Tl;dr
On the 1st of January, 2021, the Ministry of Health and Family Welfare notified the Unique Health Identifier Rules, 2021. Given that the Prime Minister had mentioned the use of these new health IDs in the rollout of the COVID-19 vaccine, we thought we would create an explainer on the Rules. This explainer is our initial attempt at an analysis of the Health ID framework, through which we hope to contribute to an evidence and fact lead public discussion on the use of digital technology in public health.
What is the Unique Health Identifier
The Unique Health Identifier (UHID) is a unique ID that is issued by the Centre for the purpose of “identification and authentication of beneficiaries in various health IT applications”. The UHID is meant to help facilitate the “integration of health data across various applications and create longitudinal Electronic Health Records for citizens”, while also aiding the Ministry of Health with de-duplication.
The Unique Health identifier Rules, 2021 were notified on January 1st, 2021. The Rules contain 6 provisions dealing with the Health ID. Rule 2 states that voluntary Aadhaar based verification shall be used to create Unique Health identifiers. Rule 3 allows entities to provide voluntary Aadhaar based authentication for the creation of a UHID. Rule 4 designates the Ministry of Health and Family Welfare to be the Authentication User Agency/ KYC User Agency for Aadhar authentication services for Health IT applications. Lastly, Rules 5 and 6 expand on the voluntary nature of Aadhaar based verification by disallowing the denial of health services due to the non-provision of Aadhaar and allowing the Ministry of Health and family Welfare to specify alternative documents for the creation of a UHID.
Under the National Digital Health Mission (NDHM), Aadhaar based verification will be used to authenticate UHIDs on a voluntary basis. Details to be collected include:
- Health Data - Diagnostic reports, discharge summaries, clinical notes, prescriptions, immunisation records
- Personal Data - Name, age, sex, household size, Aadhaar
- Sensitive Personal Data - Financial information, Sex life, Sexual orientation, Biometric data, Genetic data, Transgender status, Intersex status, Caste or tribe, Religious or political belief or affiliation
What are its legislative and policy origins?
| Document | Recommendations/provisions |
|---|---|
| Aadhaar Act, 2016 | Subclause (ii) of clause (b) of sub-section (4) of section 4 of the Aadhaar Act, 2016 allows Aadhaar based authentication for purposes prescribed by the Central Government |
| Aadhaar Authentication for Good Governance (Social Welfare, Innovation, Knowledge) Rules, 2020 | Allows Aadhaar based verification in the interest of good governance, prevention of leakage of public funds, promoting ease of living of citizens, and enabling better access to services |
| NDHM’s Health Data Management Policy | Drafted for the protection of individuals’/data principal’s personal digital health data privacy in the rollout of the UHID, and sets guidelines and standards for dealing collected therein |
| NDHM’s Strategy Overview | Chapter 2 mentions the creation of Health IDs to standardise the identification process across healthcare providers |
| Ministry of Health and Family Welfare’s National Digital Health Blueprint | Section 2.7 delineated the proposed usage of UHIDs to authenticate persons and thread medical records across multiple service providers |
What are the proposed objectives of the UHID?
As a part of the NDHM, the UHID will help “ to liberate citizens from the challenges of finding the right doctors, seeking appointment with them, payment of consultation fee, making several rounds of hospitals for prescription sheets, among several others and will empower all Indians with the correct information and sources enabling them to take an informed decision to avail the best possible healthcare”. The authentication process will help the government correctly identify beneficiaries of public health schemes and remove duplicates from existing records.
What is public opinion on the issue?
Public health groups such as the Jan Swasthya Abhiyan have registered their criticism of the Health ID. Several issues have been highlighted, such as the carte blanche provided for any entity to collect health data, the commoditisation of sensitive data such as health data, and the foisting of yet another document upon the citizenry for accessing basic public services.
From a global regulatory perspective, an EU study has shown that health data can be secured only in the presence of a strong data protection law - something that India currently lacks. The European Patients Forum has also argued for safeguards to prevent the distribution of medical data being in a manner that promotes discrimination or stigam by employers and/or insurers. Finally, an international study that compared health identifier frameworks across several OECD frameworks found that, “strong governance controls must be in place with clear lines of accountability prior to any implementation of a UHI”, and that, “broad ranging stakeholder engagement is required early on in the project to ensure representation from all parties involved”.
Sensitive Personal Health Data put to risk
The fundamental concern is that of the need to protect user privacy. While the usage of Aadhar has prima facie been made voluntary, the framing of the rules, especially when read along with the National Digital Health Mission Policy, do seem to make Aadhaar the cornerstone of the Health IDs. Many questions with respect to digital security and privacy have already been raised with respect to Aadhaar. These issues are only exacerbated by the lack of a data protection legislation.
Without a data protection legislation, any guidelines for the processing of data and any safeguards for the protection of privacy may not be adequately enforceable, further increasing the risk of data abuse. The categories of data that may be collected are also a cause for consternation. Given that the Rules enable the collection of information about sexual orientation, religious beliefs, and political beliefs, it has been argued that such data may be used for profiling and surveillance of citizens.
Secondly, given the sensitive nature of health data, the involvement of the private sector must be examined. Financial incentives may override the need for a just and open consent-sharing mechanism, while the sensitive data may be used in an exploitative manner by private entities for commercial purposes to, say, increase insurance premiums. Once again, the lack of a data protection legislation is key, as adequate safeguards for protecting against function creep and surveillance do not currently exist. Given the wide definition of data fiduciaries mentioned in the Health Data Management Policy, a wide variety of private entities, such as colony wellness centres, would be able to collect Health data through the Health ID which would only increase the potential scope of citizen profiling.
Furthermore, the usage of Aadhaar authentication by private entities during the processing of health ID may contravene the Supreme Court’s judgement in Justice K.S.Puttaswamy(Retd) vs Union Of India, 2018, which held the authentication of Aadhaar by private entities to be unconstitutional. The judges denied the use of Aadhaar authentication pursuant to a contract, which has been argued to mean that any instance of Aadhaar authentication by private entities is not permissible.
Beyond Privacy: practical, on-ground implementation harms
- Voluntary is now mandatory: Even though the use of Aadhaar has been made voluntary and the denial of health services has been denied, the potential for both exclusion and coercion still exists. This stems from two causes: firstly, the nature of aadhaar based verification, and secondly, the ambiguous nature of the Health ID and whether it is mandatory or not, especially since media reports have indicated that it might be the former.
- Perverse incentives and exclusionary systems: Citizens, especially those belonging to the working class or marginalised groups, may thus fail to receive benefits due to the well documented failures of Aadhaar based verification in other contexts. In the context of healthcare, the impact of Aadhaar can be seen in the All India Institute of Medical Sciences (AIIMS). At AIIMS, if a patient provides their Aadhaar ID they can get the registration charges of Rs. 100 waved off. Such patients are then subsequently issued a Health ID. Such a policy not only significantly privileges the usage of AADHAAR (and thus effectively amounts to financial coercion towards the adoption of the Health ID), it also may exacerbate Aadhaar authentication issues.
- Operational confusion and denial of health services: Additionally, in September there were reports that all staffers in a government hospital in Chandigarh were mandated to create Health IDs under the NDHM. While the CEO of the National Health Authority later clarified that the order was a “wrong circular”, such events have contributed to fears that the health ID may be made permanent and thus force patients to provide their consent for sharing their data to receive the healthcare services.
Recommendations
In light of the above, here are a few suggestions to address these issues:
- Clearly identifying the need, purpose and safeguards for electronic medical records: It has been argued that since the medical community is still divided over the impact of digital health records on clinical outcomes, there is a need to comprehensively study the same in the context of efficacy and privacy concerns. Lessons from studies from other countries may also be beneficial. For example, a survey of general physicians in Australia found that they accessed only a tiny fraction of all the reports uploaded onto the database. To this extent, the government must also hold consultations with diverse stakeholders to calibrate this framework towards a focus on improving medical outcomes (rather than on data collection). Hence, a transparent, consultative approach with public health groups, independent academics and experts, digital rights organisations needs to be conducted on priority.
- Withdrawal of Aadhaar based authentication: Aadhaar is a system that will lead to greater data collection and purposeless surveillance, exclusions and even potential frauds. Given the multifarious issues detailed above, the usage of Aadhaar for the purpose of authentication must be withdrawn. Public health groups have already been vocal about the imposition of yet another ID (that would effectively become compulsory for those who rely on publicly financed healthcare services). Thus, even if the health ID framework is to be retained, the removal of aadhaar-based verification would ensure that issues related to privacy are at the very least partially addressed. Hence, the Unique Health Identifier Rules, 2021 should be recalled or at the very least kept in abeyance till public processes for consultation, feedback and feasibility assessments and a legal scrutiny can be put towards them.
As mentioned earlier, this blog and the explainer mark our initial attempt to understand the issues surrounding the Unique Health Identifier Rules and start a conversation on the same. If you have any comments on the Rules or on our work on the issue, please do let us know here.