Leaving your corpse to researchers after you die is a relatively easy process, but donating your medical records to science is still nearly impossible. There are body donation programs scattered across the United States, including at major medical schools, and every year, thousands of people participate. It would be incredibly difficult, though, for those same people to donate the reams of medical data that was collected throughout their life to a research team — even though some say they’d be interested in doing so. So when a group of ethicists and lawyers met at the Oxford Internet Institute last year to create an ethical code for the donation of medical records after death, they were building a framework for a process that, at this point, doesn’t exist.

Until recently, most discussion of data after death has focused on social media platforms and other types of personal data, says Jon Cornwall, senior lecturer in the Centre for Early Learning in Medicine at the University of Otago in New Zealand. “Almost no one has thought about what is going to happen to all of the medical records that sit around after people die.”

“We didn’t find any systems where you could actively give your data,” says Jen Krutzinna, a bioethicist, one of the code’s authors, and a member of the Digital Ethics Lab at the Oxford Internet Institute. “There’s no way to pass it on in a proper way.”

That’s despite the value of the information contained within health records, which could help answer a range of public health questions that require data on people’s health over a long time period — like how working in a particular industry affects the aging process or how exposure to pollutants impacts how we develop. The ethical code around data donation, Krutzinna says, is the first step toward developing a regulatory system that would allow researchers to take advantage of the health data that people leave behind.

Millions of posthumous medical records are sitting around in digital systems, and that already massive volume is only going to grow. An analysis of the Marshfield Clinic health system in Wisconsin, for example, showed that its data repository will have more medical records from deceased patients than of living patients by 2056.

The ethical code developed by the Oxford group was published in January, and it drew from previous work on other types of medical donations, like bodies, organs, and eggs. It states that any collection of posthumous health data should be used for the common good and should not be exploited commercially, that research done with the data should be shared with the public, and that it should be carefully stored. People donating their information should be given as much information as possible about how their data might be used, and they should have the opportunity to put restrictions on the use of their data.

“Even if you’re dead and it doesn’t matter, you do worry when you sign that form,” Krutzinna says. “There is some anecdotal evidence that there are some types of medical data people don’t want to reveal, like sexual and mental health.”

Concerns about legacies aside, other research has shown that many people are okay with their data having a life after their death. Cornwall, who conducted focus groups with adults in New Zealand, says he found that people supported the idea of holding and using posthumous health records. “They want anonymity and privacy but want their descendants to have benefits as well,” he says. Participants in the small study wanted the data to be handled by the government (not private companies), were concerned about hacking, and didn’t want the data to be sold. The group was divided on the level of consent: some people wanted to opt in to donate data, while others were comfortable with an opt-out system.

While there’s still no great way to donate your data after death, existing laws and regulations allow for researchers to use electronic health records of people who have died: in the United Kingdom, for example, scientists can request permission to access and use anonymized health records from the National Health Service (NHS). NHS policy allows people to request to opt out of that research, but it’s only institutional policy, not law, notes Edina Harbinja, senior lecturer in media and privacy law at Aston University in Birmingham, England.

In the United States, HIPAA laws stipulate that personal health data remains private for 50 years after death, unless family members or an authorized representative releases it. However, that law also allows scientists to request and access data from institutions that hold it for research purposes (such as hospitals and insurance companies), as long as identifying information is removed. “It’s more permissible than the United Kingdom,” Harbinja says. “But evidence suggests it’s used less commonly.” There are practical barriers in the US: the national health system in the United Kingdom means records are centralized, but in the US, data is housed at multiple institutions. “It’s quite a liberal provision, but practically, it’s difficult,” she says.

Globally, these existing frameworks around posthumous data are often inconsistent, and they rely on institutional policy rather than established law. They also don’t consider the idea of donation. “I’d like to see more specifics around data donation and the deceased,” Harbinja says. “There is room there for introducing a consent, or authorization from family members, as is the case for organ donation.”

There’s been some interest from policymakers around medical data donation in the European Union, says Krutzinna. She and her colleagues are attending a workshop at the European Commission eHealth Network meeting in June to discuss the issue, she says. It’ll be important to work through all possible harms that could come from this data in the future, she says. “What if technology vastly improves? What if genetic diagnosis becomes much more accurate? We have to build in safeguards,” she says. It’ll be particularly important to have clear guidelines on any genetic and genomic data included in medical records because they don’t just hold information about the deceased; they also contain data about family members who may not have consented to give away their information.

It’ll also be important to build a diverse dataset, Krutzinna says. “How do we make sure that all groups are sufficiently represented, not just white Westerners? We don’t want to have data that can’t be used for everyone,” she says. “I would like to see more diverse researchers involved at this stage, and make sure they’re represented in conversations around ethics.”

The ethical code established at Oxford is the first step toward a possible future where data donation is possible. “We know the key ethical challenges. We know most of the key legal issues,” Krutzinna says. “Next is to think about what we can do in practice and how we can govern this.”

It’s important to set up clear systems so that people are aware of their options, and they can make informed, active decisions about what they want to happen with their medical data after their death, Harbinja says — whether that’s destroying it or offering every data point to a scientist. “We should be able to choose how we dispose of our digital self.”