Digital Personal Data Protection Act 2023: Impact On Indian Healthcare Industry

The Digital Personal Data Protection Act, 2023 (DPDP Act) is a new law regulating personal data processing in India. It aims to protect the privacy rights of individuals and create a framework for data governance and accountability. The DPDP Act will significantly impact the Indian healthcare industry, which is still in its early stages of digital evolution. Some of the key impacts are:

• The DPDP Act will require healthcare providers and entities to obtain explicit consent from data principals (individuals whose data is processed) before collecting, using, or sharing their personal health data, which is classified as sensitive personal data under the law

• The DPDP Act will also mandate healthcare providers and entities to implement appropriate security measures, conduct data protection impact assessments, appoint data protection officers, and comply with the codes of practice and standards issued by the Data Protection Board of India

• The DPDP Act will enable data principals to access, correct, erase, port, and restrict the processing of their personal health data and seek redressal for any grievances or violations of their rights

• The DPDP Act will create new opportunities for innovation and collaboration in the healthcare industry, as it will facilitate the use of personal health data for research, public health, emergency response, and other purposes, subject to certain conditions and safeguards

Implications of Digital Personal Data Protection Act 2023 in Healthcare Sector

The Digital Personal Data Protection Act, 2023 (DPDP Act) will have various implications in the healthcare sector in India, such as:

• It will require healthcare providers and entities to adopt privacy-conscious and data-responsible practices, such as obtaining explicit consent, implementing security measures, conducting data protection impact assessments, and appointing data protection officers

• It will enhance patient trust and confidence in using their personal health data, which is classified as sensitive personal data under the law.

• It will create new opportunities for innovation and collaboration in using personal health data for research, public health, emergency response, and other purposes, subject to certain conditions and safeguards

• It will also create challenges for developing and adopting data-driven technologies, such as artificial intelligence and machine learning, which may require balancing the protection of patient privacy and the potential of these technologies.

It will interact with other existing or proposed laws and policies related to health data, such as the Ayushman Bharat Digital Mission (ABDM), which aims to create a unique health ID named ABHA and a digital health record for each person. 

Government Initiatives to Protect Patient Data

The Information Technology Act 2000 governs provisions related to Protected Health Information (PHI) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011. 

Patient data, including health information, is treated as sensitive personal data or information and, under the IT Act, offers some degree of protection to the collection, disclosure, and transfer of sensitive personal data. 

Also, long before DPDP Act 2023, the Government introduced the Digital Information Security in Healthcare Act (DISHA), India’s counterpart of the Health Insurance Portability and Accountability Act (HIPAA), aimed at providing healthcare data privacy, security, confidentiality, and standardization and establishment of the National Electronic Health Authority (NeHA) and Health Information Exchanges. While this act aims to encourage the pan-India adoption of e-health standards, DISHA has not yet come into force. 

Penalties in Digital Personal Data Protection Act 2023 

Under the DPDP Act, 2023, you have the right to file a complaint with the Data Protection Board of India (DPB), which is the enforcement body established under the act, if you suspect or experience any non-compliance by a third party that collects or processes your personal data. The DPB can inquire into the complaint, direct any remedial or mitigation measures, inspect any document, summon and enforce the attendance of any person, and impose penalties for non-compliance. 

The act allows only monetary penalties for breaches or non-compliance, ranging from INR 50 crore to INR 250 crore, with a maximum penalty of INR 500 crore for significant data breaches. You can also seek compensation from the DPB for any harm caused to you due to the non-compliance by the third party. However, the act does not provide criminal liability or imprisonment for non-compliance. 

Data Principal

A key ingredient in laws in other countries is the power to impose penalties up to a particular amount as prescribed for offenses or as a percentage of total worldwide turnover, whichever is higher.

A data principal is under an obligation to not register a false or frivolous complaint with a data fiduciary or the Board, not to furnish any false particulars or suppress any material information. 

DPDP Act 2023 has introduced a penalty of up to ₹10,000/- (Rupees Ten Thousand) on the data principal for failure to comply with its proposed obligations.

The proposed DPDP Act 2023 introduces the concept of ‘Deemed Consent’, where the data principal is deemed to have given consent for processing their personal data. 

Consensual processing of personal data may be done in case of medical emergencies involving a threat to life or an immediate threat to the health of the Data Principal. In the context of such processing, a parallel may be drawn with India’s draft Health Data Management Policy by ABDM released in April 2022, which also envisages provisions relating to the processing of Personal Data in case of medical emergencies. 

Notably, the ABDM contemplates the appointment of a nominee to provide valid consent on behalf of the Data Principal in case such Data Principal becomes seriously ill or mentally incapacitated or where the Data Principal is facing a threat to life or a severe threat to health and is unable to give valid consent. 

Unlike the DPDP Act 2023, the ABDM does not propose Deemed Consent in the absence of a nominee but instead shifts the right to give valid consent on behalf of the Data Principal to an adult member of the family of the Data Principal.

Despite the recommendation under the JPC Report, the DPDP Act 2023 has kept the 'Non-Personal Data' of the individuals, such as information collected by the Government, NGOs, and other private sector entities, outside its ambit. The usage of phrases 'as it may be considered necessary' and 'as may be prescribed' can lead to administrative ambiguities. The autonomy of the Data Protection Board, which is entrusted with overseeing the protection of individual's personal data and ensuring compliance with the provisions of the law, is not reassuring. Further, the Government and its instrumentalities can retain personal data for an indefinite period irrespective of whether the purpose for which data was processed has been fulfilled. 

Conclusion

By 2030 India is projected to be the world’s third-largest economy and will have one of the world’s largest digital personal data footprints in motion and at rest. 

The DPDP 2023 Act’s essentiality shines in our strengthening role in the global order. With the G20 Presidency and multiple Free Trade and Regional Trade Agreements in place, we must find solutions for Data Free Flow with Trust and cross-border data flows.

Blockchain in healthcare: The Ultimate use case?

Many people have heard a lot about the blockchain in frames of a cryptocurrency called Bitcoin; however, it can have a much wider use than a simple payment method, including various industries. So, how does blockchain actually work in the healthcare industry? 

Health Care and Interoperability

Interoperability is a huge problem in the healthcare industry. In fact, improved healthcare interoperability is been a top priority for providers, policymakers, and patients for quite some time now.

So what are the two major areas when it comes to ineffective interoperability?

• The trouble of identifying patients
• Information blocking

The trouble of Identifying Patients

One of the most surprising things that we learned while researching for this guide. Apparently, there is still no universally recognized patient identifier. This despite the fact that organizations like CHIME and HIMSS have been pushing for its development for almost two decades.

This is truly shocking when you consider the fact that a unique patient identifier will be able to easily solve the problem of mismatched patient EHRs (Electronic health record) which has in the past led to several errors in patient care and increased the likelihood of patient harm.

This problem has been well expressed by the Director of Center for Biomedical Informatics (CBMI), Shaun Grannis.

“Matching the correct individual to his or her health data is critical to their medical care,” he says. “Statistics show that up to one in five patient records are not accurately matched even within the same health care system. As many as half of the patient records are mismatched when data is transferred between healthcare systems.”

So, how can the blockchain potentially solve this problem? Well, let’s look into it in a bit. Before we do so let’s look at the second problem that we have here.

Information Blocking

Despite being deemed an illegal practice, information blocking has been a problem in the healthcare industry. What do we mean by information blocking?

In the healthcare industry, information blocking is described as the result of “an unreasonable constraint imposed on the exchange of patient data or electronic health information.” According to the U.S. Office of the National Coordinator for Health Information Technology, there are three criteria for identifying information blocking:

• There has been interference
• There has been knowledge
• There is no reason for the data to not be accessible.

It goes without saying that information blocking practices that involve unreasonable interference and awareness are a huge detriment to an efficient healthcare practice. Blocking can take place because of policies that prevent the sharing of information as well as practices that makes sharing extremely impractical.

The reason for this is pretty straightforward. Hospitals don’t want to lose out on patients and want to make it as difficult as possible for them to want to move on to another hospital.

In this digital age, this should have been a draconian practice, but various surveys and studies say otherwise.

• After surveying 60 HIE leaders, it was discovered that information blocking is extremely widespread and the various actions that have been taken to curb it are still extremely ineffective.
• 50% of respondents that have been studied by Adler-Milstein reportedly engaged with health IT companies by participating in information blocking. A quarter of these respondents also said that hospitals and health systems are guilty of this practice.

According to the researchers, information blocking can be curbed by one of the following methods:

• By increasing transparency so that each and every action that has been taken by the participants can be accounted for.
• There should be a strong financial incentive so that the participants will want to share information with each other.
• A collaborative relationship between health IT companies, hospitals, and HIEs could further curb information blocking.

Alright, so now we have acquainted ourselves with the interoperability issues that are eating up the healthcare industry from the inside. Now let’s see how the blockchain is going to help solve this issue.

Public and Private Blockchains

There are two specific kinds of blockchains out there:

• Public Blockchains
• Private Blockchains

Since both are blockchains, they provide a peer-to-peer network which offers a decentralized and immutable ecosystem which are synchronized via consensus protocols.

However, that’s where all the similarities end.

Public Chains

Public blockchains are the ones that we are most familiar with. Bitcoin, Ethereum etc. are all public blockchains and the reason why they are called so is pretty self-explanatory.

They are completely open ecosystems where anyone can take part in the ecosystem. The network also has an in-built incentive mechanism which rewards participants for taking part more thoroughly in the system.

So, that’s pretty awesome right, however, will the health care industry benefit from having a public blockchain? Well…not so much.

Firstly, as has been extremely well documented, the blocks in bitcoin and ethereum have a storage issue. Bitcoin has a little over 1mb of space per block which is simply not enough to run the kind of transactions and store the kind of data that healthcare institutes require.

Then we have the throughput problems which have also been pretty well-documented. Bitcoin can barely manage 7-8 transactions per second. The block confirmation time is 10 mins which just adds to the latency. Big healthcare institutes need to deal with huge blocks of transactions per day with near 0 latency. In fact, any sorts of latency can potentially be life-threatening

Public blockchains, especially the ones that follow the proof-of-work protocol like Bitcoin require an immense amount of computational power to solve hard puzzles. As such, it is really impractical for these institutes to spend so much money on consensus mechanisms.

Finally, public blockchains are open chains, which in itself is another detriment. Think about it, why should healthcare institutes try to interact with each other in a network where anyone can come in and become a part of it. Medical insitutes deal with highly-classified and sensitive data, why will they want anyone outside their circles to interact with it?

So, public chains are impractical for these purposes. However, there is one more kind of blockchain that is practical for healthcare institutes, and they are called private blockchains.

Private Chains

Private chains are..well…private.

Unlike public blockchains, these aren’t open to everyone. As a result, people who want to participate in the private chain must gain permission to be a part of this network. This is the reason why private chains are also called “permissioned blockchains.”

Because of this, there are restrictions to the kind of people who can actually take part in the consensus. Access for new participants could be given by the following:

• The existing participants who are taking part in the ecosystem.
• A regulated authority.
• A consortium.

Once an entity has joined the ecosystem, they can play a role in network maintenance. The Linux Foundation’s Hyperledger Fabric is an example of a permissioned blockchain framework implementation and one of the Hyperledger projects hosted by The Linux Foundation. It has been designed ground up to cater to these enterprise requirements.

These private chains have been specifically designed for enterprise needs and offer a lot of features like:

• Fast transactions
• Privacy
• High security

Ok, so we have one side of the equation, which is the private chain. However, there is one more piece of the puzzle that we must understand before we wrap our heads around how the medical industry will work on the blockchain.

Cryptographic Hash Functions

Hashing means taking an input string of any length and giving out an output of a fixed length. In the context of cryptocurrencies like Bitcoin, the transactions are taken as an input and run through a hashing algorithm (Bitcoin uses SHA-256) which gives an output of a fixed length.

Let’s see how the hashing process works. We are going put in certain inputs. For this exercise, we are going to use the SHA-256 (Secure Hashing Algorithm 256).

There are quite a lot of properties that makes hash functions pretty darn useful. We have covered these earlier, however, let’s focus on a few of them for now.

Property 1: Deterministic

This means that no matter how many times you parse through a particular input through a hash function you will always get the same result. This is critical because if you get different hashes every single time it will be impossible to keep track of the input.

Property 2: Pre-Image Resistance

What pre-image resistance states is that given H(A) it is infeasible to determine A, where A is the input and H(A) is the output hash. Let’s take an example.

Here is a hash:

559AEAD08264D5795D3909718CDD05ABD49572E84FE55590EEF31A88A08FDFFD

Can you determine what was the input that generated this exact hash? You will have a hard time determining it. It won’t be impossible, it will just be extremely irritating and time-consuming.

Property 3: Snowball Effect

This property states that even if you make a small change in your input, the changes that will be reflected in the hash will be huge. Let’s test it out using SHA-256:

You see that? Even though you just changed the case of the first alphabet of the input, look at how much that has affected the output hash.

Now let’s bring it all together and see how a permissioned blockchain can help end the interoperability problem in the healthcare industry.

Permissioned Healthcare Blockchain

Imagine a network on healthcare institutes where they don’t own a patient’s personal data. The data all belong in the blockchain. The patients are identified via their hash ID which will be their unique identifier. The hashing allows the ID to be unique and secures the privacy of the user (see Property #2 above).

The blockchain can also aid in the creation of a patient information sharing marketplace. This way, it will be possible to actually incentivize information sharing between the different institutes to prevent any kind of info blocking.

However, what if we still have some malicious actors who attempt to do information blocking or tampering?

In that case two of the blockchain’s most significant features will step up and handle this situation:

Firstly, the blockchain is a transparent medium. Anyone, who is part of the network, can look into the blockchain and look at how each transaction takes place and whether all the relevant information is getting passed through or not.

Secondly, we have anti-tampering.

If anyone tries to block the data then via the snowball effect, it will change the hash drastically. Now, remember, that the blocks in the blockchain are linked to one another via a hash pointer. Each block in the blockchain stores the hash of the data that is stored in the previous block. If the data inside any one of the blocks change, it sets up a chain reaction which could freeze up the whole blockchain. Since this is a theoretical impossibility, it is impossible to tamper with any data that is inside the blockchain.

Other Advantages of the Medical Healthcare Blockchain

So, now that we know how interoperability can be solved, what other amazing advantages can the blockchain bring to the medical healthcare institute?

• Since the blockchain is Immutable and traceable, patients can easily send records to anyone without the fear of data corruption or tampering.
• Similarly, a medical record that has been generated and added to the blockchain will be completely secure.
• The patient can have some control over how their medical data gets used and shared by the institutes. Any party which is looking to get the medical data about a patient could check with the blockchain to get the necessary permission.
• The patient can also be incentivized to for good behavior via a reward mechanism. Eg. they can get tokens for following a care plan or for staying healthy. Also, they can be rewarded by tokens for giving their data for clinical trials and research
• Pharma companies need to have an extremely secure supply chain because of the kind of product they carry. Pharma drugs are consistently stolen from the supply chain to be sold illegally to various consumers.  Also, counterfeit drugs alone cost these companies, nearly $200 billion annually. A transparent blockchain will help these companies to enable close tracking of drugs to their point of origin and thus help eliminate falsified medication.

Image Credit: PwC 

• Various medical institutes around the world conduct their own research and clinical trials on various new drugs and medications. A blockchain will help create a single global database to collect all this data and put them in one place.
• Insurance fraud is a major problem that is affecting the healthcare industry. This happens when dishonest providers and patients submit false claims/information to receive payable benefits. To get an understanding of how serious this problem is, try to wrap your head around this: According to Boyd Insurance, Medicare fraud in the U.S. alone costs about $68 billion a year.

In fact, according to the charts, the top two kinds of healthcare frauds are healthcare related.

Jack Liu, CEO of ALLIVE, an intelligent healthcare ecosystem based on blockchain technology, believes that the blockchain is going to help solve this problem. According to him,

“A blockchain environment can eliminate a large portion of this fraud when providers and patients must enter their information and data to be verified, recorded and stored and health insurance companies must have access to that data.”

Since all the data will not be stored in a centralized infrastructure, it will be impossible to hack the system and get their hands on all of the data. This keeps the system leakage-free and it also helps secure the privacy of the patients.

The Detractors

Obviously, not everyone is on-board with the idea of basing the healthcare industry on the and around the blockchain technology. One of those detractors happens to be John Halamka, the Chief Information Officer of Beth Israel Deaconess Medical Center in Boston, a Harvard University teaching hospital. He has already worked on several production blockchain applications, so he is intimately familiar with how it works and its potential use-cases.

According to him,

“Blockchain is not meant for storage of large data sets. Blockchain is not an analytics platform. Blockchain has very slow transactional performance. However, as a tamperproof public ledger, blockchain is ideal for proof of work. Blockchain is highly resilient”.

Blockchain in HealthcareConclusion

So, there you have it. We have listed down the various advantages that the blockchain can potentially impart to the healthcare industry. Obviously, until we see a proper implementation of this partnership, this is all hearsay. What we can state for a fact, is that various other institutes and spaces have already started experimenting and working with the blockchain technology.

This space has no lack of money. In fact, consider the following statistics:

• The funding of digital health startups reached an all-time high in the first quarter of 2018
• Global annual health spending surpassed $7 trillion dollars in 2015
• By 2020, the global annual health spending is expected to have ballooned to over $8.734 trillion.

As such, they should be under no financial constraints to research new and exciting technologies. All signs are pointing towards a decentralized medical future. Let’s see why.

According to a report by BIS research, by 2025, the healthcare industry can save upto $100 billion per year by 2025 in data breach-related costs, IT costs, operations costs, support function and personnel costs, counterfeit-related frauds and insurance frauds if they incorporate the blockchain technology.

The report also states that the use of

“a global blockchain in the healthcare market is expected grow at a CAGR of 63.85% from 2018 to 2025, to reach a value of $5.61 billion by 2025. The use of blockchain for healthcare data exchange will contribute the largest market share throughout the forecast period, reaching a value of $1.89 billion by 2025, owing to the use of blockchain to solve the most widespread problem in healthcare information systems related to interoperability and non-standardization that has created data silos in the industry.”

According to the report and the way the blockchain is being adopted by various sectors, it definitely looks like the future of the healthcare industry is indeed decentralized. Let’s hope that the blockchain technology provides the horizontal innovation boost to this industry that it desperately needs.

Major portion of this article taken from 

https://blockgeeks.com/guides/blockchain-in-healthcare/

Emerging Healthcare Trends in 2018

Digital transformation is set to overhaul the global healthcare industry. As we move into 2018, here are some emerging healthcare trends that will talk about how personalized medicine and value based care will be adopted in the healthcare ecosystem.

Precision Medicine
In cancer, there are misspellings or mutations in important genes that drive the cell to grow out of control and eventually move around the body. Different patients have different misspellings and hence do not benefit from same treatment. Because of the differences across patients the conventional one-size-fits-all treatment paradigms has low response rate. Further, precious time is lost while physicians progress through successive standard therapies with no guidance on which will prove efficacious. This is where Precision medicine will offer the promise of averting unnecessary treatment, minimizing drug adverse events, and maximizing overall safety to ultimately maximize the efficacy and efficiency of the healthcare system. The rapid identification of the most beneficial personalized therapy would transform the patient experience.

Real Time Monitoring
Non-invasive monitoring approaches will enable in collecting patient data longitudinally across multiple time points. This is enabled by various sensors to track patient vital signs 24x7 through wearable devices, complemented by blood and saliva monitoring techniques. This data availability opens up opportunities to improving healthcare - predict onset, identify right treatments and track treatment impact.

Real Time Personalization
A Cancer characteristic in a patient is not static. It changes with time due to treatment pressures and other reasons. Hence the treatment strategy for a patient will need to evolve with time. With the ability to monitor impact of treatment on a disease -analogous to software world this will create the opportunity to debug why a treatment is not working and to learn and course-correct. This real time personalization will create an updated paradigm based on real time personalization. 

Use of Big Data
With the rise of the Internet of (Medical) Things (IoMT), mobile and wearable devices being increasingly connected, working together to create a cohesive medical report accessible anywhere by your health care provider will surface. This data can be used to identify the risk factors and provide preventative treatment to the patients. It can be pooled and studied collectively to predict health care trends for entire cultures and countries. Together, volume, variety, validity, velocity, volatility, and variability of data will produce the ultimate challenges of Big Data to apply in practices such as precision medicine, among others. However, the visualization of clear and concise clinical action that provides value to the patient, physician, and healthcare system will emerge as an effective solution.
 
Artificial Intelligence
Big data aggregated provides opportunity to learn from past and predict the future. Some clinical questions are better suited to use of artificial intelligence techniques because of available datasets. Early disease diagnosis and automated interpretation of images and other reports are few applications where AI will add value. Further, AI will help healthcare practitioners in mining of the data to identify risk factors for providing efficacious clinical treatment.

Mobility and cloud
Mobility and cloud access is and will help patients and doctors interact better and real-time. Globally, majority of doctors already use smartphones and medical app and access drug info on smart phones on a regular basis. Hospitals, insurance companies, and doctor's offices are now storing patient medical records in the cloud, with patients able to access test results online 24/7.Now, mobile devices perform ECGs, DIY blood tests, or serve as a thermometer, for 'anytime, anywhere' users. Going forward, with increasing automation, patients can enter their health results/ check-up into mobile patient portals as well as provide[the said] information to doctors - right and fast.

Overall, with rise of digital technology adoption by the healthcare ecosystem, the overall clinical care delivery for patient empowerment will be more streamlined and thereby improve the way healthcare facilities function as well.