Needs Assessment Survey

Important issues

Techno-solutionism / Tech-exceptionalism

Techno-solutionism vs. public health realities including digital divide: The DPI narrative prioritises technological fixes over structural determinants of health, potentially diverting attention and funds away from strengthening physical infrastructure, human resources, and public health systems.

Increasing adoption of digital tools and AI assisted tools in public health systems without any regulation, evaluation, assessment

Disempowerment / Exclusion

How do we ensure that people benefit from their health data? benefit sharing?

Lack of public participation and consultation

Growing linkage of AADHAAR and ABHA with health schemes and health programmes generally – issues of shifting of burden on right-holders, exclusion, surveillance

Implications on frontline health workers

Bias, Exclusion, and Inequities- Marginalised communities excluded due to poor digital access

Denial of services for lack of compliance with the digitization.

Right to health and access to medicines

Right to Privacy

Is the DPDPA 2023 adequate for privacy and data protection issues with respect to health data? what amendments are necessary? Do we need a health sector specific data protection law? What do we do about the impact of DPDPA amendment to RTI Act?

Data monetisation – lack of transparency and clarity around commercialisation of health data

issues of privacy and security

A market-first approach to digitalization has been accompanied by a fairly light-touch form of market governance and data regulation. To begin with, the Digital Personal Data Protection Act (DPDPA 2023) — which is the foremost legislation on our fundamental right to privacy —- fails to recognize health data as a sensitive resource. While the government is still empowered to classify certain entities as “significant data fiduciaries”, this approach fails to account for the high political and economic value (or risk) carried by health information. Similarly, the wide scope of exemptions provided by the DPDPA (2023) to the state also enables the bureaucracy/executive to use this data for vaguely defined purposes, a gap that can easily legitimize unauthorised surveillance and tracking. More importantly, there is a clear lack of a coherent procurement policy guiding the adoption of health data technologies (including safety-critical AI solutions). While government organisations are bound to some guidelines (like the General Financial Rules 2017), these do little to address the emerging vulnerabilities and challenges specific to health data processing. Additionally, private institutions, which rely on confidential contracts with technology providers, are restricted by a limited set of policies covered under conventional contract law. At the same time, policy interventions like ICMR’s AI guidelines or other multilateral frameworks remain optional and contextually-limited.

Big Tech / Privatization / Globalization / Control

Due to the market-driven nature of digitization and digitalization in India, the process of health data collection and processing has invariably interlinked state interests with private interests, best seen in the emergence of the PPP model in healthcare delivery. Consequently, the current landscape faces a variety of issues, including structural barriers, regulatory gaps, and technological limitations that inhibit data from serving crucial public health needs.

The state’s lagging investment in healthcare and the growing dominance of market forces in the industry, has meant that private actors have become a crucial part of health data ecosystems. These include Big Tech and Big Pharma entities that partner directly with large hospitals and governments, but also emerging HealthTech startups that provide solutions to both public and private institutions. This dependence on the market for health sector services and innovations not only affects knowledge available in the public domain but also ownership and control of technologies, converting health data into an individualized commodity for market exchange.

Instead of adopting encrypted and decentralized forms of data collection, storage, and communication, the current health data apparatus relies on the principle of data aggregation at point of care. For example, under the ABDM initiative, healthcare institutions and hospitals are imagined as nodal bodies for storing and managing patient data under the National Health Data Management Policy (NHDMP 2022). However, as has been noted by many commentators, NHDMP 2022 and other similar Executive-enforced instruments exist in a relative vacuum with respect to each other, as well as DPDPA 2023. This is unlike other jurisdictions (Europe, for instance), where the GDPR provides much-needed legitimacy and enforcement capacity to individual health data policies. In addition, private technology providers often deploy proprietary tools and solutions in partnership with healthcare institutions. In case of vertically integrated companies and large conglomerates, this poses a serious risk of vendor lock-in, as has been the case with Microsoft and Amazon’s cloud services. Furthermore, when the technologies in question relate to safety-critical functions like decision-making, closed-source models and algorithms act as unexplainable black-boxes. In the absence of an AI-focused regulation that ensures some form of transparency, this opacity can also hinder efforts at community auditing and investigation.

Regulation of AI? what should be the Indian approach? what is required for health sector?

challenges of big data, surveillance state, the political economy of big data

Transparency and accountability in increasing PPP in digital health sector – issues of transparency, accountability, privacy and data protection, over-reliance and dependence on Big Tech Infra – digital colonialism – impact on sovereignty, competition, innovation and consumer rights.

Identify and expose- Financialisation of health data- key drivers at national and global level

Governance, Transparency, and Accountability- Large health data ecosystems i- private tech vendors, insurance companies, and multinational platforms — often without clear oversight. How does it impact people?

Data security concerns and how the data collected might fall into private profiteering organisations.

Quality Data

The current policy approach for health data management has repeatedly prioritized quantity over quality. In the early days of digitalization, when the state’s goal was simply to incentivize private action, public health principles like informed consent and doctor/patient confidentiality were sacrificed to expand health data repositories. Worse still, since then, use cases for health data have matured extensively. Now, when the same low-quality data is being used to perform more complex activities like make decisions in clinical or insurance settings, it ends up encoding the same biases that exist in the real world.

Even if real time data is not possible, it should become available within six months. District level data on mortality and morbidities should be made available disaggregated into age groups, caste, class, religion and gender.

Activities that JSA should engage in

Awareness

roundtables discussions for our own understanding and consensus building on some aspects

We need to demystify the issues involved, organise discussions on emerging issues

Public Awareness and Capacity Building: Develop simple, multilingual explainers on health data rights, consent, and grievance mechanisms for communities, patient groups, and civil society actors.

Videos in all regional languages, virtual meetings

Scholarship

watch policy development, identify potential consequences

Track and monitor the dependence of health digitization and digitalization on private resources and market forces: Private ownership, control, and management of health data repositories and ancillary technologies pose serious challenges to, both, the goal of value socialization and key public health objectives. Third-party data sharing, for instance, risks violation of informed consent, whereas proprietary source-codes can replicate biases and amplify security vulnerabilities. As a result, tracking and analyzing – through a prism of ethics and rights – how datasets and the technologies underlying India’s health data ecosystem are owned and managed is an essential first-step.

Follow and challenge policy developments that accelerate the issues identified above: Policy interventions play an understated role in enabling and legitimizing commodification of health data. Both DPDPA 2023 and NHDMP 2022, for example, consider data to be individualized resources, whose collection, use, and processing depends on individual consent and conditions. This presumption of individuality, however, only serves the creation of a data market that further commodifies our sensitive information. Tracking and challenging interventions that establish such precedents will be important. Proposing alternative modalities of informed consent and public law avenues and structural solutions to address data harms and abuse is necessary.

Analysing and publishing data and creating data.

Bias, Exclusion, and Inequities- Marginalised communities excluded due to poor digital access- mapping grassroots evidence and consolidating existing evidence

Leadership and advocacy

identify some priority areas for action and work in collaboration on those issues, advocate more

watch policy development, identify potential consequences, issue statements

Build ecosystem consensus (and the requisite capacity) towards socialization of health data ecosystems, particularly in the context of AI solutions: There is a need to introduce, pilot, and popularize alternative forms of health data public infrastructures, commons and alternative economies built on principles of public health, welfare, and cooperation. This, however, requires action from a plethora of stakeholder groups in the sector, including doctors, developers, patients, researchers, and hospitals, among others.

Strategic Alliances: Partner with digital rights organisations (like Internet Freedom Foundation, Access Now, or IT for Change) to bring legal-technical expertise into health advocacy.

JSA must step in to see to it that digitization does not create digital divide and that people are denied the services

need to advocate for Health Technology Assessment of digital health tools on expanded parameters of effectiveness, quality, equity, ethics, privacy (in addition to cost-effectiveness and efficacy)