Health data linkage governance

Introduction

Health data linkage governance refers to the legal and institutional framework governing the process of connecting health information from different datasets so that information relating to the same individual, population, or event can be analysed together. Health data may be linked across hospitals, laboratories, pharmacies, insurance systems, public-health databases, genomic repositories, electronic health records, research databases, and government welfare systems.

Data linkage can produce substantial public benefits. It can improve disease surveillance, identify treatment outcomes, support medical research, detect public-health trends, and reduce duplication in healthcare records. However, linking datasets also increases the amount of information that can be inferred about an individual. Consequently, health data linkage creates significant concerns involving privacy, consent, cybersecurity, discrimination, purpose limitation, and unauthorised secondary use.

Legal character of linked health information

Health information is highly sensitive because it can reveal medical conditions, genetic characteristics, treatment history, reproductive information, mental-health information, and other intimate facts. When separate datasets are linked, the resulting dataset may be substantially more revealing than either dataset individually.

For example, a hospital record linked with an insurance database and genomic database could potentially reveal not only a person's diagnosis but also treatment history, financial information, and genetic risk.

The legal framework must therefore assess not only whether each individual dataset was lawfully collected but also whether linking them creates a new privacy risk requiring additional safeguards.

Constitutional privacy framework

In India, the leading constitutional authority is Justice K.S. Puttaswamy (Retd.) v. Union of India (2017). The Supreme Court recognised privacy as a fundamental right and identified informational privacy as an important component of Article 21.

The judgment is particularly relevant to health-data linkage because privacy includes an interest in controlling the collection and dissemination of personal information. A government agency cannot necessarily assume that information lawfully collected for one purpose may automatically be linked with another database for an unrelated purpose.

The principles of legality, legitimate state purpose, necessity, and proportionality are therefore relevant when government authorities establish large-scale health-data linkage systems.

Purpose limitation and secondary use

One of the central principles of health-data governance is purpose limitation. Information collected for a specific purpose should not automatically be repurposed for an entirely different objective.

For example, information collected to provide hospital treatment should not automatically become available for:

• unrelated law-enforcement investigations;
• commercial marketing;
• employment screening;
• insurance risk classification; or
• immigration decisions.

A new use may require an independent legal basis, additional safeguards, or consent depending upon the applicable framework.

The principle is consistent with the broader privacy reasoning in Puttaswamy, where informational autonomy and protection against arbitrary use of personal information were recognised as constitutional interests.

Consent and legal authority

Consent is an important mechanism for health-data linkage, particularly in research. Participants should understand what datasets will be linked, why linkage is being undertaken, who will receive the results, and how long information will be retained.

However, consent is not necessarily the only legal basis for every linkage project. Public-health authorities may sometimes possess statutory powers to link information where doing so is necessary to prevent or control serious disease.

The key issue is whether the government has adequate legal authority and whether the intrusion is proportionate to the public-health objective.

De-identification and re-identification

Health-data linkage creates particular risks because combining supposedly anonymised datasets can sometimes permit re-identification.

For example, a dataset containing age, location, occupation, treatment date, and rare disease information might identify an individual when combined with another publicly available dataset.

Consequently, governance should distinguish between:

• directly identifiable data;
• pseudonymised data;
• de-identified data; and
• genuinely anonymous information.

Pseudonymisation does not necessarily eliminate privacy concerns because information may still be capable of being linked back to an individual using additional information.

Data minimisation

Authorities should link only the information necessary for the identified purpose. Collecting entire databases simply because they are technically available creates unnecessary privacy and cybersecurity risks.

A proportionate linkage programme should determine:

1. what information is necessary;
2. which datasets must actually be connected;
3. whether identifiable information is required;
4. whether pseudonymisation is possible;
5. who needs access; and
6. how long linked information should be retained.

This approach is consistent with the proportionality principles recognised in Puttaswamy.

Government health-data linkage

Government agencies may link health information for public-health surveillance, vaccination programmes, disease registries, epidemiological research, or welfare administration.

Government linkage systems require particularly strong safeguards because the State may possess information from multiple sources and may have substantial enforcement powers.

In PUCL v. Union of India (1997), the Supreme Court considered governmental interception and emphasised procedural safeguards against intrusive surveillance. Although telephone interception differs from health-data linkage, the broader principle remains relevant: government access to sensitive personal information should not be uncontrolled or arbitrary.

Equality and discriminatory use

Linked health datasets can be used to generate predictive models. Such systems may classify individuals according to health risks, insurance eligibility, welfare eligibility, or other characteristics.

If these classifications result in arbitrary discrimination, Article 14 concerns may arise.

In E.P. Royappa v. State of Tamil Nadu (1974), the Supreme Court established the important principle that arbitrary State action is inconsistent with equality.

Health-data linkage governance should therefore include safeguards against using linked data to create unjustified classifications or deny benefits based upon unreliable predictions.

Research and ethics oversight

Health-data linkage for research should generally be subject to appropriate ethical review, especially where identifiable or sensitive information is involved.

Research governance should consider:

• scientific necessity;
• privacy risks;
• participant expectations;
• data-security arrangements;
• access controls;
• retention periods;
• publication risks;
• secondary uses; and
• procedures for responding to data breaches.

Where genetic information is included, additional safeguards may be necessary because genetic information can reveal characteristics of biological relatives as well as the individual who provided the data.

Data security

Linked health databases are attractive targets for cyberattacks because they consolidate valuable information.

A responsible governance system should use:

• encryption;
• role-based access;
• authentication controls;
• audit logs;
• data-separation mechanisms;
• secure linkage environments;
• breach-response procedures; and
• regular security assessments.

Access should be based upon a demonstrable need rather than institutional status alone.

Data fiduciary responsibility

Entities controlling linked health datasets should establish clear accountability structures. It should be possible to determine who authorised the linkage, which datasets were connected, what purpose was identified, who accessed the resulting information, and whether the information was subsequently shared.

Where third-party technology providers perform linkage functions, contracts should specify confidentiality, security, permitted uses, retention, deletion, and audit obligations.

Indian legal framework

India's privacy and data-governance environment includes constitutional privacy principles and statutory data-protection requirements. The Digital Personal Data Protection Act, 2023 provides a statutory framework governing processing of digital personal data, subject to its scope and applicable exemptions.

Health information may require particularly careful handling because of its sensitive nature and potential consequences for individuals. Organisations undertaking linkage should therefore assess their legal obligations concerning lawful processing, notice, security safeguards, data retention, and rights available under the applicable framework.

Healthcare institutions may also be subject to sector-specific professional, medical, and confidentiality obligations.

Relevant case laws

Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) — established privacy as a fundamental right and recognised informational privacy and autonomy.

K.S. Puttaswamy (Retd.) v. Union of India (2018) — considered large-scale governmental collection and processing of personal and biometric information and applied proportionality principles.

PUCL v. Union of India (1997) — established safeguards concerning intrusive governmental surveillance and provides an important analogy for government access to sensitive information.

E.P. Royappa v. State of Tamil Nadu (1974) — established the constitutional importance of protection against arbitrary State action.

Mr. X v. Hospital Z (1998) — considered confidentiality and disclosure of medical information, illustrating the tension between medical privacy and competing legal or public interests.

Conclusion

Health-data linkage governance requires a careful balance between the public value of integrated health information and the individual's right to informational privacy. Linking datasets can generate valuable insights for healthcare and research, but it can also create new information that was never directly supplied by the individual and substantially increase the consequences of a data breach.

Indian constitutional jurisprudence, particularly Puttaswamy, provides a strong foundation based on privacy, autonomy, legality, necessity, and proportionality. PUCL reinforces the importance of procedural safeguards for government access to sensitive information, while Mr. X v. Hospital Z demonstrates the importance of medical confidentiality.

An effective governance framework should therefore require clear legal authority, defined purposes, data minimisation, appropriate consent or statutory justification, privacy-preserving linkage techniques, strict access controls, independent oversight, security safeguards, and meaningful remedies.

The central principle is that lawful collection of health data does not automatically authorise unlimited linkage of that data. Each significant linkage activity should be assessed according to its purpose, necessity, proportionality, privacy impact, and potential consequences for the individuals concerned.