By Atrey Tripathi and Astha Shivhare
This article was written before the publication of the Draft Health Data Management Policy.
Introduction
India’s recent initiative to join Global Partnership on Artificial Intelligence (GPAI) as a founding member to support a responsible and human-centric development in use of Artificial Intelligence[1] (‘AI’) has shown that Indian government truly acknowledges the potential of AI and its stake in AI revolution. In this regard, the government had also announced several initiatives in the past for the research and development of AI. While warming up the stakeholders for the future, the then Finance Minister Arun Jaitley in his speech on the 2018-19 budget, mandated the establishment of national Program on AI under the leadership of NITI Aayog.[2] In pursuance of this, in June 2018, NITI Aayog published a discussion paper on National Strategy on Artificial Intelligence, with the tagline ‘AI for All’.[3]
As described in the discussion paper, healthcare is one of the most dynamic, yet challenging, sectors in India, and is expected to grow upto USD 280 billion by 2020, at a Compound Annual Growth Rate upwards of 16%.[4] In the discussion paper, NITI Aayog highlighted various opportunities for AI in healthcare which can overcome various existing shortcomings. However, being one of the most sensitive sectors in terms of public health, if AI’s implication in healthcare is left unchecked, it can cause severe legal rights violations. In this article, we shall discuss the probable legal challenges to and raised by AI in healthcare sector.
Importance Of AI in Indian Medical Sector
AI, the simulation of human intelligence, is technology which is capable of performing cognitive tasks, like perceiving, learning, problem-solving and decision making.[5] AI has the power to completely transform the world and its potential is rightly recognised by NITI Aayog, which is planning to use AI in the healthcare sector. Currently, the major challenge of Indian medical sector is to make medical treatment accessible and affordable to all.[6] The human power crisis is also a big challenge for the Indian healthcare sector. A study conducted by Centre for Disease Dynamics, Economics & Policy (CDDEP) in the US found that India has shortage of an estimated 600,000 doctors and 2 million nurses.[7]
The problems of accessibility, affordability and quality are prominent in rural areas because of poor connectivity, limited supply of medical professionals, and some socio-economic and cultural barriers.[8] These problems can be addressed by the use of AI in diagnosis, personalised treatment, early identification and prediction of diseases. AI can be used as an alternative to telemedicine, by which the activities like diagnosis, prognosis or medication can be easily carried out through machine-learning and performance of tasks which were hitherto have been performed by conventional doctors.[9] “With the development of more and more technology and artificial intelligence, healthcare can eventually be delivered at a lower cost because when efficiency is increased, diagnostics will be more focussed,” was the observation of Dr Trehan,[10] the Chairperson and Managing Director of Medanata Heart Institute. More advancement in AI has led to several kinds of research to make it usable in the healthcare sector, and government’s motivation towards the same shows that there can be integration of AI into healthcare.[11]
Legal Challenges Related to the Use of AI in the Healthcare Sector
AI is also defined as an intelligent system that can perceive its surroundings and take actions accordingly to maximise the chances of achieving its objective.[12] In the healthcare sector, AI can take actions, such as smart decision making, operations, customer/ patient redressal etc., and for this, AI uses data from patients as well as open data which is either fed to it or has been retrieved from internet.[13] AI uses machine learning algorithms more often nowadays, which unlike other algorithms, allows AI to calibrate itself while enabling it to identify many patterns, making it too complex for humans to trace their decisions.[14]
In this regard let us consider the case of Google Photos. In 2015, Google Photos image recognition software was found to contain a terribly serious error because of which it was occasionally labelling the images of black people as gorillas. The system was too complex to be understood and hence developers could not trace the problem and ultimately had to remove all monkey related words from the list of the image tags to solve this problem.[15] This shows that if the use of AI is left unchecked, especially in the healthcare sector, it can cause severe violations of legal rights of individuals.
It is clear that the legal rights violation by AI will hamper its acceptance in healthcare. Another factor which poses legal challenges to the adoption of AI and has also been highlighted by NITI Aayog’s discussion paper, relate to the unclear privacy, security and ethical regulations in India. We examine these challenges in more detail.
Privacy of Patients in the age of AI
In the case of Justice K.S. Puttaswamy (Retd.) and Anr. v. Union of India,[16] the Apex Court declared privacy as a fundamental right enshrined under the Article 21 of the Indian constitution. As the privacy is a very important facet of one’s life, doctors are required to follow the principles established by the Indian Medical Council Act, 2020 (IMC Act). The Act says that “principles of medical ethics, including professional norms for protecting patient privacy and confidentiality as per the IMC act shall be binding and must be upheld and practised.”[17] The IMC Act also mentions the legal repercussions of breaching the privacy of patients:“Registered Medical Practitioner would be required to fully abide by the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002 and with the relevant provisions of the IT Act, Data protection and privacy laws or any applicable rules notified from time to time for protecting patient privacy and confidentiality and regarding the handling and transfer of such personal information regarding the patient. This shall be binding and must be upheld and practised.”[18]
Section 8 of the Human Immunodeficiency Virus and Acquired Immune Deficiency Syndrome (Prevention and Control) Act, 2017[19] also guarantees the privacy of patients and provides that “no person shall disclose or be compelled to disclose the HIV status or any other private information of other person imparted in confidence or in a relationship of a fiduciary nature, except with the informed consent of that other person or a representative of such another person obtained in the manner as specified in section 5”. Similarly, there are several policies[20] related to the protection of privacy of patients, which require the maintenance of confidentiality of the patients. The reason why these policies shall be ineffective in protecting the privacy of patients in the age of AI, is that these provisions just deal with disclosure of information of patients by themselves, doctors and third parties; but do not specifically deal with the problems related to storage, accessibility and breaches of the medical data. Hence, the protection of data and privacy of patients has become one of the major challenges that incorporation of AI in the medical sector poses.[21]
Further, taking note of needs of the time, India has also adopted the Electronic Health Record Policy,[22] in accordance with which a longitudinal electronic record of patient health information, generated by one or more encounters in any care delivery setting, is to be maintained and shared. This includes patient demographics, progress notes, problems, medications, vital signs, past medical history, immunisations, laboratory data and radiology reports. In fact, the rules under the Clinical Establishment Act,[23] 2010 mandate doctors to maintain the EMR (Electronic Medical Records) of medical patients.The Act also deals with the issue of data ownership, data access and confidentiality.[24] However, the Act fails to adequately protect medical data because of improper implementation, lack of awareness,[25] and certain other flaws like unclear scope of coverage, lack of clearly defined timelines for accessing patient records, the failure to include unique identification information such as URLs and IP addresses as sensitive information, and an ambiguity in defining the scope of ‘personal health information’.[26]
These are the reasons why India has reported medical data breaches even after the implementation of a preliminary medical data protection framework. In India, the adoption of a system for assigning all citizens with a unique identification number, linking it to individual health records and several health-related schemes, raises several ethical, legal and social issues, and the need for an appropriate ethical framework and data governance.[27] Several instances of the leakage of medical data has been reported in India. Recently, a women’s health app, Maya, shared health data of women with Facebook,[28] and the data of 12.5 million pregnant women was leaked in Andhra Pradesh.[29] A major data leak was reported in India when over a million medical records and 121 million medical images of Indian patients, including X-rays and scans, were leaked online to be freely accessible by anyone.[30] The problem was the failure to properly implement a sector-specific data protection framework. Other jurisdictions like US and UK have already enacted laws related to health data to protect privacy of patients. The Health Insurance Portability and Accountability Act,[31] 1996 (HIPAA) is the legislation in the US which regulates health information privacy and gives substantial control to the patients over their information. EU’s Global Data Protection Regulation, 2018 (GDPR) provides detailed provisions for the storing, processing, and sharing of the medical data.[32]
Realising the urgent need for a data protection law, policymakers came up with the Personal Data Protection Bill, 2019 (PDP Bill).[33] The Bill aims to protect the data of the Indian citizens but there are some sections in the Bill which provide easy access to the government, even for sensitive personal data of the citizens and this has been found to be controversial.[34] For example, the Bill says that “the personal data may be processed if such processing is necessary, for the performance of any function of the State authorised by law for the provision of any service or benefit to the data principal from the State.”[35] This is in contrast with the objective of the Bill, which is to protect the privacy of individuals by protecting their data from getting misused, and shall prove to be ineffective for the protection of data and privacy of Indians in the age of AI.
Though the PDP Bill, 2019 has some shortcomings that need to be resolved before it is enacted, it must be noted that the government had released the framework of Digital Information Security in Healthcare Act (DISHA)[36] in March 2018, that aims to specifically to protect the privacy of patients and their medical data. DISHA also follows the nine privacy principles,[37] namely, choice and consent, collection limitation, purpose limitation, access and correction, non-disclosure of information, security of data, openness or proportionality as to the scale, scope and sensitivity of the data collected as well as accountability.[38] We have to see how far the enactment of this legislation proves to be effective for the protection of the medical data and solves the challenge of protection of privacy of patients in the age of AI.
Right to Equality
AI can cause serious problems by incorporating bias into the system. In the medical sector, the seriousness of such biased systems is further amplified. The discussion paper of NITI Aayog indicates the government’s motivation to make the Ayushman Bharat programme the world’s largest healthcare scheme.[39] Such a large application means that a minor discrepancy caused due to AI can violate right to equality of a significantly large population.[40]
How do biases perpetuate in an AI algorithm? There are three major ways in which biases percolate into an AI system, and the first one is because of lack of representation in the data which can cause serious bias against the communities on which proper research is not done or research data is not available.[41] A 2014 study that tracked cancer mortality over 20 years in America showed that due to the lack of diverse research subjects, Black and Hispanic Americans were significantly more likely to die from cancer than white Americans.[42]
The second reason for discrimination being perpetuated through AI relate to historical biases in the data itself. For example, a systematic review of pain management studies in USA found that black patients were 40 percent less likely to receive pain medication through AI in emergency situations than white patients,[43] demonstrating that information available to AI is full of biases as it is not true that biologically black patients have high pain tolerance.
The third way is where a machine can simulate human minds in learning and analysis, i.e., through Machine Learning(‘ML’).[44] As ML has been used by AI to improve its response with the help of the information provided by users as feedback, whether the user is a doctor or patient. Now the more the user uses the system in a racist or sexist way, the greater the bias assimilated in to the system through self-learning. This can deepen discrimination in healthcare.
Ethical principles identified in existing AI guidelines include justice & fairness, transparency, trust, privacy, dignity, etc.[45] According to World Health Organisation (WHO), trust is perhaps the comprehensive theme of the contributions aimed at dealing with the issue of human-centric ethics in AI,[46] which plays a role along with empathy and compassion in the human side of care that must be preserved in exploring kind of healthcare the society ought to promote.[47] National and international legislation and guidelines govern public health surveillance and research, of which many of the norms have developed under very different historical conditions and in accordance with the technologies which are now replaced by newer ones.[48] Authorities responsible for drafting guidelines regarding AI need to develop internal mechanisms such as their own best-practice standards to comply with ethical requirements and these mechanisms should include the monitoring boards with concrete mandate to ensure risks and costs to individuals and communities should be diluted so that more benefits shall be obtained. Such boards should also be empowered to negotiate compensation schemes for the injuries that can be suffered due to AI.[49]
Discrimination in access to healthcare and provision of healthcare shall be in violation of right to equality under Article 14 and right to health under Article 21 of the Indian Constitution. The Apex Court, in the case of Paschim Banga Khet Majdoor Samity v. State of West Bengal,[50] while widening the scope of Article 21 and emphasising the government’s responsibility to provide healthcare to every person in the country, held that in a welfare state, it is the primary duty of the Government to secure welfare of the people. Article 21 imposes an obligation on the Government to safeguard Right to Life of every individual and Government hospitals are dutybound to provide medical assistance for preserving human life without any bias. Likewise, the government is obliged to check any bias in the healthcare system due to AI so that no one is deprived of his/her Right to Life and Equality.
Conclusion
There is no doubt that some of the most promising uses of AI are in the health sector. From cost effectiveness to proper accessibility of healthcare with accurate diagnosis, anything can be handled by AI and in some cases, it can even do some high-end tasks like sophisticated operations. However, even a smaller discrepancy can prove to be fatal and because of this reason, acceptability of AI in healthcare is still uncertain. As we have seen, the violation of Right to Privacy and Right to Equality by AI, which may eventually strip individuals of their Right to Health, pose significant challenges. Comprehensive laws regarding data protection and other aspects of harmful effects of AI will help to mitigate some of the challenges of using of AI. Adopting safeguards in the form of greater accountability and transparency is also necessary to ensure respect for human rights, as AI is getting more and more sophisticated.
The authors, Atrey Tripathi and Astha Shivhare, currently law strudents at the Dr. Ram Manohar Lohiya National Law University (RMLNLU), Lucknow.
[1] Shreya Nandi, India becomes founding member of Global Partnership for Artificial Intelligence, Livemint, available at https://www.livemint.com/news/india/india-becomes-founding-member-of-global-partnership-for-artificial-intelligence-11592245966465.html, last seen on 12/07/2020.
[2] Jochelle Mendonca, Budget 2018: Government to push research efforts in Artificial Intelligence, says Arun Jaitley, The Economic Times, (01/02/ 2020), available at https://economictimes.indiatimes.com/tech/software/budget-2018-government-to-push-research-efforts-in-artificial-intelligence-says–arun%20jaitley/articleshow/62738437.cms?utm_source=contentofinterest&utm_medium=text&utm_campaign=cppst, last seen on 10/07/2020.
[3] NITI Aayog, National Strategy for Artificial Intelligence, (04/06/2018), available at https://niti.gov.in/writereaddata/files/document_publication/NationalStrategy-for-AI-Discussion-Paper.pdf, last seen on 17/07/2020.
[4] Ibid, at 24.
[5] G. Rong, A. Mendez, E. Bou Assi et al., Artificial Intelligence in Healthcare: Review and Prediction Case Studies, 6 Engineering 291, 301 (2019) available at https://doi.org/10.1016/j.eng.2019.08.015, last seen on 11./07/ 2020.
[6]Arvind Kasthuri, Challenges to Healthcare in India – The Five A’s, 43(3) Indian J Community Med 141,143 (2018), available at https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6166510/, last seen on 20/07/2020.
[7] India facing shortage of 600,000 doctors, 2 million nurses: Study, The Economic Times Industry, (14/04/2019), available at https://economictimes.indiatimes.com/industry/healthcare/biotech/healthcare/india-facing-shortage-of-600000-doctors-2-million-nurses-study/articleshow/68875822.cms?from=mdr, last seen on 22/07/2020.
[8] Rao KD., Situation Analysis of the Health Workforce in India. Human Resources, Technical Paper I.Public Health Foundation of India (2011), available at http://www.uhc-india.org/uploads/RaoKD_SituationAnalysisoftheHealthWorkforceinIndia.pdf, last seen on 22/07/2020.
[9] Craig Kuziemsky, Anthony J. Maeder, Oommen John, Shashi B. Gogia, Arindam Basu, Sushil Meher, and Marcia Ito, Role of Artificial Intelligence within the Telehealth Domain, 28(1) Yearb Med Inform 35, 40 (2019) available at https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6697552/#JRkuziemsky-11, last seen on 22/07/2020.
[10] Rashmi Mabiyan, How artificial intelligence can help transform Indian healthcare, Health World.com from the Economic Times (2018), available at https://health.economictimes.indiatimes.com/news/health-it/how-artificial-intelligence-can-help-transform-indian-healthcare/64285489, last seen on 10/08/2020.
[11] Supra 3.
[12] Supra 5.
[13] Mary Stanfill & David Marc, Health Information Management: Implications of Artificial Intelligence on Healthcare Data and Information Management, 1 Yearb Med Inform 56 (2019), available at https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6697524/, last seen on 07/08/2020.
[14] Tavish Srivastava, What Is The Difference Between Machine Learning & Statistical Modelling, Analytics Vidhya(01/07/2015), available at https://www.analyticsvidhya.com/blog/2015/07/difference-machine-learning-statistical-modeling/, last seen on 12/07/ 2020.
[15] Tom Simonite, When It Comes to Gorillas, Google Photos Remains Blind, WIRED (01/11/2018), available at https://www.wired.com/story/when-it-comes-to-gorillas-google-photos-remains-blind/, last seen on 13/07/ 2020.
[16]Justice K.S. Puttaswamy (Retd.) and Anr. v. Union of India, (2017) 10 SCC.
[17] S. 3.7(1.1), Indian Medical Council (Professional Conduct, Etiquette and Ethics) (Amendment) Regulations, 2020.
[18] S. 3.7(1.2), Indian Medical Council (Professional Conduct, Etiquette and Ethics) (Amendment) Regulations, 2020.
[19] S. 8, The Human Immunodeficiency Virus and Acquired Immune Deficiency Syndrome (prevention and control) act, 2017.
[20] Tanvi Mani, Privacy in Healthcare; Policy Guide, The Centre For Internet & Society ( 14/ 08/ 2014), available at https://cis-india.org/internet-governance/blog/privacy-in-healthcare-policy-guide, last seen on 19/08/2020.
[21] Supra 6.
[22] Electronic Health Record Standards for India, 2016.
[23] Clinical Establishments (Registration and Regulation) Act, 2010.
[24] Ministry of Health & Family Welfare Government of India, ELECTRONIC HEALTH RECORD (EHR) STANDARDS FOR INDIA, page 20, available at .https://main.mohfw.gov.in/sites/default/files/17739294021483341357.pdf, last seen on 23/082020.
[25] Rashmi Mabiyan, India bullish on AI in healthcare without electronic health records, ETHealthWorld (06/01/2020), available at https://health.economictimes.indiatimes.com/news/health-it/india-bullish-on-ai-in-healthcare-without-ehr/73118990, last seen on 23/08/2020.
[26]Amber Sinha, Comments on Draft Electronic Health Records Standards, The Centre for Internet and society, (28/05/2016), available at https://cis-india.org/internet-governance/blog/comments-on-draft-electronic-health-records-standards, last seen on 23/08/2020.
[27] Gopichandran V, Ganeshkumar P, Dash S, Ramasamy, A. Ethical challenges of digital health technologies, 98(4) Bull World Health Organ 277–281 (2020), available at https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7133485/, last seen on 10/08/2020.
[28] Women’s health app Maya sharing users personal data with Facebook, The Economics Times ( 11/09/2019), available at https://economictimes.indiatimes.com/tech/software/womens-health-app-maya-sharing-users-personal-data-with-facebook/articleshow/71073449.cms?utm_source=contentofinterest&utm_medium=text&utm_campaign=cppst, last seen on 19/08/2020.
[29] Zaheer Merchant, Health department of northern state exposed data of 12.5 million pregnant women, Medianama(03/04/2019), available at https://www.medianama.com/2019/04/223-health-department-indian-state-pregnant-women-data-leak/, last seen on 19/08/2020.
[30] Healthcare Data Leak: Over 120 Mn Medical Images Of Indian Patients Left Exposed, Inc42 (04/02/2020), available at https://inc42.com/buzz/india-healthcare-data-leak-over-120-mn-medical-images-exposed/, last seen on 22/07/2020.
[31] Health Insurance Portability and Accountability Act, 1996.
[32] Victoria Horden, The Final GDPR Text and What It Will Mean for Health Data, HEALTH PRIVACY/HIPAA (20/01/2016), available at https://www.hldataprotection.com/2016/01/articles/health-privacy-hipaa/the-final-gdpr-text-and-what-it-will-mean-for-health-data/, last seen on 18/07/ 2020.
[33] The Personal Data Protection Bill, 2019 (pending).
[34] Maneesh Chhibber, Data protection bill exempts govt agencies from law, set to be tabled in Lok Sabha tomorrow (10/12/2019), available at https://theprint.in/india/governance/data-protection-bill-to-be-introduced-in-lok-sabha-tomorrow-contentious-clauses-added/333269/, last seen on 10/09/2020.
[35] S. 12(1) (a)(i), The Personal Data Protection Bill, 2019.
[36] MoHFW Notification: Placing the draft of “Digital Information Security in Healthcare, act (DISHA)” in public domain for comments/views-reg, Ministry of Health and Family Welfare, (18/03/2018) Notification No. F.No.Z-18015/23/2017-eGov, available at https://www.nhp.gov.in/NHPfiles/R_4179_1521627488625_0.pdf, last seen on 18/07/2020.
[37] DISHA and the draft Personal Data Protection Bill, 2018: Looking at the future of governance of health data in India, Ikigai Law, (25/02/2019), available at https://www.ikigailaw.com/disha-and-the-draft-personal-data-protection-bill-2018-looking-at-the-future-of-governance-of-health-data-in-india/, last seen on 23/08/2020.
[38] K.S. Puttaswamy (Retd.) and Anr. v. Union of India (2019) 1 SCC 1.
[39] Budget 2020: Ayushman Bharat-PMJAY should use AI and ML, ET Healthworld (01 Feb 2020), available at https://health.economictimes.indiatimes.com/news/policy/budget-2020-ayushman-bharat-pmjay-should-use-ai-and-ml/73842735, last seen on 13/07/ 2020.
[40] Sara G. Murray Robert M. Wachter Russell J. Cucina, Discrimination by Artificial Intelligence In A Commercial Electronic Health Record—A Case Study, Health Affairs (31/01/2020), available at https://www.healthaffairs.org/do/10.1377/hblog20200128.626576/, last seen on 13/07/ 2020.
[41] Dave Gershgorn, If AI is going to be the world’s doctor, it needs better textbooks, QUARTZ (2018), available at https://qz.com/1367177/if-ai-is-going-to-be-the-worlds-doctor-it-needs-better-textbooks/, last seen on 13/08/2020.
[42] Ayal A. Aizer, Lack of reduction in racial disparities in cancer‐specific mortality over a 20‐year period, 120(10) ACS Journals (2014), available at https://acsjournals.onlinelibrary.wiley.com/doi/full/10.1002/cncr.28617, last seen on 14/07/2020.
[43] Wendy Watson, Christina Marsh, ARTIFICIAL INTELLIGENCE BIAS IN HEALTHCARE, Boozallen,, available at https://www.boozallen.com/c/insight/blog/ai-bias-in-healthcare.html, last seen on 15/07/2020.
[44] Supra 10.
[45] Anna Jobin, Marcelo lenca & Effy Vayena The global landscape of AI ethics guidelines,1 Nat Mach Intell 389, (2019), available at https://doi.org/10.1038/s42256-019-0088-2, last seen on 12/08/2020.
[46] Kenneth Goodman, Diana Zandi , Andreas Reis & Effy Vayena, Balancing risks and benefits of artificial intelligence in the health sector,(2020), available at https://www.who.int/bulletin/volumes/98/4/20-253823/en/, last seen on 12/08/2020.
[47] Kerasidou A., Artificial intelligence and the ongoing need for empathy, compassion and trust in healthcare, Bull World Health Organ 245, (2020).
[48] Vayena E, Salathé M, Madoff LC & Brownstein JS, Ethical Challenges of Big Data in Public Health, 11(2) PLoS Comput Biol, (2015), https://doi.org/10.1371/journal.pcbi.1003904, last seen on 12/08/2020.
[49] Ibid.
[50] Paschim Banga Khet Majdoor Samity v. State of West Bengal, (1996) 4 SCC 37.
The Journal of Indian Law and Society 