Data PrivacyData Privacy in the Healthcare Sector

INTRODUCTION

In the digital age and the century where, everyday tasks start with technology and end with  technology, there is a lot of transfer and sharing of all kinds of personal and sensitive data ,  which ultimately increases  the risk of such data getting leaked.

Data security is a crucial component of the healthcare sector too. It is important to protect sensitive patient data and adhere to rules like those imposed by The Health Insurance Portability and Accountability Act,1996 (hereinafter referred to as “HIPAA”). Healthcare is continuing to delve deeply into technology along with its many facets, including big data, machine learning, and artificial intelligence. As a result, how we use and secure that data becomes more important. Security and confidentiality of healthcare data are therefore essential in the healthcare environment.

In the past few years, data breaches have become a common phenomena worldwide, this could be attributable to various reasons. However,  the individuals to whom the data relates open to huge risk of identity theft, data fraud etc. The implications are much more grave for patients who disclose critical data to the healthcare sector which includes insurance details and details of close ones who might act as emergency contacts or caretakers.

This has led to a growing need for better laws and regulations to protect patient data. In this article, an overview of data privacy in the healthcare industry has been covered, along with flaws in the laws related to data privacy in healthcare, possible violations of patient rights due to data privacy issues, and steps to be taken by healthcare organisations to protect patient data.

DATA PRIVACY AND HEALTHCARE

Data Privacy and Healthcare have an interconnected spectrum in the present times, which has both positive and negative sides. The idea of using the data of the patients is to help keep track of the medical history of the patients so as to understand any problem or disease thoroughly and ensure treatments which are in synchrony with present and past ailments.

Data breaches of such sensitive medical data can not only risk the rights and privacy of the patients but may also cause patients to lose trust in the health industry, leading to sharing of wrong or incomplete data in the future.  This can lead to causing problems for health professionals to understand the disease properly, resulting in major treatment failures and ultimately disturbing the healthcare system of that particular country.

One such example is the “Arogya Setu” application which was release by the Government of India  during the Covid-19 pandemic,, which tracked data relating to the movement of an individual and the history of places visited so as to keep track of the spread of disease by understanding the source and thus mitigating the damage from the spread of the virus. Many analysts criticized this feature as it breached the privacy of an individual and violated fundamental rights of individuals.

Such a practice has also been observed in various countries, like Germany, which developed the Corona-Warn-App Switzerland’s SwissCovid Italy’s Immuni and many other countries throughout the world which have used the data of the public to monitor their movements in order to maintain safe healthcare in the country and have breached the privacy of their citizens to some extent, even though they have much more stringent laws as compared to India.

It is clear that data privacy and the healthcare industry have a very complicated relationship, as the need to obtain data by breaching privacy is important to ensure better healthcare facilities, but there is also a need to understand the extent to which the data is being used with the consent and knowledge of the patient.

FLAWS IN THE CURRENT LAWS RELATED TO DATA PRIVACY IN HEALTHCARE

India has recognized the issue of Data Privacy and has passed certain laws like the Information Technology Act, 2000, the Information Technology Rules, 2011 and the Digital Data Protection Bill, 2022, for ensuring enforcement of such laws, India also has a national cyber security team called the Indian Computer Emergency Response Team (hereinafter referred to as “CERT-In”) and a dedicated investigation agency in the form of Cyber Crimes Portal. However, there are several flaws in the current laws related to data privacy in healthcare.

One of the major flaws is the lack of clarity in the rules related to the collection and use of personal information in handling cross-border data flaws, and as the technology is developing rapidly, the laws fail to effectively cover this issue, especially in the healthcare sector, where patients frequently travel across borders for treatments due to higher quality procedures or cheaper medicines and doctors’ fees.

So, such a shift to the digitalisation of medical data opens the door for organisations to engage in malicious activities that can lead to a person’s identity and banking information being breached, as was observed in December,2022 where a cyber-attack case where the AIIMS, one of India’s largest and most respected medical institution/hospital, 5 servers of the AIMMS information technology network were infiltrated by hackers which lead operational disruption and non-functionality of critical applications and making the entire Hospital’s going manual for over a week.

The responsibility of maintaining and improving the encryption is also important, as hacking activities and other malicious practices like installing Ransomware, Group DDoS attacks, and phishing have been evolving and becoming more difficult to safeguard against throughout the world, leaving healthcare as no exceptions. Thus, updating the encryption is a necessity that needs to be addressed by the legislature and the cyber cell branch.

HOW HEALTHCARE ORGANIZATIONS CAN PROTECT PATIENT DATA

To protect patient data, healthcare organizations must implement a comprehensive data privacy program. This program should include policies and procedures for the collection, use, and disclosure of personal information, as well as training for staff on data privacy.

• Organizations should also implement technical measures to protect patient data, such as encryption and firewalls. Access to patient data should be restricted to authorized personnel only, and regular audits should be conducted to ensure compliance with data privacy policies and procedures.
• Ensure proper training of industry personnel dealing with patient data to handle data and safeguard it from any hacking attacks.
• Appointment of trained IT professionals to ensure the protection of internal data management systems should be made an industry standard practice in the healthcare industry. .
• Government must strive to create proper frameworks and monitoring teams for data breaches in the country and ensure efficient investigation and strict enforcement to stop such cyber -attacks and cyber leaks.

REGULATIONS IN THE EUROPEAN UNION FOR REGULATING DATA PRIVACY IN THE HEALTHCARE INDUSTRY

New technologies have presented significant opportunities for collecting, utilizing, and sharing health data in a more efficient manner, with the aim of empowering patients in managing their diseases, supporting research endeavours, and enhancing the quality, safety, and efficiency of healthcare systems. Thus, the European Union (hereinafter referred to as “EU”) adopted a new regulation in 2016 that required Member States to incorporate its provisions into national law. The Regulation will be directly applicable to Member States, with limited exceptions allowing for additional measures at the national level, the same provisions will apply uniformly across the EU, to improve the data security of patients by properly addressing the issues related to breaches of privacy and misuse of the data available in the healthcare industry. However, before 2016, the Directive on general data protection was governed by a law implemented in 1995. The emergence of new technologies, such as the increased use of the internet and electronic means in healthcare and telemedicine, necessitated the formulation of a new Regulation.

The new regulation is called the General Data Protection Regulation (hereinafter referred to as “GDPR”), which applies to all healthcare industries. This regulation uniformly facilitates harmonization of data protection rules and enhances consistency in interpretation, reducing discrepancies between countries. The harmonization has positive implications, particularly in facilitating cross-border research and cross-border healthcare, as the same provisions apply throughout the EU.

The GDPR places a strong emphasis on the rights of individuals and their control over their personal data in the healthcare sector. By empowering patients, it aims to enhance their involvement in managing their diseases and improve healthcare outcomes. Moreover, the regulation recognizes the importance of data security and privacy, addressing concerns raised by citizens who felt a lack of control over their data.

The introduction of the GDPR signifies a significant shift in the approach to data privacy in the healthcare industry within the EU. It reflects the need to adapt to evolving technologies and ensures that individuals’ rights and information are protected. By promoting transparency, accountability, and harmonization, the GDPR strives to foster a more efficient and secure healthcare system while empowering individuals in the management of their health data.

CHALLENGES FACED BY THE EU REGULATIONS

The healthcare sector faces numerous challenges in implementing the General Data Protection Regulation. These challenges encompass navigating the complexities of the data ecosystem, ensuring compliant consent management, addressing third-party data sharing complexities, implementing robust data security measures, managing cross-border data transfers, achieving interoperability and data portability, fostering compliance awareness, resolving legal ambiguities, determining appropriate data retention and storage practices, facilitating research and scientific progress, managing international collaborations, coping with administrative burden, and adapting to evolving healthcare technologies.

The challenges include understanding the intricacies of sensitive healthcare data, obtaining valid consent in diverse healthcare contexts, establishing secure data sharing practices, safeguarding against data breaches, reconciling GDPR requirements with international data transfers, achieving seamless data exchange and patient control, promoting compliance education among healthcare professionals, interpreting and applying the GDPR’s provisions, striking a balance between data retention and privacy rights, enabling research while upholding data protection principles, addressing international regulatory differences, managing administrative demands, and addressing privacy concerns posed by emerging technologies. Overcoming these challenges requires continuous collaboration, effective policies, and ongoing adaptations to ensure privacy protection while facilitating advancements in healthcare and research.

A prime example of these issues was seen with Shields Health Care Group, a medical services provider in Massachusetts, who suffered a data breach affecting approximately 2 million individuals in the US. Hackers gained unauthorized access to Shields’ systems from March 7 to March 21, 2022. Stolen data included sensitive information like names, Social Security numbers, addresses, medical records, and more.

AMLEGALS REMARKS

Data privacy is of utmost importance in the healthcare industry, and the number of cyberattacks in the healthcare industry has risen by 95.35% in the first 4 months of 2022 as compared to that of 2021, this clearly shows the need for better data protection laws. The present laws governing this domain are clearly not equipped to ensure protection against breach of data in general and therefore it is also silent about any additional level of protection for vulnerable data subjects like patients, thus the issues plaguing data privacy need to be addressed and understood by the legislature to ensure that a proper framework and laws can be implemented.

The current laws do not provide for penalties for companies that fail to protect personal information or that use it without consent. This lack of penalties makes it difficult to enforce the rules and protect patient data.

The duty also falls upon healthcare organizations to take steps to protect patient data, including implementing a comprehensive data privacy program and technical measures to protect patient data. It is essential that patient rights are protected by better laws and regulations related to data privacy in healthcare. Thus, protecting patient data is everyone’s responsibility; the patients must be made aware of their rights related to data privacy so they understand where they are sharing their data and what steps they can take to protect their personal information.  This will ultimately ensure a better healthcare regime in the country, ultimately improving the ease of living and the economy of the country.

– Team AMLEGALS assisted by Mr. Lakshya Raj Singh Rathore (Intern)