National Digital Health Mission Health Data Management Policy

Ø   

Objectives: The objectives of the Draft Policy inter alia include creation of a framework for secure processing of personal and sensitive personal data of individuals who are a part of the NDHE in compliance with all applicable laws, building of a system of digital personal and medical health records which is easily accessible to individuals and health service providers which is purely voluntary in nature and based on the consent of individuals.

Ø   

Definitions: The definitions envisaged under the Draft Policy are a mix of those as defined under the Personal Data Protection Bill 2019 (PDP Bill) with some alterations/additions to provide for certain granular aspects of health data. For example, the Draft Policy defines the term ‘sensitive personal data’ to include information relating to various health conditions and treatments of the data principal (an individual whose data is being collected), such as Electronic Health Record (EHR), Electronic Medical Record (EMR) and Personal Health Record (PHR) of the data principal.

Ø   

Health ID: The Draft Policy envisages the creation of a Health ID. A data principal may request for the creation of a Health ID at no cost, which will enable them to participate in the NDHE ecosystem. Any processing of personal data that may take place for creation of such ID must be in accordance with the Draft Policy. The Health ID may be generated in a manner as may be specified by the NHA and may be authenticated by the data principal’s Aadhaar number or any other identification document as specified by the NHA. The personal data of a data principal will be linked to his/her Health ID, and any data principal in possession of such a Health ID is deemed to be the owner of such personal data. In a similar manner, a health practitioner may request for the creation of a Health Practitioner ID at no cost, which will be required to enable them to participate in the NDHE.

Ø   

Certain key compliances: The Draft Policy provides for various compliances in relation to collection and processing of personal data and sensitive personal data. Data fiduciaries (akin to a data controller) can collect or process personal data or sensitive personal data only with the consent of the data principal. Further, the purposes for processing of personal data will be limited to those as may be specified by the NHA. Data fiduciaries are also required to adhere to certain principles such as transparency, accountability, and reasonable security practices and procedures. A data fiduciary is also required to execute confidentiality and non-disclosure agreements with data processors covering data protection and privacy responsibilities. Data fiduciaries are required to implement the International Standard IS/ISO/IEC 27001 on "Information Technology - Security Techniques - Information Security Management System - Requirements" as well as any other standard as may be applicable to them.

Ø   

Rights of data principals: This Draft Policy, akin to the PDP Bill, provides data principals with several rights in relation to their personal data and sensitive personal data such as the right to confirmation and access, correction and erasure and data portability. The Draft Policy outlines the manner in which such rights are to be exercised by data principals against data fiduciaries.

Ø   

Sharing of personal data and sensitive personal data: Any personal data processed by a data fiduciary may be shared with a health information user (HIU) in response to a request made by such HIU for personal data pertaining to the data principal, only where consent of the data principal is obtained. These HIUs are entities that are permitted to request access to the personal data of a data principal with the consent of the data principal. Data fiduciaries may make anonymised or de-identified data in an aggregated form available for the purpose of facilitating health and clinical research, academic research, archiving, statistical analysis, policy formulation, the development and promotion of diagnostic solutions and such other purposes as may be specified by the NHA. Any personal data or sensitive personal data of a data principal are not permitted to be published, displayed or posted publicly by any person or entity.

Ø   

Governance structure: The Draft Policy provides that the governance structure for the NDHE shall be as specified by the NHA, which will lead the implementation of the NDHM. In addition, the governance structure will consist of such committees, authorities and officers at the national, state and health facility levels as will be necessary to implement the NDHM. It has also been envisaged that the MoHFW and the Ministry of Electronics and Information Technology will also provide overall guidance to the NHA on relevant aspects of the NDHM.