Topol, speaking Tuesday at Fortune’s Brainstorm Health conference in San Diego, noted that that gold standard in health data ownership and security feels a long way off in the U.S. “What we see now is a worst case scenario where data is sold, stolen and hacked,” he said, adding that valuable, personal medical data—which sells for five times the price of non-health data on the dark web—is currently scattered across health systems and stored on massive servers in the U.S., making it particularly vulnerable. (Indeed, cyberattacks on hospitals, where medical data is taken hostage, have become frighteningly common.)

Data would be safer, he says, in patients’ hands—where it would be stored in the smallest possible unit size. He also argues this makes sense from a civil rights perspective: patients—not their providers nor the technology companies that store the data—should own it. “Ultimately, that is the only solution,” Topol said. If countries would agree and cooperate in emulating the Estonia model, he argued, we could collectively solve global health information problems.

Jessica Mega, the chief medical officer of Verily, the life sciences arm of Google parent Alphabet, agreed that data related to an individual’s health belongs to that individual. She said Verily has long subscribed to that point of view—and beyond ownership, it tries to bestow on patients the added value and insights from that can be generated from their health data.

Eric Lefkofsky, the founder and CEO of Tempus, a healthcare startup focused on cleaning and structuring medical data, said that while he agrees that patients should own their data, there are issues yet to be resolved. For one, it’s unclear what a patient can do with his or her data. Medical data is not currently transferable between healthcare systems, he said. The underlying infrastructure is broken.

For more coverage of Fortune’s Brainstorm Health conference, click here. For news delivered daily to your inbox, subscribe to Fortune’s Brainstorm Health Daily newsletter.