South Korea’s rollout of a new electronic health record system will give patients greater accessibility and control over their data, but questions about security and privacy remain unanswered, writes Junho Jung
The ambitious digitalisation of health in South Korea is largely the result of state driven innovation. Indeed, in 2021 the national research and development budget on digital health was US$850 million.1 In a country that has a more than 90% adoption rate of electronic health records systems in medical institutions and where around 93% of the adult population owns smartphones, the government is aiming for complete digital transformation in healthcare. Although interest in digital health is high, industry involvement is currently limited, but it is expected to grow rapidly in the coming years.
In August 2017, the government established the goal of creating new economic growth engines based on “DNA” (Data, Network, and AI technology), and securing the industrial base and related policy frameworks needed to do this. As part of this, a special taskforce for digital healthcare was formed to “establish personal medical data sovereignty and collect comprehensive strategies for improving public health.” This came hand in hand with changes to data protection laws. The newly introduced Data 3 Act (consisting of amendments to the Personal Information Protection Act, the Credit Information Act, and the Information and Communications Network Act) has allowed pseudonymised data, rather than anonymised data, to be used without consent for scientific research, and opened the way to records from public databases being used flexibly by private companies.
In February 2021, the Korean Ministry of Health and Welfare launched the My HealthWay app. This app is designed to “establish the sovereignty of personal medical data.”2 Currently, it provides integrated management of medical check-up data (from National Health Insurance records), prescription data (from the Health Insurance Review and Assessment Service), and vaccination history (from the Disease Control and Prevention Agency).
By 2022, once electronic medical record (EMR) compatibility issues are resolved between institutions, all personal health records will be stored in this single app. It is expected that in 2023, all medical records and health records, including data from personal “wearable” medical devices, will be integrated and saved into a single location—on the patient’s own medical app. This will not only provide patients with an integrated record but also full ownership of all their health data. What is notable is that Korea’s plans for integrating data are not only focused in the health sector, but also encompass personal financial and administrative information. My HealthWay is part of a broader MyData umbrella programme.3
Korea has a single mandatory national health insurance system, and all citizens are registered into it under a number given at birth.4 This number is linked with the national identification system that holds the biometric data of each citizen. The number is a key individual identifier in any medical, financial, and administrative work in Korea. Consequently, the government’s merging of a person’s entire digital data record through a single registration is possible.
It was evident during the covid-19 pandemic that the single registration system was effective for contact tracing, however, it also raised significant concerns about invasions of privacy. An amendment to the Infectious Diseases Control and Prevention Act allowed the Korea Disease Control and Prevention Agency to collect data on credit card usage from banks, geolocation information through telecom companies, and surveillance camera footage from the police for contact tracing. This meant people who’d come into contact with infected individuals could be traced and quarantined in almost real time. At certain stages of the pandemic, the Ministry of Health even made information on infected individuals public, including their means of transportation, the names of places they’d visited, the medical institutions they’d been treated at, and their health status. Even though names and addresses weren’t given out, the level of detail in the personal information the government revealed risked people being identified, potentially leading to discrimination and personal distress.
These integrated records clearly hold vast amounts of confidential personal data and it could have devastating consequences if they were breached. There is a risk that pseudonymised data could be re-identified. At the same time, such concentration of sensitive personal information in a single location controlled by the government may widen state control and surveillance. To avoid criticism on this front, My HealthWay claims to act only as a platform or “highway” that transmits the data, avoiding storing any unnecessary personal data on its server.5 Despite these reassurances, the government’s position that it only acts as a “highway” of data transfers still worries many citizens in Korea.
The general public’s view on My HealthWay has been mixed. Consumer groups welcome the initiative as each person will have control and ownership over their data, and sharing information between medical institutions and insurance companies will enhance accessibility and choice.6 On the other hand, some patient groups argue that simple storage and merging of health data does not guarantee autonomy. Health records are complex datasets, and giving informed consent for access for specific uses may be difficult to understand and implement. Furthermore, there are currently no effective measures or sanctions in place for its misuse. The government has emphasised that data in My HealthWay are not for commercial use, but this will not stop patients from sending their data to private institutions, such as large hospitals, insurance companies, and data mining companies.
Questions about good governance remain. Regrettably, at the early stages of policy development, the My HealthWay Development Committee did not include any patient group or civil society representatives. It was only in 2021, during the implementation stage, that one patient representative was able to participate in a committee where the rest of the 15 members were from the government and industry.7
My HealthWay has the potential to return the ownership of data to patients, when at present it is largely in the domain of individual medical institutions. The ability to personally store your own digital health records and to decide when to selectively transfer data for secondary use will empower people and enhance their autonomy. However, the sensitivity of health data, especially when merged with other identifiable data, poses risks to privacy. Ensuring that the app doesn’t simply hand over the ownership of the data without sufficient safeguards is essential, and should be achieved not only through technological means but by transparent governance. Without this there is a very real risk that My HealthWay will cause harms that offset its benefits.
Junho Jung is a researcher at the Center for Health and Social Change, a non-profit community based research centre specialising in transdisciplinary research on health issues. He is leading the project in critically analysing digitalisation of health in Korea.
Competing interests: none declared.
References
1. Lee, Byung-chul. Analysis on National Healthcare Data Budget. National Assembly Budget Office, Korea. 2021. pp. 4-5.
2. Ministry of Health and Welfare. Press Release. Initiating My HealthWay (Health Data Highway). 24 Feb 2021.
3 Park, Hye-yun. Expanding MyData industry to all sectors, from finance to health and communications. News1 Korea. 11 Jun 2021.
4 Resident registration numbers were introduced in 1968 as a means of promoting national security. Thus, it has long been used as a means of surveillance, especially during times of military dictatorship. For detailed review, in terms of health, refer to Kang Minah, et al. Korean Resident Registration System for Universal Health Coverage. World Bank. 2019.
5. Fourth Industrial Revolution Committee. Implementation Plan for “My HealthWay” (MyData in Medical Sector) to Promote National Health and Innovating Healthcare. pp. 4. February 2021.
6. Kang Gun-uk. “Consumer Rights and Simplifying Private Insurance Claims”, in Conference on Data Rights of Healthcare Consumer. The Voice of Consumers, Korea. 31 May 2021.
7. Ministry of Health and Welfare. Press Release. Start social discussion to form My HealthWay ecosystem – First meeting of MyData Steering Committee. 10 May 2021.