KLRI : KOREA LEGISLATION RESEARCH INSTITUTE

I. Background and Purpose

▶ Paradigm shift in health care services due to the COVID-19 pandemic and advancements in digital technology

○ As awareness of the potential of big data and artificial intelligence technology expands globally, the importance of data science and data technology has been emphasized in policy discussions for several years, and normative approaches to data protection, collection, and use have been established. The discussion also maintains its presence in the regulatory discourse at home and abroad

 

○ One of the most active areas of normative discussion on data protection, collection and use is the field of health care data

- The paradigm is shifting from the existing disease treatment-centered and provider-centered treatment to patient prevention-centered, and with the advent of the “digital healthcare” era, ‘standard treatment’ is systematized and unified through long-term treatment experience and clinical trials. It will be possible to comprehensively analyze health and medical data such as individual genetic information, living environment, and clinical information. Expectations are growing that this will enable 'precision medicine', which provides precise disease prediction/prevention and customized drugs and treatments tailored to each individual's characteristics.

 

II. Main Content

▶ Each country’s policies and programs for sharing and utilizing health and medical data

○ Countries around the world that are paying attention to the value of sharing and utilizing health and medical data are rushing to provide institutional support, such as improving policies and laws, such as developing platforms for this purpose.

- The US Department of Veterans Affairs uses the 'Blue Button' platform to analyze big data and electronic medical records to support customized medical services through analysis of electronic medical records of veterans, providing medical services to 22 million veterans. We provide medical services.

 

○ Finland's Kanta service is a policy that is attracting attention as an institutional achievement for sharing and utilizing health and medical data. Kanta includes all citizens' medical records (including dental and ophthalmology medical records), health records, prescriptions, and welfare service data. Data in the medical and welfare sectors is stored and managed

- Data stored in Kanta can be shared between medical institutions and provided to third parties such as pharmaceutical companies for use

 

○ In September 2019, Korea also implemented several policies to promote the use of health and medical data, such as the decision to establish a national bio big data platform with 1 million people by 2029 to establish public big data that can be used for public research. is doing

- As part of the 'My Data' project aimed at safely utilizing personal information, the Ministry of Health and Welfare is operating the 'My Healthway' platform, which allows for the provision and direct use of data based on consent starting in 2021

- Despite this implementation, in Korea, personal medical information data is dispersed and a national system for utilizing genomic data has not been established. Currently, countries such as the United States and Finland are advancing the sharing and utilization of health care data. We are evaluated as being lagging behind the field

 

▶ Legislation in each country for sharing and utilizing health care data

○ The United States introduced the "Health Information Technology for Economic and Clinical Health Act" (HITECH) to promote the exchange and activation of medical information

 

○ In May 2017, Japan has a special law of the Personal Information Protection Act as an alternative to overcome legal limitations such as establishing a foundation for collecting and using medical data on a large scale and using "personal information requiring consideration." The Act on Anonymous Processing Medical Information to contribute to research and development in the field (hereinafter referred to as the 'next -generation medical base law') is enacted

- Japan sought to conduct research and development in the medical field, create new industries, and create a healthy, long-lived society by utilizing anonymously processed information stipulated in the "Next Generation Medical Infrastructure Act", while protecting personal information and ensuring the usability of data by pharmaceutical companies, research institutes, public institutions, etc. Wanting to raise it.

 

○ Finland also introduced the “Secondary Use Act,” which regulates the use of health and medical information for purposes other than those for which it was collected. This law stipulates that health and medical information be used for specific secondary purposes, such as scientific research, statistics, innovation and development, knowledge management, education, and government planning and regulatory administration. We are establishing legal conditions to access and process welfare-related personal information effectively, efficiently, and at the same time safely

 

▶ Legal issues and improvement plans related to health and medical data sharing and activation

○ Despite the special provisions for processing pseudonymized information in the revised "Personal Information Protection Act" that will come into effect in August 2020, it is still impossible to use biometric information such as voice information, genome information, and fingerprints for which pseudonym processing has been reserved without individual consent. There are limitations in providing personalized health care and medical services due to the limitations of pseudonymous information

- There are limitations in that procedures for pseudonymizing personal health information are complicated, time and cost are a burden, and it is difficult to conduct longitudinal research on the health status of small groups due to the risk of identifying individuals or individuals

- Above all, the "Bioethics Act" stipulates that 'human subject research' is extensive and that research using personally identifiable information must be reviewed by the Institutional Bioethics Committee (IRB) even if individual consent is obtained. There is concern that this may lead to excessive regulation in the management service market

- It is a well-known fact that the personal consent system in the health and medical field is more important than other fields due to the nature of personal health information classified as sensitive information, but there are limitations in providing personalized health care and medical services, limitations in pseudonymization, and private personal health management services. Considering excessive regulations in the market, etc., Korea also needs to review the introduction of systems such as comprehensive consent, opt-out system, and dynamic consent under certain conditions, as in the cases of the United States, Finland, and Japan. There is

 

○ The most controversial issue related to the right to request third party transfer of health and medical data is how far the ‘scope of transfer’ will be recognized

- Article 35 of the Amendment to the Personal Information Protection Act excludes from the scope of the right to request transmission information that is separately created by analyzing and processing personal information collected by the personal information processor. It is believed that the purpose is to protect the interests of the personal information processor by excluding it from the right to request transmission by the personal information subject and allowing the personal information processor to use it exclusively.

- In the case of GDPR, the Article 29 Working Group Guidelines also state that “the outcome of an assessment regarding the health of a user” cannot itself be regarded as information “provided” by the data subject. Doing it.

 

○ In order to introduce the right to data transmission in the health and medical field, the scope and nature of the information subject to transmission must be clarified by taking into account the characteristics of medical information - it is necessary to consider the interests of the personal information processor, not the subject of personal information

- Although medical records are written based on the patient's information, such as the patient's health status, past medical history and family history, and current symptoms, they are almost entirely written by the doctor based on his or her professional knowledge and medical judgment, and are written by the doctor's affiliated company. Given that medical institutions store medical records in the form of medical records or electronic medical records, the common view is that ownership of medical records is generally recognized as being held by medical institutions or medical service providers.

 

○ Related bills, such as the “Act on the Promotion of Digital Healthcare and Promotion of Health and Medical Data Utilization (Proposal)” currently proposed in the National Assembly, standardize medical information data that includes the judgment of medical staff (personal information processors), such as medical records, as objects of transmission. This requires review as it not only does not sufficiently consider the characteristics of medical information, but is also being criticized as having the potential to infringe upon the copyright of medical staff

 

Ⅲ. Expected effect

▶ We aim to present implications for improving domestic legislation through analysis of legislative examples from major overseas countries related to sharing and activation of health and medical data

 

▶ We aim to provide a starting point for improving the legal system by analyzing legal issues related to health and medical data sharing and activation and suggesting improvement measures