India’s population of 1.4 billion exceeds that of the entire bloc of 38 OECD countries. Given the rapid pace of expansion of technology in India, it is not unreasonable to believe that the value of data generated by Indian citizens in their daily lives may already, or very soon, match the value of data generated by citizens of these countries, when adjusted for purchasing power parity. Enabling this outcome should be a key priority for the architects of India’s data governance policies.
While there has been frenetic activity in the space of digital governance in the country, we believe that there is a fundamental misunderstanding in the current policy mix. Decision-makers are finding it difficult to differentiate between data as a form of identity and data as a form of property. This failure to differentiate is holding back key areas of value creation and knowledge discovery.
Nowhere is this impact more keenly felt than in the utilisation of healthcare data in India, or the lack thereof. While large private hospitals have bespoke digital systems and government hospitals have been dragged willy-nilly into maintaining some rudimentary digital capabilities by the good offices of the National Health Mission, a large fraction of Indian citizens’ healthcare consultations occur in small private clinics with no real incentive to digitise, thereby preventing patients and downstream physicians from acquiring an interoperable digital trail of medical records.
This lack of digital records also makes it difficult for health insurers to compete on pricing, for clinical researchers to run large-sample analyses to discover new treatments, and for AI researchers to train diagnostic or decision support models on large datasets.
The fact that the healthcare data ecosystem in India remains frozen is not for want of governance efforts to facilitate data access. The National Health Authority has, in the recent past, outlined a framework for health data exchange based on two basic principles. One, that the citizen was the owner of their health records. And two, that they should be able to access them in any health facility, which subsequently has been operationalised nationwide as the Ayushman Bharat Digital Mission (ABDM). Its building blocks include registries for doctors, drugs and health facilities, middleware for information processing functions, and a consent management system that enables citizens to share their electronic health records with any registered health provider.
However, ABDM’s implementation faces a basic challenge: Clinical data is generated via an interaction between the patient and doctor, and neither is, in the moment of that interaction, interested in the future value of the data created in that encounter. For clinical data to become available, it must first become valuable. Once citizens find value in their personal health records, the innovation ecosystem surrounding health IT systems will, over time, create the best possible interfaces for doctors and health data fiduciaries to unlock that value for them.
If patients are allowed to make their health records available to commercial vendors, they will patronise healthcare establishments that are compliant with ABDM’s data interoperability and storage requirements and that put in the work to record and store data correctly. Patients interested in maintaining complete medical records will naturally simplify consultative processes for doctors, since case histories will become more accessible. An array of data intermediaries will spring up to create health information exchanges.
What is it, then , that prevents the adoption of free markets for data sharing in India? In our view, it is a mistaken prejudice, borrowed unthinkingly from the West, privileging a nebulous sense of privacy at the expense of concrete economic rights in the framing of data governance policies. In the US, the Health Insurance Portability and Accountability Act (HIPAA) places restrictions on how medical records are to be stored. The HIPAA grants patients the right to access their medical records from any provider, but not the right to make their health records available to a third party. The Act permits hospitals and other third parties to buy and sell patient records, once they have been anonymised. As a result, hospitals, insurance companies and other stakeholders monetise de-identified patient data to the tune of billions of dollars in economic value, of which the patients themselves see no share.
On the other side of the Atlantic, UK data governance principles make it clear that it is healthcare institutions, not patients, that own patients’ medical records. However, in practice, nearly 90 per cent of health records in the UK are created by the National Health Service (NHS) through one of its organs, and thus are owned by the NHS, to use as determined by internal policies.
Neither the corporatist model of data governance embedded in the HIPAA, nor the statist model of data governance embedded in the data governance principles of the UK — and the EU — healthcare systems are a good fit for the Indian healthcare system, which is highly privatised and highly decentralised. We instead advocate citizen-centric data governance.
Of course, no free market can exist without regulations and safeguards. Extremely effective technical tools for the removal of personally identifiable information exist and can be offered as digital public goods to citizens so that they can preserve their privacy while participating in a free market for information. Similarly, effective digital forensics tools exist to remove asymmetries in the information market. It is time for data governance in India to prioritise empowering citizens to use their data as their property, held or sold at will, rather than treating it as a sacred and inalienable element of their identity.
Sharma is former CEO of National Health Authority and Srivastava is a professor at the Computer Sciences Department of iIT Kanpur. Views are personal
While there has been frenetic activity in the space of digital governance in the country, we believe that there is a fundamental misunderstanding in the current policy mix. 
Share
