South Korea’s deployment of a new electronic health record system will give patients greater accessibility and control over their data, but questions about security and privacy remain unanswered, writes Junho Jung
South Korea’s ambitious healthcare digitalization is largely the result of state-led innovation. In fact, in 2021, the national digital health research and development budget was US $ 850 million.1 In a country that has an adoption rate of over 90% of electronic health record systems in medical facilities and where around 93% of the adult population owns smartphones, the government is aiming for a complete digital transformation of healthcare . Although interest in digital health is high, industry participation is currently limited, but it is expected to grow rapidly in the coming years.
In August 2017, the government set itself the goal of creating new engines of economic growth based on ‘DNA’ (data, network and AI technology) and securing the industrial base and related policy frameworks. necessary to achieve this. As part of this, a special digital healthcare working group was formed to “establish sovereignty over personal health data and collect comprehensive strategies to improve public health”. This has been accompanied by changes in data protection laws. The new Data 3 Act (consisting of amendments to the Personal Information Protection Act, the Credit Information Act and the Information and Communication Networks Act) authorized the use of data pseudonymized, rather than anonymized data, without consent for scientific research, and paved the way for public database records used flexibly by private companies.
In February 2021, the Korean Ministry of Health and Welfare launched the My HealthWay app. This app is designed to “establish sovereignty over personal health data”.2 Currently, it provides integrated management of medical check-up data (from national health insurance records), prescription data (from Health Insurance Review and Assessment Service) and history vaccinations (from the Agency for Disease Control and Prevention).
By 2022, once electronic medical records (EMRs) compatibility issues are resolved between facilities, all personal health records will be stored in this single application. It is expected that by 2023 all medical and health records, including data from “portable” personal medical devices, will be integrated and saved in one place, on the patient’s own medical app. This will not only provide patients with an integrated record, but also full ownership of all their health data. What’s remarkable is that Korea’s plans for data integration don’t just focus on the healthcare sector, but also encompass personal financial and administrative information. My HealthWay is part of a larger umbrella program MyData.3
Korea has a single national compulsory health insurance system, and all citizens are registered under a number given at birth.4 This number is linked to the national identification system which contains the biometric data of each citizen. The number is a key individual identifier in all medical, financial and administrative work in Korea. Therefore, government merging of all of a person’s digital data through a single record is possible.
It was evident during the covid-19 pandemic that the single registration system was effective for contact tracing, however, it also raised significant concerns about privacy breaches. An amendment to the Infectious Disease Control and Prevention Act allowed the Korea Disease Control and Prevention Agency to collect data on credit card usage from banks, geolocation information via telecommunications companies and police surveillance camera footage for contact tracing. This meant that people who had come into contact with infected people could be traced and quarantined almost in real time. At certain stages of the pandemic, the Ministry of Health even made public information on those infected, including their means of transport, the names of the places they had visited, the medical establishments where they had been treated and their condition. health. Even though names and addresses were not disclosed, the level of detail of personal information disclosed by the government was in danger of being identified, which could lead to discrimination and personal distress.
These embedded files clearly contain large amounts of confidential personal data and it could have devastating consequences if breached. There is a risk that pseudonymised data will be re-identified. At the same time, such a concentration of sensitive personal information in a single government-controlled location can expand state control and oversight. To avoid criticism on this front, My HealthWay claims to act only as a platform or “highway” that transmits data, avoiding storing unnecessary personal data on its server.5 Despite these assurances, the government’s stance that it only acts as a data transfer “highway” still worries many citizens in Korea.
The general public’s view of My HealthWay is mixed. Consumer groups welcome the initiative as each person will have control and ownership of their data, and information sharing between medical institutions and insurance companies will improve accessibility and choice.6 On the other hand, some patient groups argue that simply storing and merging health data does not guarantee autonomy. Health records are complex data sets, and giving informed consent for access for specific uses can be difficult to understand and implement. In addition, there are currently no effective measures or sanctions in place for its misuse. The government has emphasized that My HealthWay’s data is not intended for commercial use, but this will not prevent patients from sending their data to private institutions, such as large hospitals, insurance companies and health care providers. data mining companies.
Questions about good governance remain. Unfortunately, in the early stages of policy development, the My HealthWay development committee did not include any patient groups or representatives of civil society. It was not until 2021, during the implementation phase, that a patient representative was able to participate in a committee where the rest of the 15 members were drawn from government and industry.7
My HealthWay has the potential to return ownership of data to patients, when at present it is largely the domain of individual medical institutions. The ability to personally store your own digital health records and decide when to selectively transfer data for secondary use will empower people and empower them. However, the sensitivity of health data, especially when merged with other identifiable data, poses privacy risks. Ensuring that the application does not simply transfer ownership of data without sufficient safeguards is essential and should be achieved not only through technological means, but also through transparent governance. Without it, there is a very real risk that My HealthWay will cause damage that outweighs its benefits.
Junho Jung is a researcher at the Center for Health and Social Change, a nonprofit community-based research center specializing in transdisciplinary research on health issues. He leads the Korea Healthcare Digitization Critical Analysis Project.
Competing interests: none declared.
1. Lee, Byung-chul. Analysis of the national health data budget. National Assembly Budget Office, Korea. 2021. p. 4-5.
2. Ministry of Health and Welfare. Press release. Launch of My HealthWay (health data highway). February 24, 2021.
3 Park, Hye-yun. Expanding the MyData industry to all sectors, from finance to healthcare and communications. News1 Korea. June 11, 2021.
4 Resident registration numbers were introduced in 1968 as a means of promoting national security. Thus, it has long been used as a means of surveillance, especially during a period of military dictatorship. For a detailed examination, in terms of health, refer to Kang Minah, et al. Korean Resident Registration System for Universal Health Coverage. World Bank. 2019.
5. Fourth Industrial Revolution Committee. Implementation plan of “My HealthWay” (MyData in the medical sector) to promote national health and innovative health care. p. 4. February 2021.
6. Kang Gun-uk. “Consumer Rights and the Simplification of Private Insurance Claims,” in the Conference on Health Care Consumer Data Rights. The voice of consumers, Korea. May 31, 2021.
7. Ministry of Health and Welfare. Press release. Start a social discussion to form the My HealthWay ecosystem – First meeting of the MyData steering committee. May 10, 2021.