any meaningful sense, its owners. This is a clear position that several of our member states have already adopted in their general data protection frameworks. The application to AI specifically is what the Charter implementation needs to clarify.

Second, the patient has a clear, accessible right to a copy of their data in a portable format. This is the practical implementation of ownership. Without portability, ownership is theoretical. The standard our paper recommends is that any Caribbean patient may, on request, receive a copy of their structured cardiac data, in a defined interoperable format, within thirty days, at no cost to the patient and in their preferred language where the format permits it. The technical capability to do this exists. The regulatory mandate, in most of our jurisdictions, does not yet exist with sufficient clarity.

Third, the secondary uses of patient data, including use in the training or improvement of AI models, require specific and informed consent. The blanket consent forms that many of our institutions currently use, in which a patient signs in admission to multiple unrelated uses of their data, do not meet this standard. The replacement is not, in our view, a longer consent form. The replacement is a layered consent process, in which the patient gives informed consent to their own clinical care at the point of care, and is asked separately and at a different time, with the institutional space to refuse without consequence, to consent to specific secondary uses. The default, in the absence of explicit secondary consent, should be that the data is used only for the patient's own care.

Fourth, where Caribbean patient data is used to train or improve AI models that generate commercial value, the institutions and vendors involved have an obligation to ensure that some of that value returns to the patient communities that produced the data. The specific mechanisms can vary. In some jurisdictions, it may take the form of reduced licensing fees for the use of the resulting tools in Caribbean health systems. In others, it may take the form of contributions to regional research or health infrastructure. The principle is that patient data is not a free input to a commercial enterprise. It is a contribution from the community, and the community has a legitimate claim on the resulting value.

The case for the position.

I want to address, briefly, the objections that have been raised in our consultations.

The first objection is that the position will slow the deployment of useful AI tools in Caribbean cardiac care, by raising the regulatory and contractual cost for vendors. There is some truth to this concern. The deployment of any new generation of clinical tools is, in our region, slower than we would like, and additional regulatory burden does not help. The counter is that the cost of getting these arrangements wrong, in the long run, is materially higher than the cost of getting them right now. The Caribbean has seen, in other domains, what happens when the rules are set late. The financial services data protection regime in the 1990s was set after a decade of practice had hardened, and the costs of reversing the bad practices were enormous. We have an opportunity, in clinical AI, to set the rules early enough that the practice grows around them. We will not have this opportunity in five years.

The second objection is that the position will be difficult to enforce, particularly when AI vendors and the cloud infrastructure they depend on are located outside the region. This is a fair concern, and one we share. The response is the practical one we have used in other policy domains. The standard is set. The enforcement is iterative. The institutions in our region that contract with foreign vendors are the points of leverage, and the standard applied through them, in their procurement and their ongoing contractual obligations, is the standard that will, over time, shape what is offered. The Caribbean has experience with this from data protection regulation in financial services and from anti-money laundering regulation. The same logic applies.

The third objection is that the position is paternalistic. That patients, given the choice, will consent to the use of their data in ways that we, in regulatory paternalism, would prevent. This is the objection I take most seriously, because it is the objection that has the most truth to it. The answer is not to deny patient autonomy. The answer is to ensure the conditions under which a patient's consent is genuinely free and genuinely informed. The current arrangements, in many of our member states, do not meet this standard. The position we are taking is, in our view, the position that respects patient autonomy more fully than the status quo does, not less.

What we are asking member states to do.

The work for 2026, in our submissions to member governments, is the following.

Implement in regulation the patient ownership of cardiac data, with a defined timeline for institutional compliance. The model regulatory text is appended to our policy paper. Six of our member states have indicated readiness to advance such regulation in the current legislative session.

Adopt the model patient data portability standard, with a defined technical specification. The Working Group has done the technical work on the specification. The work that remains is the administrative work of adoption.

Revise the institutional consent practices, with support from the model layered consent process the Working Group has published. The implementation cost for institutions is, on our estimates, modest and one-time.

Embed the secondary use standards in the Charter implementation regulations for clinical AI procurement. The model procurement clauses, building on the general clauses adopted last year, are in draft. We will publish them for member comment in March.

A closing word.

The Caribbean has been, in the broader history of medicine, in the position of a region whose patients have contributed to global medical understanding through their bodies, sometimes without their informed consent, sometimes with consent extracted under conditions that were not free. The history is not pleasant. The history is also not a foreign country. The contemporary version of this problem, in which Caribbean patient data flows out of our region into the commercial training of AI systems, with insufficient attention to the rights of the patients who produced it, is the modern shape of an old pattern.

It is in our power, in 2026, to set the rules differently than they have been set in previous waves of medical innovation. The Charter gives us the framework. The political will exists in several of our member states. The patients exist in all of them. The work is the work of writing the regulation, training the institutions, and holding the line through the procurement cycles that will, over the next two years, set the practical defaults for the decade to follow. The Association will be doing its part. Our member states have to do theirs.

---

Andre Beaumont is a regulatory affairs consultant based in Bridgetown and chairs the CAIRA Charter Working Group.

Originally published in The Monthly Intelligence Report, February 2026.