Health Data Retention Policy: NHA invites suggestions on consultation paper 

National Health Authority (NHA) has invited suggestions and comments on the consultation paper on its recently released health data retention policy.

The consultation paper provides a detailed discussion on the policy's need, scope, key elements, and proposed approach for its governance structure under the ambit of Ayushman Bharat Digital Mission. 

The consultation paper says that the need for guidelines on data retention for personal health information (PHI) stems from the emerging landscape to protect sensitive data and ensure effective usage of such information in clinical decision-making by healthcare professionals. 

Data retention is the practice of storing and managing personal health data for a designated period and the policies pertaining to data type, format, duration, deletion mechanism, ownership, and procedure for violation or breach of the policy.

The consultation paper noted that patient health information is defined as sensitive data under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2018, but no guideline on retention schedule exists. Many healthcare providers currently comply with self-prescribed standards in the absence of any rules on health data retention in the country.

The Health Data Management Policy released on December 14, 2020, by NHA provided a health data retention policy to be notified for data fiduciaries to comply with the collection, use and storage of personal data.

"We are developing the National Digital Health Ecosystem in a consultative manner. Since the premise of ABDM is based on federated architecture, it becomes paramount that there are specific guidelines on data retention so that health data can be stored and shared securely among different ecosystem partners, post consent of the patient," said R S Sharma, CEO, National Health Authority.

According to the Health Data Management Policy, NHA is required to formulate a policy on health data retention to be adopted by the healthcare ecosystem in India and associated entities in the National Digital Health Ecosystem (NDHE).