Shantanu Mukherjee and Amruth Rao[1]
On 7th June 2021, Oracle announced that it had completed the acquisition of Cerner in a USD 28.3 billion, all-cash deal. Oracle, the world’s second-largest software company by revenue, is best known for its database software products and cloud services. Cerner, the second-largest healthcare IT company in the U.S. provides digital information systems and offers electronic healthcare records services to hospitals.
In a press briefing, Larry Ellison said that together, Oracle and Cerner would solve the problem of interoperability in health data by creating a unified national health records database.
Interoperability
What is the ‘interoperability problem’ that Ellison was referring to? The interoperability problem arises from the fact that healthcare data is generally stored in scattered, disparate silo-like data systems that don’t necessarily interact with one another. This creates an access problem for doctors who’re looking for a patient’s medical history. Healthcare interoperability improves the ease with which doctors provide care to their patients, and can help their patients traverse the healthcare ecosystem.
The interoperability issue has even been recognised and sought to be addressed by U.S. federal legislation. According to the 21st Century Cures Act, ‘interoperability’ is facilitated by health information technology that: (A) enables the secure exchange of electronic information from other health IT without special effort on the part of the user; (B) allows for access, exchange, and use of all electronically accessible health information for authorised use; and (C) does not lead to information blocking.
Oracle plans to solve the interoperability issue by creating a national database for healthcare records, and integrating electronic health records (EHR) data (also known as electronic medical records, or EMR) from various siloed healthcare systems. Electronic health record systems store patients’ medical history including previous progress notes, test results, medications, reports, and demographics.
According to Ellison, an interoperable EHR system or a national health records database would bring health data and EHR systems of multiple hospitals under one roof, thereby creating value for both doctors and public health officials. Easy access to a patient's medical records would allow doctors to act swiftly in cases of emergency and provide better diagnostic care and treatment. A national electronic health records system could be used by public health officials to analyse anonymised national health data which would have been very useful in the Covid-19 pandemic. Apart from these, EHRs also help in conducting scientific research.
EHR databases can even be used by third parties for financial gain. For instance, insurance companies would be able to reduce costs by avoiding repeat tests and procedures. And in extreme cases, employers who access medical records may reject candidates who may be more expensive to insure.
National Healthcare Databases
However, the experiences of multiple countries that have attempted to solve this same ‘interoperability issue’ indicate that a solution is far more elusive than Oracle’s public statements would have you believe.
In the early 2000s, the National Health Service of the U.K. launched the National Programme for IT which sought to unify the healthcare records of the entire nation. But, in 2011, the programme was shut down by the government owing to increased costs, bad project management, and the inability to adapt to the enormous scale of the undertaking.[2] One of the key factors that led to the failure of the programme was the lack of engagement with medical professionals. The inclusion of doctors in discussions would have allowed for greater participation and implementation of a system that is in the interests of the medical community and not just information technology and healthtech companies.
In the U.S, the National COVID Cohort Collaborative Data Enclave (N3C) was established by scientists and research experts to study healthcare data of patients infected with Covid-19.[3] This project collected EHR data from various hospitals and created a centralised database that could help accelerate research and identify effective treatments. Doctors then used this information to treat Covid patients. However, this initiative was fraught with many challenges. Hospitals were hesitant to take part in the project and the data that was gathered needed to be standardised as different institutions collected information in different ways. But the experts gained from the fact that N3C received a waiver from the National Institutes of Health to use a limited data set of health data for research purposes without patient consent. Additionally, the project was carried out by experts already adept in interoperability issues that other countries or organisations may lack.
Singapore is one of the few countries to have successfully implemented a national EHR system. The Ministry of Health launched the programme in 2011 in collaboration with multiple vendors including Accenture. As of June 2022, more than 1700 healthcare institutions are a part of the national EHR.[4] Both doctors and patients can access medical records through this system. However, Singapore’s success may be attributed to its small population size, fewer public health organisations, and fewer legacy EHR systems that existed at the time.
The Indian Government launched the National Digital Health Mission (NDHM) in 2020. The Mission plans to strengthen healthcare in India through the use of technology and create a digital health ecosystem. One of the components of the NDHM includes the introduction of a Unique Health Identifier that can be linked to the Electronic Health Records of the individual. However, experts have raised concerns over the implementation of the NDHM without adequate legislation on general data protection and health data privacy laws.[5] Further, they warn that the NDHM lacks a robust consent and privacy framework.
Privacy Concerns
The introduction of any national EHR system inherently brings up questions about the privacy and security of sensitive personal health information of patients. In the quest to create a national EHR database and reduce interoperability issues, privacy experts have cautioned that governments or organisations may inappropriately use patient data to forward their own financial interests, to the detriment of patients.
The National Health Authority (NHA) of India published a draft Health Data Management Policy (HDMP) in August 2020 for the NDHM (or more recently known as the Ayushman Bharat Digital Mission) as part of its public consultation process. Several problems were identified with the draft policy. The Supreme Court of India in Puttaswamy[6]held that where any policy is created that affects the right to privacy of the people, it must be a procedure established by law. The HDMP lacks any form of legislative backing, effectively making it a set of informal rules. It encourages the linkage of Aadhar with the unique health ID which raises concerns about health data being linked to other forms of data. Additionally, the policy doesn’t address the risk of re-identifying anonymised health data which is similar to the problem in the U.S.
Although the policy adopts ‘privacy by design’ as a principle, the fundamental lack of a law to support it makes it hard to enforce. Even the penalties prescribed in the policy are inadequate to act as a deterrent to the misuse of data. Despite the concerns raised by various organisations including the Internet Freedom Foundation, the new draft policy released in April 2022 fails to incorporate the suggestions put forth by public policy experts.
Apart from the HDMP, the recently published Data Protection Bill, 2021 may affect the health data privacy laws in India. However, this too has been criticised for placing economic interests at the same pedestal as privacy of data and for creating broad exceptions for processing personal data without consent. Currently, EHR data and medical records would be governed and classified as sensitive personal data or information under the IT Rules, 2011[7]. But these Rules are applicable only to body corporates and data sharing to third parties does not require additional compliances apart from the consent of the data provider.
EHR systems, particularly in the U.S. suffer from the risk of re-identification. The U.S data privacy law HIPAA allows free sharing of de-identified patient data to third parties. De-identification relates to a process in which the personal identifiers that may reveal the identity of an individual are deleted so that the privacy of the patient is maintained. However, the risk of re-identifying such data remains. In other words, de-identified data can be linked to patients.
In a study, researchers concluded that under the current HIPAA provisions, the process of de-identification is not sufficient.[8] They were able to successfully re-identify 25 percent of the dataset. The methods prescribed to de-identify data are inadequate to completely anonymise healthcare information
Re-identified data has the potential to be misused. It can be sold to third parties who can use it to create a better understanding of consumers and push targeted advertising at them. If such data is hacked, the information may be used by identity thieves to claim medical expenses, the financial data of the patient could be exposed and finally, sensitive patient information may be revealed to employers or family members.[9] In the eyes of large tech and healthcare companies, health data is seen as an asset that can be monetised. This necessitates strong data privacy laws that protect the sensitive health information of patients.
Monetization of Health Data
Interoperable EHR systems aggregate health data from different hospitals and medical institutions. Researchers, public health organizations, and pharmaceutical companies find this data attractive. De-identified health records that are sold to researchers are used to conduct large-scale studies where health data of a large population is necessary to reach a comprehensive conclusion.
In India, the draft Digital Information Security in Healthcare Act, 2018 that was placed in the public domain clearly barred the use of digital health data for commercial purposes. According to the draft Act, health data could not be sold to insurance companies, employers, and pharmaceutical companies even if they were anonymised. On the other hand, the HDMP does not have any such prohibitions. Experts speculate that healthtech companies may take advantage of this and sell data to insurance and pharmaceutical companies.
Insurance companies find health data appealing because firstly they can avoid the additional costs of repeat tests and procedures in different hospitals. Additionally, they may also use the data to target customers based on their overall health status. Insurance companies can levy high premiums or deny their services to persons with severe health issues and offer low premiums to relatively healthy policyholders.
Pharmaceutical companies may use health data to determine investments, examine how to target clinical trials, and develop marketing strategies. Additionally, they use de-identified health data for research. It has been reported that pharmaceutical giant Pfizer spends nearly 12 million dollars buying health data from various sources.
Recently, a lawsuit was filed against Meta, the parent company of Facebook, accusing it of collecting sensitive personal data from hospital websites using its Pixel tracking tool. This is an example of the value that tech companies attribute to healthcare data.
Neither is this the first example of a big tech/healthcare data scandal. As part of the controversial Project Nightingale, Ascension, a healthcare company transferred the medical records of nearly 50 million individuals to Google in return for access to Google services. Google claimed that it would use the data and artificial intelligence to suggest improvements in individual patient care with the end goal to create an omnibus search tool. But there were concerns about the company monetizing the data by using it for marketing or targeted advertising.[10]
Oracle’s acquisition of Cerner gives them access to a treasure trove of data. Whether Oracle will be duly cognizant of the privacy concerns of all its stakeholders including patients when accessing or monetising this data remains to be seen.
At any rate, Oracle’s plan to create a national EHR database is likely to be more difficult than their public statements suggest, judging by the experiences of other countries that have attempted to solve this “interoperability issue”.
[1] Amruth Rao is a 4th year student at Jindal Global Law School.
[3] https://www.theverge.com/2020/10/19/21522863/health-data-records-covid-coronavirus-model-nih-privacy-n3c
[4] https://www.moh.gov.sg/institutions-participating-in-the-national-electronic-health-records-system-(nehr)
[5] https://ea51c4f6-3257-4b64-b189-d18d2b68e428.filesusr.com/ugd/bfda9b_14f8cf90a45b48958b4209442e8db9f8.pdf
[6] (2017) 10 SCC 1.
[7] Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011.