The first session was about the ‘Challenges in the implementation of DISHA’. The panelists were happy that InnovatioCuris has taken an initiative to critically discuss the challenges a hospital will face once the act becomes the law. All the panelists agreed that the act lacks various aspects. Few concerns that bother the clinicians are, that who will give the consent if the patient is unconscious.

The ambulances have the capability that it sends the health records from the ambulance to hospital before the patient reaches the hospital for doctors to study the emergency cases. In this scenario, what should be done if a patient denies the consent for sharing the data at a later stage? Should the clinical establishments discard the already shared health record or should they handover the same to the owner (in this case, patient) or what should be done. There are no set protocols defined in the act for such cases.

A question was put forward, does the patient has the authority to edit their health record, or can they view, who have seen their health record. A healthy discussion took place where we got to know that citizens of Estonia have chip cards, where one can see their health record and can also see the logs of who has accessed their health record. This made us realize, that India as a nation state can use Aadhar card as a mechanism, where we can log in into a portal and get to see health records.

The third challenge that came forward was interoperability of health records. As the record lies with the custodian, not the patient, editing and viewing of it can be done by the clinical establishments. The health record can be shared by the clinical establishments to another, but there is no standard on how to transfer it. Data integrity is a point of concern, which is not mentioned in the act.

One of the challenges that came into light was according to ‘Clinical Establishment Act Standards for Hospital[2]’ the hospital has to keep health information and statistics in respect of national programmes, notifiable diseases, and emergencies/disasters/epidemics and furnish the same to the district authorities in the prescribed formats and frequency. The question is what if the patient does not give consent. The proposed act should have a provision where the clinical establishments are liable to take the health data.

As we have unstructured healthcare facilities in India, the act should also empower the clinical establishments by various means to keep the data safe. As of now the DISHA is a proposed act, not a law and has lots of loopholes. It also lacks in many aspects discussed earlier. This is just a start and the government should take necessary steps to improve it.

The second panel discussed on ‘Opportunities for making health sector DISHA and data protection ready’. The panelist consisted of CIO of path labs, owners of healthcare IT firms, who shared relevant thoughts and comments. The panel started the discussion on why do we need the act and what are the benefits of the act. Panelist were grateful to the government to bring the act. They told that the clinical establishments will take steps to increase the safety of the health record.

The gaps in the technology for generation, storage and transmission will be lowered down. Sectors such as banking, financing and insurance have structured their data, but this lacks in healthcare. Detailed scope of security features are missing from the act, this would help the companies to design the software from the ground up by using security as an important consideration.

The imminent threat is in the software which are already in place and have not been patched or the system has not been upgraded. The good news is that many have an audit trail in built in their system, which track any CRUD(creation, read, update, delete) of the records. The discussion contributed a fruitful thought: Data at rest is not encrypted. The question that arises is what is preventing the healthcare IT companies to encrypt the data at rest.

One of the challenge in the DISHA is that, the owner of the data must be informed of any breach of the privacy or confidentiality of their digital health record within three days. But according to IBM report it takes on an average of 197 days to detect a breach[1]. How can the Healthcare IT companies safeguard the health record and let the owner know about the breach. The solution is to encrypt the tables in the database, but that might hamper the performance.

It is a huge opportunity for the stakeholder to bring standards in the act. DISHA might have only completed its first round of comments from the public and stakeholders, it can be expected that the revisions made based on the feedback will churn out a more refined version of the act. In any case, it is evident from the draft that the government has really pushed to provide additional security, privacy and confidentiality for individuals, with respect to their digital health record.

Prof. Paul Lillrank (moderator) presented his keynote by giving insights of his ideas and implementations in the organization for which he is the chairman (Aalto Health Platform). Explained how the world famous, ARAVIND EYE CARE model was chosen and implemented by his student in Finland who studied ARVIND EYE CARE in Tamil Nadu. Stressed on technology circulation instead of technology transfer, as the later is only one directional flow. He felt India is the most innovative place in the world with the land full of opportunities.

Molshree Pandey, currently working on communicable diseases and finding ways to collaborate stakeholders in a much more efficient way. Conducts and concentrate on boot camps, road shows in Denmark, presentations to many companies; connecting and opening pathway to better delivery of care in India as well as Denmark. Insisted on modification of products according to the country.

Ankit Bahl compared the way of delivering care and implementing in 2 countries Estonia of 1.2 million populations with India of 1.2 billion populations. Estonian healthcare developments:

-Have S.E.Z for Pharmaceuticals, diagnostic companies in Estonia
-Worlds first biobank which Is commercialized too!
-97% of their patient prescriptions are made online for better access for both patients as well as stakeholder handling it.

Only three things can’t be made online in Estonia 1.marriage 2. Divorce 3. Trade property. Haha!! Introduced E ambulance in Estonia! They call E-Estonia and are also working towards to achieve it!

Iris Ohrn, A kind of matchmaker and identifies companies, investors which would benefit mutually. She observed similar challenges in India as well as Sweden in terms of the cost of healthcare.

K Gopalan, Works for the betterment of healthcare ecosystem of underprivileged. India is a big corridor for the scope of solutions. The focus needs to be on Primary health care, an example is vatsalya which is trying to provide subsidized private care. Promoted SANKALP, which is a form of the network of healthcare stakeholders.

Identification of right partners and right market recognition is required. IPR (very important) during technology transfer is at-most concerned.

As GDPR in EU, likewise, we need in India too. Shared her views on DISHA Act
DISHA:
– Setting up central and state organizations
– Ensuring trust in the system
– Recognition of ‘RIGHT TO RECTIFY’ by the patients is becoming important
Differences in DISHA and GDPR should be studied,
Example: right to forget/Erase isn’t there in DISHA