Barriers to the protection of patient data and the need for immediate action in light of recent data breach incidents in India

Abstract

In Oct 2024, India’s popular health insurer, Star Health Insurance, faced a massive data leak, which may have compromised the data of 31 million customers. It included names, addresses, dates of birth, health records, Aadhaar card details, and even PAN card photos. It was one of the many data breaches related to patients’ data in the recent past. The DPDP Act was passed on August 11, 2023, after five years of legislative development in light of data breaches. It still awaits the formation of the Data Protection Board of India. This Board will be an enforcement authority, ensuring compliance with the provisions of the Act. Until then, the Act remains unenforceable. DPDP adopts a holistic approach to protecting personal data. In this paper, the factors contributing to the barriers to protecting patients’ data have been explored by analysing the global regulations, laws, or provisions and mapped in the Indian context by examining the expanding digital healthcare footprint in terms of various schemes and initiatives. The paper explores the primary factors as bureaucratic challenges, highlighting that the Digital Healthcare Information Security Act (DISHA) draft was released in 2018; however, it has still not been enacted, considering precedence to DPDP. The second factor is the scoping of the DPDP itself & challenges concerning the emerging technologies that do not categorise patients’ data as “sensitive personal data, “ which has a higher threshold than regular consent, requiring a specialised focus on patients’ data. The third factor lies in the societal state, highlighted by the lack of awareness about data privacy rights. Finally, the fourth factor explores the complex regulatory ecosystem wherein no single, holistic law covers health data protection in India, especially considering emerging technologies such as AI and blockchain. The need for a harmonised and coherent approach to data privacy has been highlighted as a recommendation in the paper.