Health Data for Better Health Care

INTRODUCTION
The alarming increase in incidents of data breaches has been a cause of worry. Facebook data breach has affected more than 500 million users worldwide.¹ Big companies such as Yahoo, WhatsApp, Adobe have suffered from data breaches.² Last year had caused a paradigm shift in terms of work culture and massively increased online activity.³ Breach of health data had also witnessed a spike due to vast amount of data being collected by health service providers, insurance companies and other government authorities and increased use of medical devices by people in the form of wearables and other medical devices.⁴ The recent health data breach in India took place, where the data of over millions of medical records and medical images were leaked, the breach was detected by German firm, Greenbone Networks.⁵ This call for a deeper scrutiny into how health data is handled by various stakeholders.

REGULATING HEALTH DATA
Health Data may broadly be defined as information related to physical or mental health of an individual or the health services provided to that person.⁶ They may be collected through various ways, for e.g., during the registration of health services, laboratory tests, hospital records, etc.

The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, under the Information Technology Act, 2000 treat a patient’s personal information, which includes information about physical, physiological and mental health conditions along with medical records and history as sensitive personal data or information (“SPDI”). Certain protections are available for SPDI.⁷ For instance, a body corporate is required to obtain consent of the provider of the sensitive information regarding purpose of usage before collecting the information.⁸

With the objective to digitise healthcare in India, Ministry of Health and Family Welfare (“MoHFW”) last year launched the National Digital Health Mission (“NDHM”). The Health Data Management Policy under NDHM is created with the objective to create a system of digital health records which is easily accessible to individuals and health service providers.⁹ Participation of an individual will be on a voluntary basis. If an individual chooses to participate, he/she will be issued a Health ID by the NDHM. It is based on the principle of federated architecture, which allows interoperability between independent and decentralized information systems. Such interoperability will have to comply with provisions relating to consent, security and protection of personal data.

NDHM also talks about health data and classifies it into to two categories¹⁰

• Personal health data – It includes any data with personally identifiable information related to an individual containing detailed information of various health conditions and treatments.
• Non-personal health data – It includes aggregated and anonymised health data where all personally identifiable information has been removed.

Similarly, under the Personal Data Protection Bill, 2019 (“PDP Bill”), ‘health data’¹¹ is classified as ‘sensitive personal data’¹² and any kind of processing of this data is prohibited unless explicit consent is given by the data provider¹³. The PDP Bill gives more control to patients over their personal data that is being collected, as well as how this information is used. The Bill also penalises for data breaches.¹⁴

Regarding non-personal data related to health of people (both aggregated and anonymised), the protection accorded to it is the same as provided to the underlying data as per the Report by the Committee of Experts on Non-Personal Data Governance Framework.¹⁵ This is to say that since ‘health data’ is classified as ‘sensitive personal data’ as per Section 3(36) of the PDP Bill, therefore non-personal health data would be accorded same protection as sensitive personal data. This additional protection is necessary This categorisation gives additional protection to the health data and also because anonymised data bears a risk of re-identification which could constitute a critical loss of privacy.¹⁶

LEVERAGING HEALTH DATA
Data is crucial for further developing technologies especially artificial intelligence systems that feed on datasets. It also helps policy makers to make evidence-based decisions. Data related to health also falls under a High Value Dataset (HVD) – a dataset that is beneficial to the community at large and shared as a public good.¹⁷ Health data held by the private sector when combined with public-sector data may be useful for improving public service, devising public programs, infrastructures, etc. to achieve societal objectives of healthcare planning.¹⁸ Therefore, in various laws, provisions are there for sharing of data with the government. For an overview of the same refer to Table 1.

DISHA: THE DIRECTION FOR BETTER DATA MANAGEMENT
The Digital Information Security in Healthcare Act (“DISHA”) is another important law that will be crucial for governance of data in India. DISHA aims to provide privacy, security, confidentiality and standardization related to digital health care data of the citizens of India. The Act aims to provide a framework to regulate the generation and collection of such data, including the right to withhold confidential health details.¹⁹ It promotes the rights, obligations, safety, accessibility, compilation, and retention of everyone’s digital health record.²⁰ This legislation includes medicinal, medical wearable devices, insurers, and manufacturing firms, as well as other organizations that handle digital health details for their customers. Some of the features of the Act are as follows

• An agency named National Electronic Health Authority and State Electronic Health Authority will be constituted to ensure the compliances under the Act.²¹
• The Act does not deny citizens any health benefits on refusal to give consent for collection of data.²²
• The owner of data shall have the right to access their own data and rectify it.²³
• The owner will also have the right to know about the establishment which has their data, and the purpose for which the data is being used.
• The establishments will have to inform the authority about the breach of data within 3 days of the breach.²⁴
• The people will have the right to complain to State or Central adjudicating authorities, if they feel their data is getting breached.²⁵
• The Act will benefit the citizen to secure their privacy and provide transparency regarding their data.

CONCLUSION
Data breach is one of the serious concerns, and when it comes to health data, it becomes more important to secure that data because if the personal data is leaked, it can cause some irreparable damages to individuals. Many aforementioned legislations have not come into force which raises important questions on data security. This leaves victim of these breaches without any effective remedy. The need is have robust data protection regime.