Health Data Protection Research Articles

Adolescent–provider relationship and perception of protection of health data: insights from the West Bank – Palestine – a qualitative study

ABSTRACT Adolescence is a crucial time for health decisions, where privacy and confidentiality, especially in Palestine, impact adolescents’ willingness to seek healthcare. This study aims to explore Palestinian adolescents’ experiences with health data protection and its impact on seeking healthcare. The findings revealed diverse perspectives on health, healthcare-seeking, and health data protection. Barriers include limited trust in healthcare providers, data security awareness, and privacy concerns, leading to hesitancy in sharing sensitive health information with healthcare providers and thus refraining from consulting them. Our study provides a sense of how Palestinian adolescents perceive privacy and confidentiality in healthcare and its impact on seeking healthcare. Adolescents in the West Bank – Palestine may face health challenges as their hesitation to seek care, driven by privacy concerns and reliance on less reliable health information, increases the risk of engaging in risky behaviours. Interventions and strategies are essential to promote better health outcomes for this population.

Deployment of in-body wearable devices in healthcare and at work: closing the EU regulatory gap

Abstract Background In-body wearable devices can protect workers’ health and safety. Moreover, they might provide data that could be capitalized on in the context of the European Health Data Space (EHDS), which aims at fostering a single market for medical devices and high-risk AI systems. Yet, neither EU legislation nor national law regulates the use of in-body wearables at the workplace and the related data protection and safety issues. This regulatory gap impacts on workers’ rights. Methods The study explores whether the EU regulatory framework used in the healthcare sector for medical devices could fit the in-body wearables’ application in employment. The legal and policy analysis takes the perspective of workers’ rights and discusses the application of a key GDPR principle: lawfulness. The research discusses the potential transformations in the EU health data protection framework that could close the regulatory gap. Results The EU regulatory framework for medical devices (focused on product safety, performance, and quality) is not equipped to address the data protection challenges linked to the use of in-body wearables for occupational health and safety purposes. The GDPR’s principle of lawfulness and the related guidance by EU and national data protection authorities lack clarity on employers’ possibilities to apply in-body wearables for occupational health purposes. Filling the regulatory gap is conducive to appropriate qualification and risk-based classification of in-body wearables, which affect pre- and post-market requirements and impact on data protection. Conclusions a. The EU legislator could use its social policy competence to regulate the use of in-body wearables to protect workers’ health while safeguarding their data. b. EU authorities should clarify whether and how the data collected by in-body wearables at the workplace could be shared and (re)used within the EHDS. c. Further input by data protection authorities is needed to close the regulatory gap. Key messages • The EU should regulate the use of in-body wearables to protect workers’ health and safety. • Health data gathered through the application of in-body wearables at the workplace may be an asset for the EHDS.

Implications of Personal Data Protection Law in Consumer Health Data Management to Improve Secure and Confidential Handling in Indonesia

The purpose of this study is to understand the impact of the implementation of the Personal Data Protection Law (PDP Law) on the management of consumer health data in Indonesia, with a focus on enhancing secure and confidential handling. In the midst of the rapidly evolving digitalisation era, the management of personal data, especially those related to health information, requires strict and effective legal regulation. This is becoming increasingly urgent given the increasing incidents of data leaks and privacy violations, one of which occurred in the leak of the Indonesian Ministry of Health's server which collected 6 million patient medical record data. The research method used is normative juridical with a conceptual approach and a statutory approach, where secondary data is broken down into three different types of legal materials, namely primary, secondary, and tertiary legal materials. The PDP Law and Consumer Protection Law are the primary legal sources, accompanied by the use of relevant literature as secondary legal sources as well as dictionaries and encyclopedias as tertiary legal materials to further explain. The novelty of this research lies in the comprehensive analysis of the existing regulations and their applicability in the health context, as well as considering the increasing public awareness of their rights to personal data. The results show that although challenges such as uneven technological infrastructure and lack of awareness among health staff still exist, the measures taken through the PDP Law have created a strong foundation for better health data protection in the future, improving security and confidentiality in health data management.

Unpacking the complexities of health record misuse: insights from Australian health services

PurposeInformation systems (IS) research in general and health IS studies, in particular, are prone to a positivity bias – largely focusing on upside gains rather than the potential misuse practices. This paper aims to explore failures in health IS use and shortcomings in data privacy and cybersecurity and to provide an explanatory model for health record misuse.Design/methodology/approachThis research is based on four data sets that we collected through a longitudinal project studying digital health (implementation, use and evaluation), interviews with experts (cybersecurity and digital health) and healthcare stakeholders (health professionals and managers). We applied qualitative analysis to explain health records misuse from a sociotechnical perspective.FindingsWe propose a contextualized model of “health records misuse” with two overarching dimensions: data misfit and improper data processing. We explain sub-categories of data misfit: availability misfit, meaning misfit and place misfit, as well as sub-categories of improper data processing: improper interaction and improper use-related actions. Our findings demonstrate how health records misuse can emerge in sociotechnical health systems and impact health service delivery and patient safety.Originality/valueThrough contextualizing system misuse in healthcare, this research advances the understanding of ineffective use and failures in health data protection practices. Our proposed theoretical model provides explanations for unique patterns of IS misuse in healthcare, where data protection failures are consequential for healthcare organizations and patient safety.

Health Data Protection and Privacy in The Internet of Things Era: The New Legal Challenges in Indonesia

Health Data Protection and Privacy in The Internet of Things Era: The New Legal Challenges in Indonesia

A National Minimum Health Log Standard; SAMILOG

Aim: Health data is considered highly sensitive, and the protection of health data is an ethical and legal responsibility. Healthcare organizations use various security measures and techniques to adopt a secure electronic health records system, including keeping log data. HIS developers kept the log records according to their needs by making the necessary coding for the "change-delete" triggers. Therefore, the need to develop a common standard for keeping diaries in health information systems was felt. This standard was considered a guide for software developers. This standard was named SAMILOG (Minimum Log Standards in Health). In this study, the development process of SAMILOG is explained. Method: Focus group meetings were held with seven developer companies. Several scenarios of unauthorized access or data breaches in a health information system were created. The participants discussed each scenario and evaluated the best methods for keeping logs and which data should kept log in each case. Previously, a standard called VEM was developed to assist data migration, when HIS software of a hospital changes. The data field names of VEM standard were also used in this new standard. Results: In SAMILOG 1.0, it was defined which of the data elements in each VEM set should be logged, it required an update for SAMILOG as the VEM was updated. Conclusion: SAMILOG v1.0 was announced in 2016. In case of a security breach related to the past in the health data of public hospitals in Turkey, primarily the data logged within the scope of SAMILOG are examined.

Digital Transformation of Health: Towards the European Health Data Space

The European space for health data (EHDS) is the first European proposal for the arrangement of a specific area common to the entire EU. The main goals are enabling citizens to control and use their own health data, nationally and throughout the EU (primary use of health data), cross-border exchange of health data and building a single market for digital health services. A further goal is to create an effective legal framework for the use of health data for research and innovation purposes (secondary use of health data), as well as the establishment of electronic health records and the development of a health data management system. In the paper author presents the concept of health data privacy in digital age and analyses the current health data protection legal framework. The paper examines the provisions of the EHDS Proposal, critically analyising the proposed terms of primary and secondary use of health data, as well as it's rules on data portability and interoperability.

A comparative analysis: health data protection laws in Malaysia, Saudi Arabia and EU General Data Protection Regulation (GDPR)

Purpose General Data Protection Regulation (GDPR) of the European Union (EU) was passed to protect data privacy. Though the GDPR intended to address issues related to data privacy in the EU, it created an extra-territorial effect through Articles 3, 45 and 46. Extra-territorial effect refers to the application or the effect of local laws and regulations in another country. Lawmakers around the globe passed or intensified their efforts to pass laws to have personal data privacy covered so that they meet the adequacy requirement under Articles 45–46 of GDPR while providing comprehensive legislation locally. This study aims to analyze the Malaysian and Saudi Arabian legislation on health data privacy and their adequacy in meeting GDPR data privacy protection requirements. Design/methodology/approach The research used a systematic literature review, legal content analysis and comparative analysis to critically analyze the health data protection in Malaysia and Saudi Arabia in comparison with GDPR and to see the adequacy of health data protection that could meet the requirement of EU data transfer requirement. Findings The finding suggested that the private sector is better regulated in Malaysia than the public sector. Saudi Arabia has some general laws to cover health data privacy in both public and private sector organizations until the newly passed data protection law is implemented in 2024. The finding also suggested that the Personal Data Protection Act 2010 of Malaysia and the Personal Data Protection Law 2022 of Saudi Arabia could be considered “adequate” under GDPR. Originality/value The research would be able to identify the key principles that could identify the adequacy of the laws about health data in Malaysia and Saudi Arabia as there is a dearth of literature in this area. This will help to propose suggestions to improve the laws concerning health data protection so that various stakeholders can benefit from it.

Safeguarding Patient Privacy: Exploring Data Protection in E-Health Laws: A Cross-Country Analysis

INTRODUCTION: Health information amassed during the treatment of a medical condition is termed health data. This data encompasses information gathered about a patient and their family, forming a patient history. The internet has progressively transformed communication, commerce, and information acquisition. Among the diverse domains it has influenced, the healthcare sector stands out as one of the most intricate and unique realms of integration. Big data are the results of normal online transactions and interactions that take place online, the detectors that are implanted in devices and actual locations, as well as the generation of digital contents by individuals whenever they submit data over internet.
 OBJECTIVES: The need of protection of health data and methods of safeguarding patient privacy. The study also helps \understand and appreciate the best practices which will help India in implementing the law more effectively.
 METHODS: A doctrinal method of research was employed to analyse the laws and regulations. A comparative approach of different countries gives us the understanding of the gaps and issues. The efficacy of the laws was tested as the paper explores the laws of Canada & Indonesia regarding data protection.
 RESULTS: In this study, we understood the generation, processing, and interchange of these massive amounts of data can now be facilitated by cloud computing technology. As India, recently enacted ‘The Digital Data Protection Act 2023’ which might be a ray of hope for protection of sensitive health data of individuals from misuse.
 CONCLUSION: The journey towards optimal data protection is ongoing, requiring continuous adaptation to the dynamic nature of technology and the ever-changing healthcare environment.

Preserving Privacy and Security: A Comparative Study of Health Data Regulations - GDPR vs. HIPAA

Abstract: The digital revolution has irreversibly transformed the healthcare landscape, revolutionizing the way health data is managed and raising critical questions about its protection. The seamless integration of technology has propelled healthcare into a new era of interconnectedness and data-driven innovation, presenting both unprecedented opportunities and challenges. In this context, this paper conducts a comprehensive comparative study of two pivotal regulatory frameworks: the General Data Protection Regulation (GDPR) and the Health Insurance Portability and Accountability Act (HIPAA). These regulations, enacted on different continents, serve as cornerstones in the protection of health data and offer profound insights into the evolving landscape of data privacy and security in the digital age.The surge in digital health platforms, electronic medical records, and data-sharing networks has ushered in an era where personal health information is more vulnerable and valuable than ever before. The GDPR, a landmark legislation within the European Union, empowers individuals with control over their personal data and sets stringent standards for data protection. On the other side of the Atlantic, HIPAA plays a fundamental role in regulating health data in the United States, emphasizing the confidentiality, integrity, and availability of electronic health information.This study aims to unravel the intricate tapestry of health data protection by juxtaposing the GDPR and HIPAA. By exploring their commonalities and disparities, this analysis offers insights into the multifaceted dimensions of safeguarding health data in an interconnected world. Delving into the legal principles, individual rights, organizational responsibilities, security prerequisites, procedural intricacies, and enforcement mechanisms embedded within these frameworks, this study seeks to inform stakeholders and decision-makers about the critical nuances of health data governance.Employing a comprehensive research approach that draws from primary legal sources, scholarly interpretations, case studies, and comparative analyses, this study enriches our understanding of the intricate interplay between regulation and technology. By shedding light on the regulatory strategies of the GDPR and HIPAA, stakeholders can better navigate the intricate terrain of health data protection and contribute to the development of a privacy-respecting and technologically vibrant healthcare ecosystem.

Cybersecurity, privacy, and health data protection in the digital strategy of the European Union

Contemporary societies increasingly rely on the opportunities created by technologies that make possible the production, collection, processing, and reuse of huge datasets to obtain inferences that can be used in the most disparate fields. Among these, healthcare stands out in importance since in medical practice a considerable series of personal information is exchanged and shared. The protection needs of the individual sphere in the healthcare sector acquire a specific scope with reference to the use of information and communication technologies, which allow patients and healthcare professionals to communicate, or the latter among them, in view of the achievement of a series of goals that pertain to the diagnosis, prevention, monitoring, rehabilitation and treatment of an increasingly large number of diseases. In such a context, this works aims at proving a synthetic overview on the whole architecture adopted by the European Union in the field of cybersecurity, privacy, and health data protection, which appears fundamental for guaranteeing the fundamental rights of European citizens but also to deal with the challenges posed by the digital transition of contemporary societies.

Protection of Medical Record Data as a Form of Legal Protection of Health Data through the Personal Data Protection Act

This study aimed at analyzing government’s efforts to provide protection for medical record data of patients as a form of legal protection for patient’s medical data. In the midst of the flurry cases of personal data leakage by hackers, it has raised concerns from various parties about the possibility of medical records leaking of someone’s medical history. Medical history or medical record contains confidential information about a person’s condition related to health and the history of health care that has been carried out. It becomes particularly serious when it records certain diseases of the patient that should not be spread out to the public. In Indonesia, several regulations regarding the protection of personal data which is a person’s privacy rights have been formed. However, this is not enough to deal with the development of digital technology to provide legal certainty for the protection of personal data including medical records as one of the objectives of the law, namely to provide legal certainty and protection. Therefore, this study examines how the legal protection of medical record data based on legal protection according to positive law and the Personal Data Protection Act.

From Privacy-Enhancing to Health Data Utilisation: The Traces of Anonymisation and Pseudonymisation in EU Data Protection Law

The proliferation of digital technologies in healthcare creates two conflicting needs: protection of health data and the free flow of such data. Anonymisation and pseudonymisation hold the potential to play important roles in reconciling these two conflicting needs by enabling the processing of health data in a less privacy-intrusive manner. Taking a forward-looking perspective, this paper aims to contribute to the scholarly debate around anonymisation and pseudonymisation by extending the discussion to the contexts of forthcoming EU data laws, with a focus on the draft European Health Data Space (EHDS) Regulation. It does so by digging into the past, present and future of anonymisation and pseudonymisation in EU data laws. Starting with a positivist enquiry, the paper investigates the traces and evolution of anonymisation and pseudonymisation in EU data protection instruments from both before and after the entry into force of the General Data Protection Regulation. It then shifts focus to future EU data laws and examines the roles of anonymisation and pseudonymisation in these instruments, including the draft EHDS Regulation, the newly adopted EU Data Governance Act and the draft EU Data Act. Ultimately, the paper makes preliminary remarks and recommendations on the draft EHDS Regulation and questions to what extent its current incorporation of anonymisation and pseudonymisation can be reconciled with the health data sharing arrangements proposed in this Regulation.

An Authentication and Access Control Model for Healthcare based Cloud Services

Electronic Health Record (EHR) systems are used as an efficient and effective method of exchanging patients’ health information with doctors and other key stakeholders in the health sector to obtain improved patient treatment decisions and diagnoses. As a result, questions regarding the security of sensitive user data are highlighted. To encourage people to move their sensitive health records to cloud networks, a secure authentication and access control mechanism that protects users’ data should be established. Furthermore, authentication and access control schemes are essential in the protection of health data, as numerous responsibilities exist to ensure security and privacy in a network. So, the main goal of our suggested solution is to maintain a secure authentication and access control mechanism for health cloud data. Thus, in this work, Security Secret Key Provider (SSKP) phase is proposed for the E-healthcare-based cloud that consists of two parts. The first is an authentication scheme that is Security Secret Key (SSK) and the second is a modular access control mechanism. We explain the methodology of the proposed approach through appropriate evaluation results, which improves system security and performance by minimizing the time spent to get authentication and access the data. Simulation results indicate that our approach is significantly more effective than existing research.

A Framework for User-Focused Electronic Health Record System Leveraging Hyperledger Fabric

This research study aims to examine the possibilities of Hyperledger Fabric (HLF) in the healthcare sector. The study addresses the gap in the knowledge base through developing customization techniques to enable the simplicity and efficacy of Electronic Medical Records (EMR) adoption for healthcare industry applications. The focus of this research explores methods of using blockchain technology that prioritise users. The investigation of several concepts used in developing web applications has been determined. The study identified that an open-source project, known as Hyperledger Fabric, can be utilised to construct a novel method of storing EMRs. The framework provides a test network that can be customised to satisfy the need of several projects, including storing medical records. This research additionally outlines the difficulties encountered and problems that need to be resolved before Hyperledger Fabric can be successfully implemented in healthcare systems. Considering all types of blockchains available, the needs are met by Hyperledger Fabric, which offers a distributed and secure environment for healthcare systems. Blockchain has the potential to transform healthcare by putting the patient at the centre of the system and enhancing health data protection and interoperability. Also, by using grant and revoke access mechanisms, patients have complete control over their medical information as well as authorized doctors who are allowed to view records. This functionality is made possible by the chaincode defined in the blockchain platform. The research study has both practitioner and research implications for the development of secure blockchain-based EMRs.

Protection of Health Data in Accordance with the GDPR: Selected Issues

Patients’ rights are widely commented issue in the medical and legal press. Attempts are being made to analyse issues relating to patient consent, the right to information about the medical procedures performed and the state of health, or the authority of medical personnel to make decisions about the patient’s person and the related procedures or treatments. This results in an increase in the importance of information, which has become one of the most important values in today’s world. Access to information, especially about oneself, means a certain social and legal awareness. Restrictions on access to information deprive people of the right to selfdetermination and, at the same time, the right to satisfy one of their needs, which is particularly important in today's world. Nowadays, it is unavoidable to process the data of any person, which is essential for the proper functioning of society, but above all for the benefit of each individual. This testifies that an individual is present in social, economic or political life. For over a year now, institutions providing medical services have been obliged to implement a number of regulations contained in the Regulation of the Parliament and Council 2016/679 of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC. Personal data relating to health are defined in the preamble of the Act. This Regulation does not indicate the organisational or technical measures to be taken by the data administrator to ensure data protection. These measures should be appropriate to the scope, purpose and risks of the data being processed. Sensitive data shall fall within the category of data for which processing involves the adoption of enhanced security measures. The task of the 99 data administrator is to introduce appropriate guarantees to ensure the implementation of appropriate technical and organizational measures so that the data processing meets the requirements of the GDPR and protects the rights of data subjects. Their task is also to adapt their forms, statements, e-mails or other queries so that they are clear, understandable and readable for the average recipient. For it is the quality that is the essence of information provided in the inquiry, not its number. The EU legislator has introduced several new developments to identify patterns of conduct and interpretations that are new concerning previous regulations. With the introduction of the GDPR, new procedures have been developed in order to exercise the rights of data subjects. However, the existing acquis of literature and judicature, as well as experience in the application of provisions ensuring the full entitlement of the data subjects, is not underestimated. More and more frequent analysis of the consequences of breaching the right to the protection of medical data and of the issue of giving and withdrawing consent to the processing of data may increase the importance of this right for society and thus ensure full protection of privacy and the information autonomy of the patient.

HEALTH DATA OWNERSHIP IN MALAYSIA PUBLIC AND PRIVATE HEALTHCARE: A LEGAL ANALYSIS OF HEALTH DATA PRIVACY IN THE AGE OF BIG DATA

Health data ownership in big data is a new legal issue. The problem stands between the public and private healthcare as the main proprietor of health data. In Malaysia, health data ownership is under government hospitals and private healthcare jurisdictions. Who owns the data will be responsible for safeguarding it, including its privacy. Various technical methods are applied to protect health data, such as aggregation and anonymization. The thing is, do these technical methods are still reliable to safeguard privacy in big data? In terms of legal protection, private healthcare is governed under Personal Data Protection Act 2010, while the same Act does not bind the government. With the advancement of big data, public and private healthcare are trying to extract values from health data by processing big data and its analytical outcomes. Considering that health data is sensitive due to its nature which contains personal information of individuals or patients, had raised an issue as to whether the proprietor could provide adequate legal protection of health data. Personal Data Protection Act 2010 is still applicable in giving protection for health data for private healthcare, but what are the laws governing health data privacy in public healthcare? This article aims to answer the questions by analyzing legal sources relevant to health data privacy in big data. We propose a regulatory guideline that follows the GDPR as a legal reference model to harmonize the public and private healthcare ownership of health data better to protect the privacy of individuals in big data.

When data protection norms meet digital health technology: China's regulatory approaches to health data protection

While ageing remains a global concern, it is especially challenging for China, which has the world's largest ageing population. In response, the Chinese government has introduced digitalisation policies that clearly embrace the use of information and communication technologies in health. To enhance data protection in this tide of digital transformation, China adopted its first ever standalone data protection legislation in 2021, the Personal Information Protection Law, which is expected to have huge impacts on technology and data processing. This paper captures these significant changes related to technological advances and regulatory approaches. It aims to explore the interplay between China's new data protection legal regime and the digital health advances which were proposed to facilitate healthcare in an ageing society. To do so, the paper first reviews and categorises the use of digital tools for various health functions and argues that the use of digital health technologies creates significant data protection concerns. The paper then investigates to what extent China's data protection rules mitigate privacy risks created by digital health technologies. An evolutionary overview of China's data protection legal landscape is mapped out. On this basis, outstanding legal issues surrounding health data protection are explored, contributing to a nuanced analysis of health data processing under different scenarios including: (1) healthcare provision; (2) health research; (3) public health; (4) social care and health management in a non-medical context; and (5) real-world data for market approval. The paper shows that the Personal Information Protection Law renders China's data protection legal landscape less fragmented and offers important legal safeguards for health data. Despite legislative advances, a closer look at relevant provisions in the Personal Information Protection Law and their interplay with other regulations reveals areas where further clarification is needed, including the definition of health data, the meaning of ‘separate consent’, data minimisation requirements for health apps, and the operation of the enforcement mechanism. The paper ends with indicating potential steps forward, with a hope that the benefits of digital health can be realised in a manner that respects privacy and human dignity.

System Construction of Athlete Health Information Protection Based on Machine Learning Algorithm.

The exercise volume and exercise level can be quantitatively assessed by measuring and collecting athletes' health and exercise data. The protection of athletes' health information has lately become an important research topic due to a rise in sports activities. However, due to the nature of the data and the limits of protection models, protecting athlete health data is a complex undertaking. Machine learning and blockchain have caused worldwide technological innovation, and it is bound to bring deep modifications to the sports industry. The main purpose of blockchain is security, decentralization, traceability, and credibility of the athlete's health data protection and gathering system. To progress and increase the sports industry and methodically assess the physical fitness of sportspersons' health information, this study concentrates on the Machine Learning and Blockchain-based Athlete Health Information Protection System (MLB-AHIPS) proposed in the sports industry. The ML technique is utilized to clean and handle the information to comprehend the recognition and secure managing of the sportsperson's fitness information. The system uses attribute-based access control, which permits dynamic and fine-grained access to athlete health data, and then stores the health data in the blockchain, which can be secured and tamper-proof by expressing the respective smart contracts. The simulation outcomes illustrate that the suggested MLB-AHIPS attains a high accuracy ratio of 97.8%, security ratio of 98.3%, an efficiency ratio of 97.1%, scalability ratio of 98.9%, and data access rate of 97.2% compared to other existing approach.

Health equity and health data protection related to telemedicine amid the COVID-19 pandemic

The correlation between health equity and health data protection in the area of telemedicine has been put into relief during the COVID-19 pandemic. Indeed, the right to health data protection is not only a personal right but also a human right. Health equity cannot be maintained without an adequately functioning system of health data protection in telemedicine, yet, in many countries, health equity remains a mere dream. The United States and the European Union are the flagships of both health equity and health data protection, with HIPAA (in the US) and the GDPR (in the EU); however, some gaps do exist, as demonstrated by the practice of telemedicine during the COVID-19 pandemic. While US and EU regulations on telemedicine do provide legal certainty, fighting the COVID-19 pandemic has created a new legal climate, with new priorities superseding health data protection, which had been paramount beforehand.