🔬 Forensic Medical Education

Postmortem analysis of opioids

DATA OWNERSHIP OF HEALTH RECORDS

Principles for Electronic Health Records in India

An Electronic Health Record (EHR) contains personal and sensitive health information about an individual. Recognizing the importance of privacy and autonomy, the EHR Standards for India establish that the individual (patient) is the rightful owner of the health data contained in his/her health records. This section describes the principles of data ownership, consent and control as recommended in the EHR Standards for India.

1. INDIVIDUAL IS THE OWNER

The individual to whom the health information pertains is the ultimate owner of that information. All rights to access, control, use, share and transfer the health data rest with the individual.

This includes the right to:

• Access his/her health records
• Seek correction or amendment of records
• Grant or deny permission for use or disclosure
• Withdraw consent at any time
• Transfer the record to another service provider
• Decide how the data may be used in the future

2. CONTROL OVER THE DATA

Individuals have control over their health data. They can decide:

• Who can access their information
• For what purpose it can be used
• For how long it can be retained

Note: No person or organization shall access or use the health data without the explicit consent of the individual, except as permitted by law.

3. CONSENT IS ESSENTIAL

• Consent of the individual is mandatory for any use, sharing or disclosure of health information.
• Consent must be informed, voluntary, specific and unambiguous.
• The individual must be made aware of the purpose and extent of use.
• Consent can be withdrawn at any time, and the individual has the right to revoke access previously granted.

Exception: In the absence of consent, information shall not be used or disclosed, except as per the provisions of applicable law.

4. PERMITTED USE AND DISCLOSURE

Health data may be used or disclosed only:

• With the consent of the individual, or
• As required by law (e.g., for public health, court orders, mandatory reporting, etc.)
• For the purpose for which consent has been granted.

The health information shall not be used for any purpose other than that which is conveyed to the individual at the time of seeking consent.

5. GUIDING PRINCIPLES OF DATA OWNERSHIP

• AUTONOMY

Individuals have the freedom and authority to make decisions about their own health information.

• TRANSPARENCY

Individuals must be clearly informed about how their data will be collected, used, stored and shared.

• CONFIDENTIALITY

Health information must be kept confidential and protected from unauthorized access, use or disclosure.

• ACCOUNTABILITY

Organizations and persons handling health data are accountable for protecting privacy and respecting ownership.

• INTEGRITY

Health data must be accurate, complete and protected against tampering, loss or damage.

• LAW AND ETHICS

Use and disclosure of health data must comply with applicable laws and ethical standards.

6. PURPOSE

These principles are intended to ensure that the collection, storage, use and sharing of health information is done in a manner that respects the rights of individuals, protects their privacy, and promotes trust in the digital health ecosystem.

Empowered individuals are central to building a secure, trustworthy and citizen-centric digital health system in India.

Source: Electronic Health Record (EHR) Standards for India, 2016 – Standards Set Recommendations v2.0 e-Health Division, Ministry of Health & Family Welfare, Government of India