The health Ministry Monday approved a policy under the National Digital Health Mission (NDHM) to protect and manage personal data of patients using the digital services of the scheme. The policy that was approved by Union Health Minister Harsh Vardhan acts as a guidance document across the National Digital Health Ecosystem (NDHE). The government said that this policy is to be read along with, and not in contradiction to, any applicable law, or any instrument having the effect of any law together with the Blueprint, the information security policy, the data retention and archival policy and any other policy which may be issued for the implementation of the NDHM. Data collected across the National Digital Health Ecosystem (NDHE) will be stored in at the central level, the state or Union Territory level and at the health facility level, by adopting the principle of minimality at each point. The policy was approved “after over a month” of soliciting feedback from various stakeholders and the general public.
Features of the Draft Health Data Management Policy
The key objectives of this Policy are

• to provide adequate guidance and to set out a framework for the secure processing of personal and sensitive personal data of individuals who are a part of the NDHE in compliance with all applicable laws;
• to safeguard digital personal health data, including the Personal Health Identifier, the electronic health records and electronic medical records, by implementing adequate technical and organisational measures across the NDHE ecosystem;
• to create a system of digital personal and medical health records which is easily accessible to individuals and health service providers and is purely voluntary in nature, based on the consent of individuals;
• to increase awareness of the importance of data privacy and instil a privacy-oriented mindset among the members of NDHM and its ecosystem partners;
• to ensure national portability in the provision of health services;
• to establish appropriate institutional mechanisms for auditing of the NDHE as needed and to encourage stakeholders and ecosystem partners to adopt the data protection principles set out in this Policy; and
• to leverage the information systems existing in the Indian health sector by encouraging conformity with the defined data privacy standards and integrating such existing systems with NDHE.

Significance of Draft Health Data Management Policy

• It is the maiden step in realising the NDHM’s guiding principle of ‘Security and Privacy by Design’ for the protection of individuals’ data privacy.
• It encompasses various aspects pertaining to health data such as data privacy, consent management, data sharing and protection etc.
• The main objectives of the draft policy are to provide adequate guidance and a framework for the secure processing of personal and sensitive personal data of individuals.
• It will be in compliance with all applicable laws and international standards that define the set of frameworks of consent for the collection and processing of health data by healthcare practitioners.

Road Ahead

• With the emergence of Big Data and increase in online data management, concerns around the protection of different kinds of sensitive personal information of individuals are being raised globally. Although India has realized the right to privacy, it is yet to roll out laws for protection of different kinds of datasets being used by the government, like Aadhar, DNA profiling, Aarogya Setu etc. The Draft Health Data Management Policy is a proactive initiative for protecting the health data of citizens before the creation of its repository.