PM Modi’s Digital Health Mission Might put Personal Data at Risk, Lead to Exclusion

Prime Minister Narendra Modi on Monday launched the Ayushman Bharat Digital Mission (ABDM), which he said would “strengthen health facilities” in the country. via video conference. Currently, the project is being implemented in a pilot phase in six Union Territories.

In his Independence Day speech in 2020, Narendra Modi had first announced the scheme. “From today, a major campaign is being launched in which technology will play a big role. The National Digital Health Mission is being launched today. This will bring a new revolution in India’s health sector and it will help reduce problems in getting treatment with the help of technology,” the Prime Minister had said.

The ABDM is an ambitious plan to build a digital health ecosystem that connects different stakeholders in the healthcare sector, both public and private. A key aspect of the mission is to establish a Unique Health Identifier (UHID) system that issues a unique identification number for each individual (or entity), which links to the Electronic Health Record (EHR) of that individual (or entity). EHRs are a longitudinal electronic version of patients’ complete medical history (tests, diagnosis, treatment, prescriptions, etc.) that can be seamlessly and efficiently exchanged with healthcare providers. This is intended to facilitate health information exchange for patient care and secondary use, including research and healthcare planning.

After the announcement, the National Health Authority (NHA) officially rolled out digital health IDs in the six union territories of India on a pilot basis. On December 14, 2020, the government approved the National Digital Health Mission: Health Data Management Policy (NDHM-HDMP) to guide the development of the UHID system, as well as facilitate the creation, storing, processing and sharing of individual Electronic Health Records.

However, healthcare professionals and experts have raised concerns about the impact of the NDHM framework on data privacy and access to health. According to an analysis of the Health Data Management Policy, it cannot ensure that digitisation of medical records would be undertaken with due protection of individual autonomy, informed consent, confidentiality and privacy. The analysis was done by the Centre for Health, Equity, Law & Policy (C-HELP), ILS Law College, and Internet Freedom Foundation (IFF) and was published in June 2021.

The policy does not establish an independent regulatory authority overseeing the government and private sector entities’ collection, storage, processing, and sharing of health data. Further, the HDMP simply states that liabilities and penalties will be as per existing law. According to the paper mentioned above, in the absence of a data protection law, “the current laws simply don’t have adequate penalties to cover different actors and different ways in which data can be breached.”

Despite the risk, the Indian government is forging ahead with adding more digital health initiatives tied to the NDHM-HDMP framework, including telemedicine and the COVID-19 vaccination drive through the Co-Win portal.

According to the authors of the paper, on the one hand, the UHID and EHRs can make healthcare more efficient, cost-effective and accessible. But on the other hand, they also entail significant risks to the privacy, confidentiality and protection of personal health data, and exclusion and unfairness due to digital illiteracy.

“In order to make a successful transition from paper to a digital system, and minimise the risks associated with it, it is necessary to ensure health system and security environment preparedness to support the digitisation. A robust legal and regulatory framework that protects individual rights, through adequate enforcement, transparency and accountability mechanisms, is also imperative,” the paper said.

The paper’s analysis of the NDHM-HDMP revealed five significant shortcomings: weak legal foundation and inadequate preparatory groundwork; excessive delegation; a narrow framework of consent and privacy; risks of exclusion, especially due to dependence on an Aadhaar-based authentication system; and possibilities of data monetisation by private sector entities.

On paper, the NDHM seems more inclusive than most other schemes and policies introduced by the current Union government. But the policy explicitly lays down a regime of non-exclusion, with respect to both the possession of a health ID and Aadhaar-based verification. It mandates that participation in the National Digital Health Ecosystem (NDHE) shall take place on a voluntary basis, and no individual can be denied access to any health service for lack of a health ID. Additionally, Aadhaar will not be mandatory to register for a Health ID while each data principal shall have the right to opt-out of the programme at any time and ask for the de-linking and deletion of their data.

However, it is unclear whether the proposed framework will be able to accommodate user consent in practice. Experts have stated that the registration for the health ID may be similar to Aadhaar based registration, in that it would be “‘voluntary’ on paper, but made mandatory by certain institutions, both government-owned and private”. Multiple media reports have mentioned cases in which the health ID has been made mandatory.

Concerns have also been raised about whether the NDHM is yet another step towards privatising healthcare. In a statement released in August 2020, National Health Authority (NHA) of AB-PMJAY (Ayushman Bharat-Pradhan Mantri Jan Arogya Yojna) said that the NDHM “will reduce existing gaps between various stakeholders, such as doctors, hospitals and other healthcare providers, pharmacies, insurance companies and citizens by bringing them together and connecting them in an integrated digital health infrastructure.” NHA is the main designer and promoter of NDHM, and it is advised by the government think-tank, NITI Aayog.

It is feared that NDHM will help convert the government’s role from a ‘service provider to a broker’ for the private healthcare sector. This is something that has been seen before. The Ayushman Bharat project was aimed at converting the government’s role from a ‘Service Provider to a Financier’, as announced by the former Union Health Secretary Sujatha Rao. In effect, however, it has paved the way for insurance companies to provide funds for healthcare with a profit motive instead of strengthening primary and tertiary infrastructure to provide free and universal healthcare.

According to experts, NDHM is a scheme for privatisation of healthcare system replacing government healthcare services, promoting ‘e-Pharmacy’ for online supply of medicines and telemedicine as a mode of online diagnosis to digital prescription for the private sector’s benefit. It also keeps an individual’s medical history and other details under governmental control, which could end up being used for commercial purposes by the private sector, including during trials for new formulations by multinational drug companies.