A patient’s care continuum potentially starts from a doctor’s chamber, moves to a diagnostic centre or operating room of a hospital and continues to the post- treatment/operative stages. At each point in the continuum, data is generated in the form of doctors’ prescriptions, test results, medical device data, discharge summaries etc- most of which are stored with different entities such as hospitals, diagnostic centres etc either in electronic or non-electronic format. However, in India, this data is rarely shared between institutions, especially, in the absence of a national framework or platform for data sharing between institutions in India. A health system with fully interoperable health information will lead to strengthened care coordination, improved safety and quality, increased efficiency and reduced cost – all of which in turn will lead to better healthcare service and management. It will also result in more accurate tracking and prevention efforts for diseases and other public health threats. The COVID-19 pandemic has globally pushed healthcare systems to engage in data sharing, thus highlighting the importance of such practices in the coming times.
In this regard, to create a seamless online platform for health data sharing, the National Digital Health Mission (NDHM) has been envisioned by the Government of India. As part of NDHM’s overarching vision, the focus was given to create an enabling environment necessary to support the integrated digital health infrastructure of the country through the National Digital Health Ecosystem (NDHE). The NDHE would support Universal Health Coverage in an efficient, accessible, inclusive, affordable manner, by provisioning a wide-range of data, information and infrastructure services. However, considering the sensitivity around health data, it was imperative for NDHM to have a framework that can safeguard the privacy of confidential health data, while supporting interoperability, technological flexibility and independence across the NDHE. To achieve this goal, the Health Data Management Policy (HDMP) was released by the Ministry of Family and Health Welfare on 14 December 2020. It is a guidance document that outlines a framework of minimum standard for data privacy protection, to be followed across NDHE for ensuring compliance with relevant and applicable laws, rules and regulations. The HDMP focuses on federated architecture instead of a centralized architecture as proposed in the National Digital Health Blueprint, 2019. As such, the data collected across NDHE will be stored at three levels, i.e. at a Central level, at a State or Union Territory level and lastly, at the health facility level, adopting the principle of minimality at each level. To enable participation in the NDHE, the individual to whom the personal data relates may request for the creation of a Health ID at no cost, their personal data will be linked to this ID and he/she will be deemed as the owner of the data.
The HDMP has received wide attention from the media and the public in general. Largely public and experts have been supportive of the vision of the policy especially for framing a protocol on the process of data collection, storage, processing and exchange. Most experts appreciated the fact that there is clarity in the framework of informed consent in the policy document. It provides patients with the flexibility to choose to give consent to selective data only. Further, the right of the person who owns the data, to withdraw her/his consent and the procedure for such withdrawal has been considered. The policy also clearly states that sensitive personal data shall not be published, displayed or posted publicly by any person or entity unless anonymised or de-identified.
Nevertheless, major concerns have been raised in relation to the absence of a Personal Data Protection Bill which is still being debated in the parliament. As such, the HDMP will operate in the absence of robust legislation governing personal data and would not be able to provide the necessary protection to the sensitive and private information that will be shared by citizens. However, the HDMP has come with a certain amount of granularity in this regard, such as the policy states it will be re-evaluated when the Data protection bill is approved. Another concern that has been raised by many experts is that the policy does not have any mention of a penal provision or fine as punishment for non-compliant actors although it provides provisions for exclusion of non-compliant actors from NDHE or losing their IDs. It also mentions that the National Health Authority shall formulate and implement procedures to identify, track, review and investigate incidents of a personal data breach and shall maintain a record of such instances and actions taken pursuant to such instances. Further, the lack of a standard nomenclature for various medical terms, diseases, drugs etc across the country can cause major problems for interoperability. This issue can be addressed by adhering to standard international nomenclatures. However, at present data sharing will be encouraged in its present format. Also, concerns have been raised by various groups that this policy may facilitate further privatisation of healthcare in the country. The policy has also been criticised for being more data centric rather than being health centric. However, major concerns are related to data security and whether health data sharing in absence of proper protection laws may lead to monetisation of health data. In this regard although the policy discusses in detail the privacy principles to be followed by data fiduciaries, it is imperative to have a functional data protection law in place to guard the implementation process of the HDMP. This is a major area of concern as data breach and misuse have also been reported in many other countries where similar nationwide health data sharing policies have been implemented such as in the US and Australia.
Despite the associated risks of privacy breach it is extremely important that Indian healthcare system is revamped by telemedicine and systematic sharing of health data across concerned agencies. In this context, HDMP is a much needed instrument which if implemented properly could be an important step towards achieving the United Nations’ Sustainable Development Goal of Universal Health Coverage. Further, most experts are contended by the fact that the policy has the inherent strength of being dynamic, allowing it the scope to evolve and improve with changes in governance systems. With better adoption of anonymisation and aggregation protocol supported by strong data protection laws, the HDMP has the potential to pave the path for a new revolution in the healthcare system towards achieving equitable and affordable healthcare for all.
