Health Data Retention Policy : Analysis – UPSC GS3

By /
Context: The National Health Authority (NHA) has initiated a consultation process on the retention of health data by health-care providers in India.
Health Data Retention Policy of India:
  • The National Health Authority (NHA) released a consultation paper on a proposed health data retention policy.
  • Data retention is the practice of storing and managing personal health data for a designated period.
  • The proposed policy would fall within the ambit of the Ayushman Bharat Digital Mission (‘ABDM’), formerly known as the National Health Digital Mission.
  • Objective:
    • To ensure uniformity in record retention, as well as compliance with applicable regulations, guidelines, and laws in India.
    • To minimize risks associated with personal health data, while also maximizing the benefits from the use of the same.
  • Need for such a policy:
    • Currently, service providers can compete on how they handle the data of individuals or health records.
    • Given the landscape of health-care access in India, including through informal providers, many patients may not think about this factor in practice.
  • Benefits of the Policy:
    • Individuals benefit through greater convenience and choice, created through portability of health records.
    • The broader public benefits through research and innovation, driven by the availability of more and better data to analyze.
Justice K. S. Puttaswamy Judgment
  • The Supreme Court of India, in Justice K. S. Puttaswamy (Retd) Vs Union of India, held that privacy of medical/health data is a fundamental right under Article 21 of the Constitution.
  • Consequently, any policy with a significant bearing on this right must meet the four tests laid by Puttaswamy, i.e. the measure must be
    • a procedure established by law aimed at a legitimate goal;
    • just, fair and reasonable;
    • proportionate to the objective sought to be achieved; and
    • have procedural guarantees to check against abuse by state or non-state actors.
What are the Issues with the Health Data Retention Policy?
  • Privacy Concerns: The privacy risks should make us very hesitant about retaining an individual’s entire health or medical record on the grounds that they might be useful for research someday. As per Indian law, if an individual’s rights are to be curtailed due to anticipated benefits, such benefits cannot be potential or speculatory.
  • Legality Concerns: The question of legality becomes a question about the legal standing and authority of the NHA. The NHA is not a sector-wide regulator, it has no legal basis for formulating guidelines for health-care providers in general.
  • Concerns with Sensitive Data: The legal systems consider health data particularly sensitive, and improper disclosure of this data can expose a person to a range of significant harms.
  • Concerns with Anonymity: Standards for anonymisation are still developing. The research community is still to arrive at consensus on what constitutes adequate anonymisation.
Way Forward:
  • A clear and specific test for retaining data with rigorous processes run by suitable authorities.
  • To anonymise data that is being retained for research purposes.
  • An alternate basis for retaining data can be the express and informed consent of the individual in question.
  • Health-care service providers will have to comply with the data protection law, once it is adopted by Parliament.
Scroll to Top