Those trying to fraudulently obtain the digital health info of another person for commercial gains or failing to furnish health details, will face punitive action—jail term/r fine or both—as per the draft legislation Digital Information Security in Healthcare Act (DISHA) which has been prepared by the Union Health Ministry.
Under the Act, which is the part of the Government’s eHealth strategy with an aim to ensure privacy and confidentiality of the patient health records, the Ministry has proposed to constitute a national electronic health authority (NeHA) which would function as an independent regulator. It would formulate rules, standards and processes for developing and managing electric health records (EHR).
EHR is the digital copy of a patient’s health records - clinical history, doctor’s prescriptions, test reports, radiology films, etc. “With the use of advanced software and applications, several tertiary care hospitals now seed all the health records of a patient with a unique patient ID number. A uniform EHR, a key objective of the proposed regulation, will provide a clear view to the government about the country’s health profile in real time,” said a senior Health Ministry official, explaining the need for the DISHA Act.
He said that the proposed NeHA, which will cover clinical establishments, health information exchanges, entities having custody of digital data and central and state e-health authorities will allow the electronic flow of health records between hospitals besides safeguarding of data security and privacy, simultaneously in the country.
National and state e-health authorities have been proposed to be set up once the Bill is notified.
The draft bill also have provision of penalty for non-compliance of the orders of the national and state e-health authorities. In case of non-compliance , or non-compliance with the order of the national and state e-health authorities in case of redressing grievances of the owner of digital health data, a person would be penalised Rs 1 lakh and then Rs 10,000 each day subject to a maximum of Rs 1 crore.
Similarly, those persons who compromise data intentionally, dishonestly, fraudulently or negligently for commercial purposes or commercial gain will attract imprisonment from three to five years or fines not less than Rs 5 lakh. The amount will be provided to the owner of the data.
The draft Bill also empowers an individual to refuse consent for the “generation and collection of digital health data” by the hospitals and other entities.