A rights based approach to digital health

Privacy, health, and a rights-based approach

People - and their rights - should be the central concern for the design of healthcare policy. Decisions in healthcare affect people deeply and personally, and so people must be involved and able to engage in the process. This is needed to ensure that healthcare services are meeting all of peoples’ needs. Of course that includes the quality of healthcare itself, but it can also be crucial in directing decisions away from those that negatively impact people’s privacy.

Privacy is intimately connected to healthcare because healthcare is itself deeply intimate. Accessing treatment involves revealing sensitive information about our bodies, our minds and our lifestyles (such as what we look like under our clothes, who we have sex with, or how invasive thoughts affect our mood). Medical professionals have long taken confidentiality seriously, and the design of healthcare policy must also be serious about people’s right to privacy.

Within the world of development, the notion of taking a “human rights-based approach” (HRBA) means doing just that: foregrounding people, their rights, and their involvement in the design - and the execution - of projects, plans and policies. The core idea is that development activities should be about building resilient and fair communities who can participate in the world equally, and on their terms. After all, the availability and accessibility of good quality healthcare is not a gesture of charitable goodwill: it’s something that we all inherently deserve as human beings.

Taking an HRBA therefore demands a systemic approach. It’s about understanding and embracing the complexity and diversity of human lives, and building institutions which have the mandate and the resources to uphold human rights. That means putting in place the right kind of measures in the design of digital health interventions, with proper consideration of the following:

Participation, empowerment and capacity building

People should be treated as actors rather than mere recipients, with proper involvement in decisions that affect them. It is essential that everyone knows their rights and how to demand them, both for themselves and on behalf of others. Activities and actions should therefore be locally defined and led, ensuring relevance and ownership. This will require capacity building, which must operate as a two-way street. Duty-bearers (such as government departments and regulators) must also be empowered and adequately resourced. Lastly, participation is both a means and an end in itself - it can lead to better decisions, improves relationships and challenges power imbalances.

• People should be involved in the design of digital health tools (e.g. apps) and platforms (e.g. patient records) through participatory consultations, co-design processes, and/or user feedback mechanisms.
• People should not be forced to take part in health development programmes or digital health initiatives, including maintaining provision of offline services.
• State actors must have capacity to understand and assess impact of health programmes on all rights, including privacy.

Transforming power relations

The patterns and root causes of inequality, discrimination and other power imbalances should be addressed and challenged. That requires transforming power relations (in particular between health providers, private companies building health tools and systems, and right-holders), as well as promoting equality and non-discrimination. In doing so, no-one should be left behind: human rights are universal, and this must be reflected in both policy and implementation. To achieve real inclusion, marginalised and excluded groups must be placed at the centre of decision-making and prioritised throughout. Taking an HRBA means: 

• Understanding what impact digital health tools have on different populations, through an intersectional lens.
• Exploring why might different groups be happy/reluctant to use different tools.
• Ensuring people have agency over policy and intervention decisions that affect them.
• Preventing private companies and their interests overshadowing people and their rights.
• Identifying who is left behind by healthcare interventions and responding to that assessment.

Law, policy and morals

The legal and political dimensions of human rights must also be properly accounted for. Because human rights are entitlements rather than simply preferences, fulfilling them is a matter of justice, not of goodwill. Human rights therefore make legal, political and moral demands and require legal, political, and institutional accountability. Those institutions must take the demands of human rights seriously: responding to the political demands about how society should be organised and governed. Doing so can also help to further them in the collective consciousness. At the same time, human rights are legal constructs, grounded in law and enforceable through the courts, where they must be heard and upheld.

• The rights to health and to privacy are legal requirements, not a nice-to-have. States must dedicate adequate resources to health to progressively improve practice and embed its realisation for all, without unduly impinging on privacy or other rights.
• Governance and institutional safeguards must be in place to prevent access to care being withdrawn or diminished arbitrarily.
• Legal, social, institutional and financial tools must be accessible and available so that communities affected by digital health tools can uphold their rights.

The above aspects of taking a human rights based approach are sometimes described as the PANEL (or PLANET) principles, which stands for:

• Participation
• Accountability
• Non-discrimination
• Empowerment
• Legality
• Transparency

Organisations working on digital health issues, including PI, often call for governments and companies to take a rights-based approach to healthcare. That’s because we believe that people - and their rights - should be the central concern for the design of healthcare policy.

What does all this mean for the right to privacy

The purpose of the above measures is to ensure that wider views and considerations - including about privacy - are properly accounted for in the design and deployment of digital health. While the provision of healthcare necessarily entails investigation of intimate matters, that does not mean that the right to privacy and the right to health are always in tension. Instead it means that, properly understood, a rights-based approach to digital health requires thorough consideration of, and compatibility with, people’s privacy needs.

In practice, that means avoiding particular interventions that have an unacceptable level of privacy intrusion. The data intensive nature of many digital systems means special care is needed here. So, for example, strong and enforced rules around the use and protection of health data are needed. Its sensitivity - and its value in being shared for research and other purposes - mean that it warrants special and robust legal regimes. Law, policy and governance measures will also be needed to ensure that the privacy impacts of digital health tools are properly assessed and accounted for.

Context always matters - different situations will demand different degrees of protection. Who can access and use health data depends on both the identity and the motivation of the other party. You may expect that speaking to your GP about a health condition entails a certain loss of privacy, but that doesn’t mean that your data about that interaction can then be shared with third parties without your knowledge and permission. You might be happy for your data to be used carefully to support research into a disease that runs in your family, but that doesn’t mean you want identifiable information about you to support private profits or inform law enforcement. Maybe you find an app really useful to help you understand your health better, but that doesn’t mean that it’s ok for the data collected to be sold to advertisers.

The answer is not entirely about rules and regulation. People and communities must also be informed, educated, involved and empowered so that they can understand how digital health will impact them. Everyone must also be able to participate in digital health in ways that meet their needs. That may not always be straightforward and people will always have differing priorities and viewpoints, especially given the complexity and sensitivity of both healthcare interventions and data governance. But it is needed regardless of the context or part of the world in which digital health tools are being relied on.

Finally, digital health initiatives can have particular impact on already-marginalised communities. That can come about because of a lack of access to digital services (the digital divide), or where matters related to healthcare are criminalised or stigmatised (for example in relation to sexual health). In such circumstances, a HRBA demands care and sensitivity that such groups are not left behind and their position not inadvertently worsened. In these contexts, taking care to respect and protect privacy is especially crucial.

Conclusion

If the promises of digital health are to be met - promises of more widely available, more efficient, more personalised healthcare - a rights-based approach must be taken. People and communities must not be left out or left behind. And concerns over privacy must be acknowledged and addressed.

For national goverments, that means putting in place the required law and governance structures rather than rushing through new innovations. For public healthcare providers, it means facing up to the demands of learning about how new technology works and how it affects people. For National Human Rights Institutions, it means monitoring performance and providing resources. Global actors must also be supportive of these efforts. And the private sector has a role to play too - tech companies engaging in healthcare and health companies designing new tech also have human rights obligations, and should model best practice in the fulfillment of people’s rights.