National Digital Health Blueprint: An overview, opportunities and legal challenges

Rahul Dev, Patent Attorney and Technology Business Lawyer shares a deep understanding of the national digital health blueprint and emphasis on the need for a concrete legal policy

India is in critical need of a reliable and affordable framework to manage public healthcare. The present challenges faced due to the coronavirus are a glaring reminder that a robust public healthcare framework is imperative for the stability and the growth of a nation. 

Although the pandemic has slowed down India’s business growth, India is perceived as one of the fastest-growing economies. In order to spur growth and development, India needs to introduce and implement initiatives that ensure a healthy workforce, improve the public healthcare framework and most importantly integrate public and private healthcare resources. 

In July 2019, the Ministry of Health and Family Welfare released the National Digital Health Blueprint in the public domain and invited comments from various stakeholders, including the general public. This blueprint aims at establishing and managing the core digital health data and provide the appropriate infrastructure required for its continuous exchange. This evolution of Indian healthcare can be achieved by supporting the implementation of open standards by all the stakeholders in the National Digital Health ecosystem.

Understanding the need to introduce the National Digital Health Blueprint

This National Digital Health Blueprint is an extension of the National Health Policy of 2017 (NHP 2017) that was formulated to provide universal healthcare to all citizens of India based on digital technologies for achieving higher efficiency and effectiveness. 

In 2018, the NITI Aayog introduced the National Health Stack (NHS), which is a digital arrangement aimed at developing a clearer and sturdier health insurance system. 

In essence, the NHS covers multiple mechanisms, including, an electronic national health registry that would function as a single foundation of health data for the nation. Another mechanism includes a coverage and claims platform to function as the building blocks for robust health protection schemes, thereby allowing for the horizontal and vertical expansion of schemes such as Ayushman Bharat by the states, and further allowing a robust system of fraud detection.

In addition, the NHS also aims to provide a Federated Personal Health Records (PHR) system to provide the citizens with access to their health data, and further facilitating the accessibility of the health data for medical research, which is crucial for evolving the understanding of human health.

Furthermore, an interesting mechanism of the NHS includes the introduction of National Health Analytics (NHA). The NHA provides an inclusive data-sharing platform covering various health schemes, and sustaining this platform for smart policymaking and regulation by way of improved techniques, such as, for example, by enhanced projecting analytics. 

To ensure that various aspects of the NHS are fully connected and prevent the accumulation of detached silos, the NHS further includes the introduction of supplementary horizontal systems with a unique digital health ID, health data language, and supply chain control via health programmes.

Keeping the above initiatives in mind, the NDHB is a constructive document that has been introduced for the application of the NHS. The underlying idea is to make a national digital health ecosystem that supports universal health coverage in a competent, available, comprehensive, reasonable, opportune, and safe manner, through the provision of an extensive collection of data, information, and infrastructure services. 

Features of the National Digital Health Blueprint 

The NDHB identifies the necessity to establish a specific organisation, called the National Digital Health Mission (NDHM) that can facilitate the implementation of the blueprint, to support and simplify the development of a national digital health ecosystem. 

The key features of this blueprint include a unified architecture, a set of architectural elements, a five-layered structure of architectural institutional blocks, a Unique Health ID (UHID), privacy and consent control, national portability, electronic health records, appropriate principles and guidelines, and, health analytics. 

 With a view to ensuring that the implementation of NDHB as proposed by the Government does not create any imbalance, healthcare stakeholders in the private sector have been asked to review all the aspects of the NDHB in a diligent manner.

Legal challenges 

At a time when the country is right in the middle of a public health emergency, it becomes all the more important to implement the National Digital Health Blueprint to ensure quality care is introduced across all strata of the society. However, this implementation comes with an anticipated set of legal challenges.

One of the main concerns with the National Digital Health Blueprint (NDHB) report is that it suggests a framework that severely overlaps with the fundamental right to privacy. Specifically, it does not align fully the privacy principles recommended by the Group of Experts on Privacy (Justice A.P. Shah Committee) and the more recent, Justice B.N. Srikrishna Committee report whose recommendations on data protection form the core foundation for the draft Personal Data Protection Bill, 2018. 

Moreover, the blueprint allows the use of Aadhaar based authentication for schemes under Section 7 of the Aadhaar Act. However, the Hon’ble Supreme Court’s Aadhaar judgment held that Aadhaar can be used only when backed by law, and, even the amended Aadhaar Act of 2019 allows Aadhaar to be used only for telecom and banking. 

Additionally, the blueprint does not provide sufficient safeguards against commercial exploitation of Sensitive Personal Information (SPI) that may be caused by private entities that will be linked to public entities under this system. These include insurers, pharmaceutical companies, and device manufacturers. The use of Aadhaar for online electronic signature service (e-Sign) as a quick and convenient tool to access various medical services under the NDHB framework is an illustrative example of this challenge.

Unauthorised access to health records

The right of patients to control their medical data is not completely accredited in the NDHB, even though the Supreme Court had said in its Privacy Judgment that control over information is a cornerstone of privacy. In the absence of concrete legal policy, third parties such as insurance companies, pharmaceutical companies, employers, and data brokers may not be given complete access to the medical data of the patients.

The present discussion represents just the tip of the iceberg depicting various legal pitfalls associated with the implementation of the NDHB. In the present form, there exist serious concerns about the privacy of an individual’s health records. Hence, implementation of the blueprint in the absence of an enforceable data protection law seems impractical. 

Ideally, the blueprint should be brought to reality after the data protection bill is passed so that the important provisions of this law are applicable to the blueprint. For example, as per the data protection bill, there are mechanisms in place to provide the right to the patients to complete their incomplete data, or update the incorrect information. However, such a right is not recognised in the blueprint in its existing form, which calls for major amendments to align itself with the legal provisions of the soon to be introduced data privacy law.

Accordingly, the government’s action plan has to be absorbed with a pinch of salt and extensive due diligence is required by all stakeholders to ensure that a right balance is created between the public healthcare needs and the legal rights of the citizens, specifically the right of privacy and data protection.