Govt Created Health IDs Without Consent, Say Vaccinated Indians

The problem lies with uninformed consent, which is possible for lack of a robust data protection law in India.

Aneesh T, a Pune resident said that he received his first dose of vaccination against COVID-19, but was shocked to see a Unique Health ID (UHID) allotted to him on his vaccine certificate.

"My COVID-19 vaccine certificate mentions a Unique Health ID which was generated without any prior consent," he told The Quint.

While more than 23 crores of Indian have been vaccinated against COVID-19, as per the latest data by Ministry of Health and Family welfare, it has come to notice that if a person uses their Aadhaar card to register for vaccination on CoWIN, the authorities will use this to generate a UHID for the individual.

Many Indians who took the jab said they have no idea how the ID is generated. Several took it to social media platforms to point out that there was no "consent" taken or information provided to the users before the generation of the UHID.

What is a Unique Health ID?

A Unique Health ID will be provided to every citizen which will contain details of their diseases, diagnosis, report, medication etc., in a common database through a single ID. This will essentially be a digitised version of all their health records. This digital database will be linked to the registry of doctors and health facilities across the country.

Earlier, in January, 2021 , the health ministry issued a gazette notification which stated that Aadhaar authentication will be used on a 'voluntary' basis to create UHIDs for those citizens getting the vaccine.

The National Digital Health Mission website clearly mentions that once the UHID is generated, these will be used for the purposes of "uniquely identifying persons, authenticating them, and threading their health records (only with the informed and prior consent of the patient) across multiple systems and stakeholders."

Why Is This Problematic?

While it is understandable that the COVID-19 vaccination program will be the perfect opportunity to get health IDs for several citizens since a large mass of the population will get vaccinated under the program, the problem lies with uninformed consent.

Concerned with the allotment of UHID, Mumbai resident Vidhi Rawat said, " I didn't know that the government is creating a unique health ID for me. While I don't have any issues with the allotment of UHID, what matters is that I wasn't informed. No wonder, the hospital was keen on asking Aadhaar details," she said.

UHID Issued Before Personal Data Protection Law

Prasanth Sugathan, legal director at Software Freedom Law Centre or sflc.in, said that the health data management policy will operate in the absence of India’s Personal Data Protection Bill which is currently before a standing committee of Parliament.

Sugathan points out that the health data management policy is not a substitute for law. The policy will operate in the absence of a robust legislation governing personal data. It is also not in compliance with the Hon'ble Supreme Court's judgment in Puttaswamy 1 (2017) which categorically states that there must be a law governing data collection and processing.

While the policy provides for data deletion and correction by the data principal, it has not provided adequate grounds to data principals to delete their data. "The deletion of data is contingent upon several conditions such as if it violates a data protection law or if it has served the purpose," he added.

“Interestingly, while at one place the policy recognises absolute right of data principal over their data, it does give an absolute right to data principal to delete their data”

Prasanth Sugathan, legal director at Software Freedom Law Centre

What Is The Solution?

National Digital Health Mission specifies that Aadhaar is NOT mandatory for registering a health ID. It says that the "process of generation of Health ID has voluntary usage of Aadhaar" and shall require a "notification under Section 4 of Aadhaar Act."

According to MoHFW website, information that is needed for the registration of a Health ID is – "Name, Year of Birth, Gender, and Mobile Number or Email."

Using Aadhaar card will provide all the relevant information needed to create a UHID. Experts told The Quint that the only solution to this problem is using "other Identity proofs such as PAN card, licence as these proofs will not create a UHID."