Digitised Health Care

Context: The draft Health Data Management Policy of the National Digital Health Mission (NDHM) is ambitious but raises privacy concerns.

Features of the Draft:

• Defining the stakeholders: In the proposed health policy, citizens are “data principals”, hospitals and doctors “health information providers”, and the government and its agencies “health information users”.
• Creating an integrated Data Storage System: Records may be held by different service providers but linked through a unique health ID.

• HealthID: This ID would be on the lines of Aadhaar but not Aadhaar itself, although it may be linked to it.
• This would allow individuals to be treated anywhere, increasing accessibility.

• Enlarged coverage of institutions: A large number of institutions down to the local pharmacy could be considered fiduciaries under this policy.
• Provision of Consent: In theory, the consent of the individual will be asked for before data collection, and that consent can also be withdrawn.
• Sharing of the Anonymised Data: for facilitating health and clinical research, academic research, archiving, statistical analysis, and policy formulation.

Issues with the draft: Privacy Concerns:

• Not backed by any legislation: Proposed legislation has been pending since 2018, and the drafts released into public domain raise serious concern.
• Unnecessary duplication of Data: Voluntary provision of linking healthID with Aadhar leads to unnecessary duplication of an already extant ID system.
• Collection of Irrelevant data: It could include financial information; physical, physiological, and mental health data; sex life and sexual orientation; genetic data; and “religious or political belief or affiliation”.
• Widening coverage may lead to data-leakages: It is unrealistic to assume such a wide range of fiduciaries will be data-secure.
• Consent made irrelevant: In practice, given a system where data on so many parameters can be collected by such a wide range of fiduciaries, and disseminated for so many purposes, consent becomes irrelevant.

Conclusion: The draft seems designed to enable the commercial exploitation of data without paying much heed to protect the privacy of citizens. Sensible policy formulation could certainly enable better health care.