Health data governance

Introduction

Health data governance refers to the legal, institutional, technical, and ethical framework governing the collection, storage, processing, sharing, use, disclosure, retention, and deletion of health-related information. Health data may include medical records, diagnostic reports, prescriptions, laboratory results, genetic information, biometric information, mental-health records, insurance information, digital health records, and data generated through health applications and wearable devices.

Because health information can reveal intimate details about a person's physical and psychological condition, its governance is closely connected with privacy, dignity, autonomy, confidentiality, cybersecurity, non-discrimination, and the right to health.

In India, health-data governance is based on constitutional jurisprudence, data-protection legislation, healthcare regulation, professional confidentiality, and sector-specific rules.

Constitutional right to health privacy

The most important constitutional authority is Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1. The Supreme Court recognised privacy as a fundamental right under Article 21 and explained that privacy includes bodily integrity, decisional autonomy, and informational privacy.

Health information falls within the core of informational privacy because disclosure of medical information can affect dignity, employment, insurance, family relationships, and social status.

Government collection of health information must therefore satisfy constitutional requirements of legality, legitimate purpose, necessity, and proportionality.

Medical confidentiality

Medical confidentiality is a fundamental component of health-data governance. Doctors and healthcare institutions routinely receive information that patients reasonably expect to remain confidential.

In Mr. X v. Hospital Z, (1998) 8 SCC 296, the Supreme Court examined medical confidentiality and held that although confidentiality is an important principle, it is not absolute. Disclosure may be justified in appropriate circumstances where a legitimate competing public interest exists.

This creates an important governance principle: disclosure of medical information should be based upon a legally recognised justification rather than convenience.

Digital Personal Data Protection Act, 2023

The Digital Personal Data Protection Act, 2023 (DPDP Act) provides India's general framework for digital personal-data processing.

Health-data controllers and processors must consider requirements concerning:

• lawful processing;
• notice and consent where applicable;
• reasonable security safeguards;
• data processing obligations;
• responsibilities of data fiduciaries;
• breach response;
• rights available under the Act; and
• obligations concerning children's data where applicable.

Health information may also be subject to additional sector-specific requirements. Therefore, compliance cannot be reduced to the DPDP Act alone.

Consent and patient autonomy

Consent is central to healthcare data governance. Patients should ordinarily know how their information will be used, particularly where data is collected for purposes beyond direct treatment.

In Samira Kohli v. Dr. Prabha Manchanda, (2008) 2 SCC 1, the Supreme Court emphasised informed consent in medical treatment. While the case concerned treatment rather than digital data, its underlying principle of patient autonomy is relevant to the governance of health information.

Consent mechanisms should therefore be understandable and specific enough to communicate important uses of health data.

Secondary use of health data

One of the major governance challenges is secondary use. Information initially collected for treatment may later be used for:

• medical research;
• public-health surveillance;
• artificial-intelligence training;
• pharmaceutical research;
• insurance analytics;
• government planning; or
• commercial purposes.

Secondary use should have an appropriate legal basis and should respect applicable consent, confidentiality, security, and ethical requirements.

A hospital should not assume that because a patient provided information for treatment, the institution has unrestricted authority to use that information for every future purpose.

Government health databases

Governments increasingly operate large databases containing health information. Such databases can improve public-health planning and disease surveillance but also create substantial privacy risks.

Under Puttaswamy, government health-data programmes should satisfy proportionality requirements. Authorities should determine:

1. Why the information is necessary.
2. What information is genuinely required.
3. Who can access it.
4. How long it will be retained.
5. Whether information can be anonymised or pseudonymised.
6. Whether it can be shared with other departments.
7. What remedies exist if information is misused.

The existence of a legitimate public-health objective does not automatically justify unlimited data collection.

Public-health emergencies

Health-data governance becomes especially difficult during epidemics and other emergencies. Governments may need rapid access to health information for disease surveillance, contact tracing, vaccination management, or resource allocation.

However, emergency processing should remain connected to the specific public-health purpose. Data collected during an emergency should not automatically become a permanent surveillance database.

The proportionality principle therefore requires consideration of whether the emergency measure is necessary and whether less intrusive alternatives exist.

Genetic and biometric health information

Genetic and biometric information creates additional governance concerns. A genome can reveal information about disease susceptibility and biological relatives, while biometric data can provide persistent identifiers.

The Supreme Court's reasoning in K.S. Puttaswamy (Aadhaar) v. Union of India, (2019) 1 SCC 1 is relevant to large-scale collection and use of biometric information. The Court examined issues concerning proportionality, informational privacy, and the purposes for which biometric information may be used.

The case illustrates the importance of restricting data use to legitimate purposes and preventing unnecessary expansion of government databases.

Data security and cybersecurity

Health-data governance requires strong security because a breach may expose highly sensitive information.

Healthcare institutions should implement measures such as:

• encryption;
• access controls;
• authentication;
• audit trails;
• secure backups;
• employee training;
• incident-response plans;
• vendor security assessments; and
• appropriate data segregation.

Security is not merely a technical matter. It forms part of the legal responsibility of organisations entrusted with sensitive health information.

Discrimination and health data

Health information can create discrimination risks. If employers, insurers, educational institutions, or government agencies obtain medical information, they may potentially use it to disadvantage individuals.

Article 14 of the Constitution provides protection against arbitrary state action. The constitutional principles of dignity and autonomy developed in Puttaswamy also reinforce the importance of preventing unjustified use of health information.

Government agencies should therefore avoid using health data to create arbitrary classifications or deny benefits without a legitimate legal basis.

Children and health data

Children require enhanced protection because they may lack the maturity to understand long-term consequences of data disclosure.

Health applications, schools, hospitals, and government programmes collecting children's health information should therefore apply appropriate consent and security safeguards.

The long-term nature of digital records means that information collected during childhood may remain accessible for many years. Data minimisation and appropriate retention limits are therefore particularly important.

Judicial review and accountability

Government health-data programmes remain subject to judicial review. In Maneka Gandhi v. Union of India, (1978) 1 SCC 248, the Supreme Court established that procedures affecting personal liberty must be fair, just, and reasonable.

Where health information is compulsorily collected or disclosed by government authorities, affected individuals should have access to appropriate procedural safeguards and legal remedies.

Courts can examine whether the government acted within statutory authority, whether the measure is arbitrary or disproportionate, and whether appropriate safeguards exist.

International comparative jurisprudence

The European Court of Human Rights has repeatedly treated medical and biological information as highly sensitive. In Z v. Finland, (1997) 25 EHRR 371, the Court recognised the particularly sensitive nature of medical information and held that its protection is essential to respect for private life.

Similarly, S. and Marper v. United Kingdom, (2008) 48 EHRR 50 demonstrated that biological information collected for legitimate government purposes cannot automatically be retained indefinitely without appropriate justification.

These cases support a broader principle of strict necessity and proportionality in handling sensitive health information.

Governance framework

An effective health-data governance system should establish:

• clear legal authority for collection;
• meaningful notice and consent where required;
• purpose limitation;
• data minimisation;
• strong cybersecurity;
• confidentiality obligations;
• controlled third-party access;
• retention and deletion policies;
• independent oversight;
• audit mechanisms;
• breach-response procedures; and
• effective remedies.

Healthcare organisations should also maintain clear records identifying who accessed sensitive information and why.

Conclusion

Health-data governance is fundamentally about balancing the benefits of data-driven healthcare with the individual's rights to privacy, dignity, autonomy, confidentiality, and equality.

Indian jurisprudence provides a strong foundation. Puttaswamy establishes informational privacy and proportionality; Mr. X v. Hospital Z recognises medical confidentiality; Samira Kohli reinforces patient autonomy; Puttaswamy (Aadhaar) addresses large-scale biometric-data governance; and Maneka Gandhi provides procedural fairness principles. Comparative decisions such as Z v. Finland and S. and Marper further demonstrate the special sensitivity of medical and biological information.

The central governance principle is that health data should be collected and used only for legitimate, clearly defined purposes and protected throughout its lifecycle. Effective regulation therefore requires a combination of lawful processing, informed participation, data minimisation, confidentiality, cybersecurity, limited retention, independent oversight, transparency, and proportionate government access.