The launch of the National Digital Health Mission (NDHM), an integrated and interoperable digital health framework providing each citizen with a unique health identifier, has met with a mixed reception.

While it cannot be denied that the NDHM holds immense potential in leveraging technology to catalyse health outcomes, the project also has far-reaching implications for the health sector and processing of health data, especially in terms of its privacy implications.

The engine of the NDHM is the National Health Stack (NHS) proposed by the NITI Aayog. The NHS is a set of cloud-based services based on open Application Programming Interfaces, designed to create a large health database, by collecting health data from all over the country.

Cognisant of the privacy concerns such large-scale data collection could raise, the National Health Authority subsequently floated a draft health data management policy for the NDHM (Policy) to act as a “guidance document” for the mission.

However, it is not yet clear how far the Policy meets the requirements of the Personal Data Protection Bill, 2019 (PDP Bill), for the health sector. Given the sweeping nature of the NDHM and the radical shift in healthcare facilitated by the scheme, it is essential to ensure that the digital health ecosystem as imagined by the NDHM is privacy-preserving and inclusive. For the same, we have identified two interventions that could preserve individual autonomy while promoting inclusive and innovative healthcare solutions.

First, the NDHM must ensure that an individual’s health data remains accessible to them in an ‘easy to understand’ form at all times.

The National Digital Health Blueprint (Blueprint) considered this integral to the NDHM — noting that holding patient data at the closest physical location to the patient, and citizens having ‘full control’ of the processing of their personal data are key principles driving the mission’s architecture.

This ‘federated architecture’ is an architectural pattern requiring the building blocks of the NDHM ecosystem to be built at the local, State and Central levels. However, it is not specified how the ecosystem shall ensure that digitally illiterate masses, or persons living in remote areas, are able to exercise full control over their personal data.

In this context, we propose that the federated architecture, as envisaged under the Blueprint, factor in two elements at the stage of design and implementation — socio-economic status and geographic terrain. By doing so, we hope to ensure two outcomes; first, the State can identify geographically-distressed areas where public health infrastructure ought to be supplemented with digital infrastructure by setting up digital health centres; and second, the upskilling of traditional healthcare workers (such as anganwadi workers) in rural or low-income neighbourhoods to ensure that the vulnerable groups are empowered to take privacy-preserving health decisions.

Better security safeguards

Second, it is critical for the digital health ecosystem to preserve privacy and promote transparency. For this, we recommend that entities responsible for the processing of health data are mandatorily assigned a ‘data trust score’ rating by an auditor appointed by the Ministry of Health and Family Welfare. The idea of a ‘data trust score’ for entities has found place in both the PDP Bill and the Policy, with a higher trust score meaning more transparency, better record-keeping and sharper privacy and security safeguards. In the wake of the recent controversy surrounding the RTI reply on the Aarogya Setu application, such a measure can be particularly useful for government-driven innovations. The requirement for such applications to meet a minimum trust score can guarantee operational openness and ensure that information concerning an application’s development is freely available in the public domain.

While the aforementioned interventions act as enablers of privacy and innovation in health tech, the way forward lies in ensuring that the frameworks under the Policy and the PDP Bill are operationalised in a complementary manner, with public health and privacy regulators working in collaboration to enhance public health capacities.

Banerjee is a Research Fellow and Menon is a Research Scholar at Shardul Amarchand Mangaldas & Co. Views

are personal

Related Topics
comment COMMENT NOW