Privacy loophole: Private sector involvement in development in absence of data law

The unique health ID, which will be provided to every citizen to make their health details accessible in a common database, is expected to be a part of the National Health Stack.

A medic waits to collect samples for COVID-19 testing at School Darya Ganj Near Red Fort in New Delhi on Monday , July 27, 2020.

Written by: Prabha Raghavan, Pranav Mukul

5 min readNew DelhiAug 16, 2020 07:45 AM IST First published on: Aug 16, 2020 at 01:03 AM IST

The unique health ID for every Indian, announced by Prime Minister Narendra Modi as part of his Independence Day speech, is being packaged as a Unified Payments Interface (UPI) equivalent for the healthcare system that would make the health records of all citizens accessible in a common database through a single identification. The involvement of private firms in the development of the umbrella scheme National Digital Health Mission (NDHM), while limited to outside of most of the core responsibilities, raises potential red-flags on the privacy of online health records in absence of a data protection law.

The mission, including the roll-out of the health IDs, will first be piloted across six Union Territories — Andaman and Nicobar Islands, Chandigarh, Dadra and Nagar Haveli and Daman and Diu, Ladakh, Lakshadweep and Puducherry. The scheme is built on six core modules, of which two are expected to involve the participation of private firms — telemedicine and e-pharmacies. These modules are expected to be rolled out at a later stage, said two sources aware of the development.

Initially, in 2017, the Ministry of Health and Family Welfare had drafted a Digital Information Security in Healthcare Act to ensure data privacy, confidentiality, reliability and security of digital health data. But the said Act was subsumed in the personal data protection law that was being prepared by the Ministry of Electronics & Information Technology. The Committee of Experts under Justice BN Srikrishna on personal data protection framework had said in its report that “if a higher standard for protection of personal data is imposed by another law (for instance, the draft Digital Information Security in Health Care Bill, 2017), it may operate in addition to the proposed data protection law”.

Explained: What is the National Health ID announced by PM Modi?

The unique health ID, which will be provided to “every citizen” to make their health details accessible in a common database, is expected to be a part of the National Health Stack — a digital backbone of the country’s healthcare system, as proposed by the Niti Aayog in 2018. The National Health Stack aims to bring together various stakeholders in the ecosystem to improves efficiency, transparency and citizens’ experience with linkage across public and private healthcare. It is learnt that private players may be invited for development of personal health record (PHR) and electronic medical record (EMR) systems “in line” with the sandbox guidelines. However, core responsibilities related to developing the scheme’s IT infrastructure, generating Digital Health ID cards and verification of facilities shall rest with the government. These sandbox guidelines are expected to be released soon.

A strategy overview document issued last month by the Ministry of Health and Family Welfare, the NHA, and the Ministry of Electronics and IT preparing a strategy overview document last month, which lays down the framework for the national health ID system also details various stipulations to ensure privacy as well as accessibility. The strategy overview document reads the health data legal framework back to the Personal Data Protection Bill, which is currently being discussed by a Joint Parliamentary Committee. “Till such time digital services are made mandatory, maintenance of physical records will be required. While option of digital Health ID will be there, in case a person does not want Health ID, then also treatment should be allowed,” the document says.

“Core building blocks of NDHM…have been developed and shall be owned, operated and maintained by the government. Eligible and competent private players will have equal opportunity to integrate with these building blocks and create their own products for the market,” Dr Praveen Gedam, Additional CEO-NHA, told The Sunday Express. The mission was announced following various consultations over the last month with more than 500 stakeholders, including doctors, medical councils, hospitals, labs, IT firms and industry associations like CII, NASSCOM, NATHEALTH and FICCI. More than 100 of these stakeholders are involved in the digital health space, Gedam said.

“The attempt is to develop the equivalent of the UPI infrastructure for healthcare. Going forward, the vision is also to synchronise this platform with the Ayushman Bharat-Pradhan Mantri Jan Arogya Yojana (AB-PMJAY) one, where digital health IDs can be created for beneficiaries subject to their consent,” he said. “This could improve the healthcare ecosystem and reduce instances of fraudulent activity in the health insurance scheme as well,” he added.

A senior government official said the plan is to create a centralised infrastructure, where certain platforms may be developed by third-party entities. “Some of the discussions have been on how the government can partner with associations or the private sector for the development of a consumer-facing telemedicine platform,” the official said. The “core building blocks” of the IT platform to implement NDHM have been developed by the National Health Authority (NHA). This includes the Health ID, Digi-Doctor and Health Facility Registry modules, which the NHA has developed using the in-house team that has also worked on implementing the AB-PMJAY.