Health Data and Privacy

In one line

Confidentiality was a rule about what a doctor says; data protection is a rule about what a system holds, and the difference is that the system never forgets and is not a person.

In the wording a student can write in an exam: health data engages the same interest as medical confidentiality but under conditions the older duty was not designed for, since information that was once held in a single practitioner's record is now collected at scale, retained indefinitely, combined with other data, and processed by entities with no relationship to the patient; and the legal response accordingly shifts from a duty owed by an individual professional to a framework of purpose limitation, consent, security and accountability applied to whoever holds the data, resting constitutionally on informational privacy under article 21 as recognised in Puttaswamy.

Why the law has this at all

Apply the five changes from [How a Technology Becomes a Rights Question] to a medical record and the case for a separate body of rules makes itself.

Scale. A practitioner's confidence covered the patients they saw. A hospital system covers everyone who ever attended, and a national health identifier covers everyone.

Cost. Copying and searching a paper record cost something and that cost limited what was done with it. Neither costs anything now.

Permanence. A paper record decayed and was eventually destroyed. A digital record persists, so a diagnosis at nineteen is retrievable at fifty.

Invisibility. A patient knew when their doctor was consulted about them. They do not know when a record is accessed, transferred, analysed or sold.

Delegation. Decisions about care, eligibility and pricing are increasingly taken by systems reading the record, which is the problem of [Artificial Intelligence and Decisions by Machines].

The last three are what the duty of confidence cannot reach. It is a duty owed by a person who can be identified and sued, and it addresses disclosure; the harms above arise from retention, combination and processing, often without any disclosure in the ordinary sense.

The constitutional foundation

Justice K.S. Puttaswamy (Retd.) v. Union of India, AIR 2017 SC 4161, (2017) 10 SCC 1, decided on 24 August 2017 by nine judges, held that the right to privacy is protected as an intrinsic part of the right to life and personal liberty under article 21 and as a part of the freedoms guaranteed by Part III, over-ruling M P Sharma and over-ruling Kharak Singh to the extent that it held otherwise.

Two features of the reasoning bear directly on health data, and both were recorded in the judgment delivered for four of the nine judges. Information is nonrivalrous, invisible and recombinant, so that a person may never learn that their data has been taken. And a data protection regime must not permit collection that discriminates on grounds including genetic or health status, which names this subject matter expressly.