National Health Data Network

Digital health transformation and data protection

Abstract

[Purpose] The National Health Data Network (RNDS) is a national platform for the integration and interoperability of health information. Since 2019 the network has been implemented in Brazil, in the context of the development of initiatives for the digital transformation in health and to be used by public and private health entities. As it is an environment in which health information circulates, it involves processing of personal data that is subject to the General Data Protection Law (LGPD). Notably, it involves the processing of sensitive health data. This article analyzes the context of the emergence of the RNDS and expose its challenges for the protection of personal data, including the analysis of LGPD rules and how some of these rules are related to the implementation of the network.

[Methodology/approach/design] The research was carried out in three fundamental phases. The first consisted of reviewing specialized bibliography and documents published by public entities regarding digital transformation in health and the implementation of the RNDS. The second aimed at identifying the legal provisions relating to the protection of personal data applicable to the RNDS. Finally, the third phase consisted of identifying the measures adopted to RNDS be compliant with these legal provisions and its challenges for compliance with LGPD.

[Findings] As a result, the article demonstrates that the RNDS, despite representing progress for national digital transformation in health, faces challenges to comply with the LGPD, with regards to the principles for data processing, such as the purpose and transparency principles, information security and prevention, compatibility of the consent-based approach of the RNDS with the requirements for valid consent of the LGPD and the legal prohibition of sharing health data with the objective of obtaining economic advantage.