Naavi.org

(This is a continuation of the previous Article)

The Health Data Protection policy announced by NHD scheme has adopted the Obligations of data fiduciaries and rights of data principles from the Personal Data Protection Bill 2019.

Accordingly the obligations include

1.Accountability,

2.Transparency,  (Including Data Trust Score, Grievance Redressal, Periodical update of changes in the  processing)

3. Privacy by Design . (The system is envisaged to have a decentralized storage of data which could mean multiple data bases at State/UT level introducing the security requirements commensurate with the associated risks. )

4. Choice and Consent driven sharing

5. Purpose limitation

6.Collection, Use and Storage limitation

7. Empowerment of the rights guaranteed

8. Maintenance of Data Quality

9. Reasonable Security Practices and Procedures

As could be expected, the Ministry of Health which is in love with ISO standards has stated that “The data fiduciaries will implement the International Standard IS/ISO/IEC 27001 on “Information Technology – Security Techniques – Information Security Management System – Requirements” as well as any other standard as may be applicable to them”

Naavi.org has extensively discussed the desirability of the regulations not to suggest a particular proprietary standard to be implemented.

To reiterate, this means that every Data Fiduciary is being forced by the regulation to buy an ISO 27001 certificate which has a payment tag.

It is impossible to avoid a perception that this is being suggested for reasons other than the necessity and it is suggested that the Ministry drops this provision.

It must be also pointed out that ISO 27001 does not support the DTS system and is not comprehensive enough for the compliance of the Techno Legal requirement.

The policy suggests a NDHM-CISO and NDHM-DPO to be appointed by the organizations.

Obligations of Data Processors are similar to PDPB 2019 as entities bound by contractual agreements.

The Data Fiduciary needs to conduct a Data Protection Impact Assessment and maintain appropriate records. They should also conduct periodical review audits.

Sharing of Data

Sharing of de-identified and anonymized data may be permitted while sharing within the community of Health Information Users who will have obligations similar to the Data Fiduciary.

Grievance Redressal

The policy envisages that the Data Fiduciaries shall have a Grievance Rederssal mechanism and the DPO will be accountable to redress the grievances.

Data Breach Management

The National health Authority (NHA) is expected to notify the time limits related to the notification of data breaches. The NHA will report the breaches to the Cert-In for the time being.

NDHM Sandbox Environment

It is interesting to note that the Ministry is providing a sand box arrangement for software systems to be tested in a controlled environment. The Sandbox hosts APIs for Health ID service, Consent Manager gateway etc.

Penalties

Any non compliance of the regulations may attract cancellation of the registration and stoppage of contracts.

Summary

While the policy is an attempt to implement the provisions of the PDPB 2019 to the health sector, once the PDPA comes into being, it would be better if this policy is simplified to avoid overlapping with the PDPA provisions.

Further the references to the ISO audit as if it is mandatory must be removed and the security inconsistencies need to be addressed.

We keep our fingers crossed to see how the Ministry would respond.

Naavi

All Articles in the series:

1.National Digital health mission shows the way… Be Ready before PDPA becomes effective

2.NDHM is a trend setter… Get started early on the Privacy Protection journey

3.Consent Management under NDHM

4. NDHM-Health Management policy Objective need not be linked to ISO standard

5.Managing IDs in NHD ecosystem

6. Data Fiduciaries under NDHM

(This is a continuation of the earlier article)

Presently most of the Government’s schemes use the Aadhaar ID as the identity determinant of the citizens. It is the attempt to link Aadhaar ID to property registrations to prevent benami properties which triggered the big Privacy movement in India which lead to the Puttaswamy judgement. At the same time, Aadhaar IDs have been subjected to many security breach incidents to the extent that the dark web may be having the Aadhaar information of a very large number of Indian citizens. Also when the Aadhaar ID were first issued, the security systems were so weak that many fake Aadhaar IDs have been issued because the enrollment was done by agents. There have been instances of enrollment laptops being stolen and probably every enrolling agent kept a copy of his work. As a result Aadhaar information is no longer the secret it is supposed to be. If any privacy leak is possible through a linkage to Aadhaar ID, perhaps it has already occurred.

The Government is therefore under a dilemma on whether they should use the same Aadhaar ID as the identity of the individuals in the NHD system. Under HIPAA US government used the social security number for individuals and tax registration numbers for covered entities to create the HIPAA data base. But NHD has decided to issue new IDs to the stakeholders in the NHD ecosystem.

Accordingly, several unique IDs are being suggested to be created to identify the users of the NHD ecosystem.

The IDs are

1. Health ID to every individual user of the system. All consents would be linked to this Health ID. It is stated that the participation in the system is voluntary so that Health ID will only be unique as long as the individual is using the system and may be cancelled at his option. As a result the person may seek re-allocation of the ID if he opts in at a later time. Aadhaar number may be used for registration but the allocation of Health ID is not excluded for persons not having Aadhaar ID. As a result this data base will be independent of the Aadhaar data base. The ID will be issued by the Data Fiduciary who is registered with the NHA similar to the agents of UIDAI who issued the original Aadhaar IDs and could be a point of security weakness in the days to come.
2. Health Practitioner ID to every doctor to permit him to work under the system. This will also provide an opportunity to opt out . Authorized registrars would be appointed for the purpose of registration.
3. Health Facility ID to every health care facility which could be hospitals, pharmacies, diagnostic centers etc. The procedure for registering the health facility ID would be provided in due course.

Some of the states are also creating “Family IDs” and it may be linked to the Health IDs under this project. These two IDs will soon be added to the Aadhaar ID and PAN card for the individuals besides the Voter ID, Senior Citizen ID etc creating a host of Government IDs which an individual need to maintain.

The registration, de-registration as well as re-registration  will result in submission of personal information, need to delete the same and re-enter the same, maintaining the accuracy of the information, avoiding fake information being uploaded are issues that need to be addressed.

In the scheme now envisaged there is scope for fraudulent double registrations particularly if Aadhaar is not linked to the Health IDs. I hope this would be properly addressed during implementation.

(To Be continued..)

Naavi

All Articles in the series:

1.National Digital health mission shows the way… Be Ready before PDPA becomes effective

2.NDHM is a trend setter… Get started early on the Privacy Protection journey

3.Consent Management under NDHM

4. NDHM-Health Management policy Objective need not be linked to ISO standard

5.Managing IDs in NHD ecosystem

6. Data Fiduciaries under NDHM

(This is a continuation of the earlier article)

Before we dive deeper into the NDHM’s Health Data Management policy, there is a need to discuss one philosophical issue about what should be the objective of such policy and even the laws such as PDPA.

For the time being we shall assume that this “NDHM-HDM Policy is a directive from the Ministry to all the participants of the NDHM eco system and hence has the force of a near statutory regulation. Presently it is aligned to Section 43A of the ITA 2000 and once PDPA comes into existence, this policy will get aligned to the PDPA and get a real legal force.

Hence we need to discuss what should be the objectives of such laws/regulations.

The ITA 2000 objective was to promote E Commerce and to protect data through various measures of information security and cyber crime control. The objective of PDPA is to protect the “Privacy of an Indian Citizen”.

The policy declares that it is the first step in realizing NDHM’s guiding principle of “Security and Privacy by Design” for the protection of individual’s data privacy. This statement is in alignment with the objectives of PDPA. The policy is also careful to declare that it is subordinate to other applicable laws.

However, in Paragraph 3 of the Policy, the policy has stumbled to declare that one of the key objectives of this policy includes

“to create a system of digital personal and medical health records which is easily accessible to individuals and health service providers and is purely voluntary in nature, based on the consent of individuals, and

in compliance with international standards such as ISO/TS 17975:2015 (defines the set of frameworks of consent for the collection and processing of health data by healthcare practitioners and other entities) and

other relevant standards related to data interoperability and data sharing as may be notified for the implementation of NDHM from time to time”

It is difficult to understand whether the second para above was required or could have been deleted altogether since it indicates as if it is one of the objectives of this policy to be compliant with an ISO standard.

It appears that there is no need to frame a law or a regulation to be compliant with a “Standard” unless the “Standard” itself is a law as it happens in a prescriptive law such as HIPAA.

In other laws, the law sets down a principle which is expanded in the regulatory notifications. After this it is for the industry to develop their own best practices which may be called “Standards” or by any other name.  Those who develop “Standards” align the standards to the law and not the other way round.

ISO standards some times are mistaken as “Regulatory Standards” and this perception needs to be changed. ISO standard is subordinate to law and is a tool of compliance. Law cannot be a tool of compliance of an ISO standard.

It would be better to correct this aspect in the policy.

(To Be continued)

Naavi

All Articles in the series:

1.National Digital health mission shows the way… Be Ready before PDPA becomes effective

2.NDHM is a trend setter… Get started early on the Privacy Protection journey

3.Consent Management under NDHM

4. NDHM-Health Management policy Objective need not be linked to ISO standard

5.Managing IDs in NHD ecosystem

6. Data Fiduciaries under NDHM

(This is in continuation of the earlier article on NDHM)

“Informed Consent” is the backbone of most Data Protection laws including the Indian Personal Data Protection Act (proposed). The NDHM’s Health Management Policy adopts all the provisions of the PDPB 2019.

Consent is a mandatory requirement under the policy and it should meet the standards of a “Free Consent” under Section 14 of the Indian Contract Act, should involve “Informed choice” etc as envisaged in PDPB 2019 (Section 11).

The purposes to which a consent can be obtained under this policy is restricted to the requirements of the NHA (National Health Authority similar to the DPA of PDPA) which means that the consent can be used only for purposes consistent with the NDHM.

Once this policy comes into force, fresh consents have to be obtained. This means that the legacy health data for which consent may be available or not becomes a data collected under a “Defective” or “Expired Consent”.

When subsequent processing is required and the data has to be passed onto another processor (Health Information Users and Providers), a “Consent artifact” has to be generated and shared by the “Consent Manager”.

In obtaining the consent from a minor (less than 18 years of age), the policy indicates that a “Valid Proof of relationship” must be obtained along with the identity of the parent or guardian for processing of sensitive personal data.

The “Valid Proof of relationship” could be a point of difficulty and needs to be debated further.

It is expected that the NDHE framework will take note of “Nomination” like an “Authorized representative” who takes care of the consent in the event the data principal is seriously ill or mentally incapacitated.

This point is a problem in all health related laws since this provision is in conflict with the earlier provision that “Consent has to be as per Section 14 of Indian Contract Act”. As per the Indian Contract Act, a person who loses the mental capacity to take decision is no longer able to withdraw the earlier authorization given to an agent and hence the contract of agency is deemed as terminated in such a situation. HIPAA resolves this dilemma by bringing in the view of the medical practitioner whose certificate would be a vital document that determines what decision can be taken in respect of the patient.

It is better if we also adopt this provision in the policy.

The Rights of the data principal recognized by the policy is similar to the PDPB 2019 and includes right to confirmation, right to access, right to receive a notice, right to correction and limited right to erasure. and data portability.

The provisions recognize the need for retention of data as per law and use of restriction of access and disclosure instead of deletion if the situation so warrants and expects a Data Retention and Archival policy to be adopted for the purpose.

Another point of difficulty is the policy that a person may restrict consent to disclose the information to his legal heirs after his death which would not be possible in electronic form of consent. This would be ultravires the ITA 2000 since any instruction applicable after the death of a person can be considered as a statement of Will which has no recognition in electronic form.

(….Continued)

Naavi

All Articles in the series:

1.National Digital health mission shows the way… Be Ready before PDPA becomes effective

2.NDHM is a trend setter… Get started early on the Privacy Protection journey

3.Consent Management under NDHM

4. NDHM-Health Management policy Objective need not be linked to ISO standard

5.Managing IDs in NHD ecosystem

6. Data Fiduciaries under NDHM

(This is in continuation of the earlier article on NDHM)

The National Digital Health Mission (NDHM) is an ambitious project of the Government of India for providing a nation wide health care system and makes comprehensive use of technology. Since the project deals with the health information of individuals, it is already under an obligation to be compliant with ITA 2000. Though we may argue that Section 43A is for Body Corporates and not for Government, any organization which can sue and be sued in its own name should be considered as being under the obligation of compliance under ITA 2000 even if it is a public body. At the same time post Puttaswamy judgement, the obligation for privacy protection is already on all Government projects. Hence NDHM is a project which needs to be compliant with the expectations of Information Privacy Protection under the Puttaswamy Judgement, as encapsulated in the PDPB 2019 which is also the “Due Diligence” requirement under ITA 2000 for both Section 43A and Section 79.

The NDHM is already under various stages of implementation and hence the Ministry of Health and Family welfare (MOHFW) had acted a few years ago in building a law called DISHA (Digital Information Security for Health Act) and also formulated the EHR policy for hospitals as well as Telemedicine Policy. However since the PDPA was conceived as a comprehensive privacy legislation, it was prudent for the MOH to drop its proposal for a separate Act and restrict itself to developing a code of practice for the health care industry to meet the requirements of PDPA.

When DISHA was drafted we did not have a draft of PDPA and now we have a near final version of the Act as proposed. Hence NDHM has gone ahead and incorporated the principles of PDPA into its policies and has already started its journey towards PDPA compliance.

This is precisely the pro-active approach which Naavi has been suggesting to other companies and sectoral regulators and we must appreciate the efforts of MOHFW in showing the way for other regulators.

The Policy document is applicable  to the participants of NDH Ecosystem which revolves around all the citizens of the country and all stakeholders in the health industry. By its very nature it encompasses the entire universe of health data processors including the Central and State Governments, Hospitals, Diagnostic labs, Pharmacies, Health Insurance services, Heath Tech Services, Medical practitioners, NGOs etc. Even the Websites who provide services to the health care sector may come under the provisions of this policy.

Since “Health” is an associated aspect of every citizen, the policy is applicable for a very large section of the population especially those who are using the services of the NDH related services.

The participants of the NDHE are issued specific Digital IDs (Patients, Doctors and other participating institutions) which will be an ID to be protected.

The policy is closely aligned to the PDPB 2019 in terms of definitions, obligations and rights guaranteed.

Some of the new difinitions that have been introduced are

“Personal Health Identifier” or “PHI” is the data that could potentially identify a specific data principal and can be used to distinguish such data principals from another. PHIs could also be used for re-identifying previously de-identified data. It could include a data principal’s demographic and location information, family and relationship information and contact details;

“Health Information Provider” or “HIPs” means hospitals, diagnostic centres, public health programs or other such entities registered with the National Health Infrastructure Registry, which act as information providers (by generating, storing and distributing health records) in the digital health ecosystem

“health locker” means a service of information exchange of electronic health records or electronic medical records, which can be accessed by the data fiduciary or data processor upon receiving the consent of the data principal and where such service can also be used by a data principal in order to create Personal Health Records;

“Health Information Users” or “HIUs” are entities that are permitted to request access to the personal data of a data principal with the appropriate consent of the data principal. The NHA may, from time to time, specify certain terms and conditions in relation to HIUs;

“Health ID” refers to the Identification Number or Identifier allocated to a data principal, “Health Facility ID” refers to the unique ID allocated to each health facility and  “Health Practitioner ID” refers to the unique ID allocated to each health practitioner

Though PDPA has missed, the policy defines the three different terms Anonymization, Pseudonymization and De-identification independently.

“de-identification” means the process by which a data fiduciary or data processor may remove, or mask identifiers from personal data, or replace them with such other fictitious name or code that is unique to a data principal but does not, on its own, directly identify the data principal;.

On the other hand, “pseudonymisation” means a data management and de-identification procedure by which personally identifiable information fields within a data record are replaced by one or more artificial identifiers, or pseudonyms;

 “anonymisation” in relation to personal data, means such irreversible process of transforming or converting personal data to a form in which a data principal cannot be identified through any means reasonably likely to be used to identify such data principal;

The definition of “Biometric” data is also interesting as it includes the “Behavioural characteristics” of a data principal, by stating “biometric data” means facial image, fingerprint scans, iris scans, or any other similar personal data resulting from measurements or technical processing operations carried out on physical, physiological, or behavioural characteristics of a data principal, which allow or confirm the unique identification of that natural person;

An interesting term called “Consent artifact” has been defined instead of the usual “Consent may be in writing or other means etc. ” Instead here  “consent artifact” means a machine-readable document that specifies the parameters and scope of data sharing and access that a data principal consents to in any personal data sharing transaction;

The guideline also adopts the term “Consent Manager” which in this context means an entity or an individual, as the case may be, that interacts with the data principal and obtains consent from him/her for any intended access to personal or sensitive personal data, where the role of the consent manager may be provided by the NHA or any other
service provider;

The “Definitions” indicate that the policy seems to have taken into consideration many aspects of PDPA and made relevant additions also which may in turn influence the final draft of the PDPA.

(To Be Continued)

Naavi

All Articles in the series:

1.National Digital health mission shows the way… Be Ready before PDPA becomes effective

2.NDHM is a trend setter… Get started early on the Privacy Protection journey

3.Consent Management under NDHM

4. NDHM-Health Management policy Objective need not be linked to ISO standard

5.Managing IDs in NHD ecosystem

6. Data Fiduciaries under NDHM

India is entering the global order of Privacy Protection with the enactment of “Personal Data Protection Act” some time in 2021 when the Bill (PDPB 2019) will be presented to the Parliament.

Even while a section of the industry is working at delaying the passage of the Bill, the Government is silently working at implementing the provisions of the proposed bill in its National Digital Mission without waiting for the Bill to be passed, DPA to be constituted etc.

This approach is consistent with the law in India since Information Technology Act 2000 (ITA 2000) already has provisions under Section 43A.  This provision of ITA 2000 mandates protection of sensitive personal data under “Reasonable Security Practice”.

“Reasonableness” under Section 43A can be extended to “Due diligence” which includes the general legal development in the country that India is shortly enacting a comprehensive personal data protection Bill which will expand and replace Section 43A of ITA 2000.

The fact that PDPB 2019 is the “Due Diligence Prescription under Section 43A of ITA 2000” is the reality and though the penal provisions of the law may not be effective as at this time, the principles of personal data protection under PDPB 2019 are applicable as of now as part of Section 43A of ITA 2000. This has been rightly recognized by the Ministry of Health which has adopted the emerging law into its NDHM project through a comprehensive ” Health Data Management Policy”.

Since this policy indicates how other sectoral regulators may also think of advancing the implementation of PDPB 2019 without waiting for the formalities of its passage into a law, we can explore this policy is greater detail along with the other details of the NDHM through a series of articles.

Watch out for more information

Naavi

( To be continued)

All Articles in the series:

1.National Digital health mission shows the way… Be Ready before PDPA becomes effective

2.NDHM is a trend setter… Get started early on the Privacy Protection journey

3.Consent Management under NDHM

4. NDHM-Health Management policy Objective need not be linked to ISO standard

5.Managing IDs in NHD ecosystem

6. Data Fiduciaries under NDHM