Is your private health data even private anymore?

In 2017, the Union Ministry of Health and Family Welfare introduced the National Health Policy, which for the first time, envisaged the creation of a digital health ecosystem in the country. .Subsequently, with the onslaught of the COVID-19 pandemic across the country, on August 15, 2020, the Prime Minister announced the launch of the National Digital Health Mission (NDHM) to give fruition to the idea of unified digital healthcare. The NDHM aimed at developing an integrated system that would serve the needs of various stakeholders and improve efficiency in linking the healthcare sector..One of the primary goals of NDHM is the creation of a Unique Health Identifier (UHID) which would facilitate integration of health data across various applications and create a longitudinal Electronic Health Record (EHR) for citizens. Essentially, this UHID is meant to be a repository of all health-related information for each citizen of the country..From its very inception, the Unique Health Identity Scheme was promised to be a voluntary exercise whereby obtaining the consent of a citizen was mandatory before generating a Health ID for them. Moreover, time and again, the government reiterated that sharing Aadhaar details would not be mandatory and that the Health ID could be created on the basis of one’s mobile number and other demographic details as well. Usage of Aadhaar details or linking the Health ID to one’s Aadhaar card was evangelized as a purely voluntary and consent-based process..Curiously, what has taken effect in practice is that from around April-May 2021, the National Health Authority (NHA), which is the organization responsible for implementation of the NDHM, has been surreptitiously issuing Health IDs to citizens, under the garb of procuring personal information including Aadhaar details for the vaccination drive against COVID-19. Neither prior consent nor intimation that their Aadhaar details will ultimately be used to create a Unique Health ID have been given to the citizens. It is absolutely shocking to see that till date, the average Indian citizen is not even aware that they now possess a 14-digit Health ID, which has been dubiously incorporated in the electronically generated vaccination certificate. .This exercise has also not been uniform for all citizens. Despite the usage of Aadhaar not being mandatory, it appears that Health IDs have only been created for citizens who provided their Aadhaar Card for verification. Others, who furnished their PAN Card or other identity cards have not yet been allotted the UHID. While it may be argued that citizens wilfully shared their Aadhaar details, it has to be borne in mind that this consent was for the sole and standalone purpose of verifying their identity at the time of vaccination and not for the creation of a Health ID..Therefore, in the absence of the necessary knowledge of the purpose for which data is being collected, valid consent could not have been given. Such actions are in direct violation of Section 6(3) of the Aadhaar and other Laws Amendment Act, 2019 which provides that voluntary use of the Aadhaar number by way of authentication means the use of such Aadhaar number only with the informed consent of the Aadhaar number holder..What’s even more baffling is that the NDHM has been implemented in the absence of any legislation that gives legal backing to it or even envisages its implementation. It is a settled position in law that government policies or guidelines which have not been framed under any statute or provision of the Constitution of India, are not considered as statutory in nature, and are instead merely executive instructions/administrative guidelines, compliance whereof cannot be enforced through courts. Thus, non-adherence to such policies is implicitly permissible, which leaves the citizens remediless in case of deviations by the government..Puttaswamy: Right to Privacy is a Fundamental Right under Article 21, Supreme Court.Furthermore, there is a massive information void with regard to the purposes for which the Health ID shall be used, the various organizations/stakeholders who would be allowed to access sensitive personal data, and the security measures installed to protect such data. The clandestine manner in which such Health IDs are being generated is a violation of the citizens’ right to privacy, which has now been recognized by the apex court as a fundamental right enshrined under Part III of the Constitution of India in KS Puttaswamy (Retd.) & Anr v. Union of India. Also, due to the near impossibility of any kind of complete retraction of information from digital portals, it is also not clear as to whether citizens will be able to effectively get their Health IDs revoked in case they wish to at a later stage..Interestingly, such brazen and outrageous violations of people’s right to privacy also pose a new threat for private entities/hospitals. Recently, as the government permitted vaccination sessions to be organized at workplaces, several private companies/organizations took responsibility to get their employees vaccinated. In these instances, such companies have unknowingly become intermediaries that collected and collated personal information of their employees for the vaccination drive and passed it on to the private hospital conducting the drive, which ultimately furnished the complete record to the NHA. .The NHA, however, misused the data collected to generate UHIDs for the citizens without keeping these private entities in the loop. This could have legal implications for such private entities/hospitals as the Supreme Court in KS Puttaswamy struck down Section 57 of the Aadhaar Act, which allowed private entities to seek Aadhaar details from their customers for providing services..What is also pertinent to note is that the Protection of Data Bill, 2019, which is still pending before Parliament, categorizes health data as sensitive information and clearly states that such personal data shall only be collected by data fiduciaries to the extent that is necessary for the purpose of processing such personal data. This Bill places the burden of proving that the data was collected with consent of the data principal. Currently, the Bill is silent on its retrospective applicability. However, in case, it is made retrospectively applicable, it will have widespread ramifications on private companies/hospitals as they could be brought under the ambit of a data fiduciary..To make the Right to Privacy meaningful for its citizens, it is the duty of the State to act in a transparent manner to effectively put in place a data protection framework which, while protecting citizens from dangers to informational privacy originating from state and non-state actors, serves the common good..Unfortunately, the current manner in which Health IDs are being created for citizens without furnishing basic information regarding the infrastructure that will be used in setting up this digital ecosystem, is grossly unconstitutional and it is about time that the state come clean and take accountability for its actions..The author is a litigating lawyer based in Delhi.