Prologue World Association for Medical Law 2019 Annual Congress Recently, many countries are trying to fully utilize medical records building up in hospitals and clinics. Japanese Effort to Utilize Medical Big Data: In April 2017, the Japanese Parliament passed the Act for The Enactment of the Next-Generation Medical Anonymized Medical Data for the Promotion of Medical Research and Developments [commonly referred to as Infrastructure Act, 2017 Jisedai Iryo Kiban Ho, which can be translated as the Next- Generation Medical Infrastructure Act]. Its aim was to create the scheme to utilize medical data Eiji Maruyama generated in medical settings, while safeguarding the Kobe University, Kobe, Japan privacy of the individual patient. http://www2.kobe-u.ac.jp/~emaruyam/ 1 Prologue Prologue The Act intends to create the system where hospitals and clinics can provide patients' data to governmentally accredited private companies skilled in data handling and data security. In 2015, the Japanese Personal Data Protection Act was It will be operated on voluntary basis. Hospitals are able but not amended to be adapted to the advanced technology and required to take part in the system. globalization. Patients of participating facilities are given the written notice of it The amendment created a new category of "personal data and offered the opportunity to opt out. requiring special care," and medical and health data was The data company will collect and pool patient data, consolidating included in it. the data of the same patient, and make anonymization. Sharing of that kind of data, if identifiable, is allowed only The anonymized data will be provided for a fee to pharmaceutical where the consent of the person is obtained. companies, research institutions and government agencies for research and development.
History of PDP Legislation and Next Generation Act Personal Data Protection (hereinafter as PDP) Legislation May 30, 2003 Enacted. Background of the Act: ◆Personal Data Protection Legislation includes the following: Enactment of Personal Data ●Personal Data Protection Act ●Administrative Agencies Personal Data Protection Act Protection Legislation in 2003 and ●Independent Administrative Corporation Personal Data Its Amendment in 2015 Protection Act April 1, 2005 Full Implimentation of Personal Data Protection Legislation. Sept. 9, 2015 Personal Data Protection Act Amended. May 12, 2017 Next-Generation Medical Infrastructure Act Enacted. May 11, 2018 Next-Generation Medical Infrastructure Act Coming into Force. 6 Basic Policy of Japanese PDP Act Section 1 of PDP Act The purpose of this Act is to protect the rights and interests of Summary of PDP Act and individuals while taking consideration of the usefulness of its 2015 amendment personal data……. ◆ The Act sets out the provisions for ensuring the transparency and data subject participation in processing of personal data. ◆ The key concept of the Act is the "purpose of use" of personal data. 8 8
Summaries of the PDP Act 2015 Amendment to the PDP Act ・ Specification of the purpose of use in the processing of ・ Clarification of the Difinitions of Personal Data. personal data is required. ・ Utilization of personal data under adequate control and ・ When personal data is collected, notification to the data subject security. or publication of the purpose of use is required. ・ （ Without the consent of the subject ） The use of personal data ・ Enhanced protection of personal data: ensuring beyond the the specified purpose of use is prohibited unless traceability of data sharing. otherwise authorized by law. ・ Creation of the Personal Data Protection Committee as ・ （ Without the consent of the Subject ） The sharing of personal the regulating body. data with the third party is prohibited unless otherwise ・ Accommodating global processing of personal data. authorized by law. ・ Other necessary amendments. ・ The disclosure or correction request by the data subject must be adequately complied. 9 9 10 10 2015 Amendment to the PDP Act 2015 Amendment to the PDP Act ・ In health and medical area, the Cabinet Order ・ Clarification of the Difinitions of Personal Data. implementing the 2015 Amendment added the following ・ The amendment created a new category of "personal data three categories of description to "medical history" set out requiring special care."[ § 2 (3)] in the act itself. [ § 2] ・ "Personal Data Requiring Special Care" is defined personal ・ The presence of mental or physical disability. data that contains the data subject's race, creed, social ・ The results of health checkup or other medical tests. status, medical history, criminal record, fact of having ・ That health consultation, medical care or prescription suffered injury by criminal acts, or other descriptions filling was provided to improve the subject's mental and prescribed by cabinet order as requiring special care in physical condition. processing lest the unfair discrimination, prejudice or other All medical and health data is, in effect, characterized disadvantage will occur on the part of the data subject. as "personal data requiring special care.". 11 12 11 12
Amended PDP Act § 17 (2) Amended PDP Act § 23 (1) ・ ・ Sharing with third parties of personal data is allowed Collecting "personal data requiring special care" is allowed only where the advance consent of the subject is only where the advance consent of the subject is obtained, except in the following cases. obtained, except in the following cases. (i) cases allowed by legislation. (i) cases allowed by legislation. (ii) cases in which there is a need to protect a human life, (ii) cases in which there is a need to protect a human life, body or property, and when it is difficult to obtain a body or property, and when it is difficult to obtain a subject's consent. subject's consent. (iii) cases in which there is a special need to enhance (iii) cases in which there is a special need to enhance public health or promote fostering healthy children, and public health or promote fostering healthy children, and when it is difficult to obtain the subject’s consent. when it is difficult to obtain the subject’s consent. (iv) ***. (v) ***. (iv) ***. 13 14 13 14 Amended PDP Act § 2 (9) ・ "Anonymized data" means the data relating to an individual that has been created by processing the Summary of the Next-Generation personal data to make it (1) neither individually Medical Infrastructure Act identifiable (2) nor restorable to any personal data. [hereinafter referred to "the Act"] 15 15
Definition of Entities and Agent Definition of Medical Data under the Act Medical Data ・"Medical data" is defined under the Act to mean the data Entity using medical data database (e.g. Processing Entity relating to a [either living or dead] individual that contains the hospital, clinic, school and employer ） [Processing Entity] following descriptions about mental and physical condition of the individual. Governmentally accredited private entity that Accredited Medical creates anonymized medical data stored in (i) the medical history; Data Anonymizing systematically organized database by collating (ii) the presence of mental or physical disability; Agent and anonymizing medical data to promote [Anonymizing Agent] (iii) the results of health checkup or other medical tests; R&D in the medical field (iv) that health consultation, medical care or prescription filling Anonymized Entity that utilize database of anonymized was provided to improve the subject's mental and physical Medical Database medical data (e.g. pharmaceutical company, condition. User Entity research institution, and administrative body) [User Entity] 17 18 ③ Notification Prime Minister's Office ① Application NATIONAL The Act provides that Prime Minister, Minister of Education and Science, for Accreditation Anonymizing Agent ⑥ Provision of GOVERN ‐ Minister of of Health, Labor and Welfare and Minister of Economy, Trade and Processing Entity Medical Data ② Granting of Industry are the ministers in charge of the Act. ⑦Creation of Anony- （ Hospital /clinic ， MENT accreditation mized Medical Data In fact, the Office of Health Care Strategies at the Prime Minister's Office school ， employer ） Prime seems to be the leading authority supervising the administration of the Act. ⑧ Provision of Minister's When a prospective Anonymizing Agent would like to start its Anonymized Office Medical Data operation under the Act, it must first apply for and obtain the Processing Entity accreditation from the supervising authority.[ ①② ] The accre- User Entity （ Hospital /clinic ， ditation will be granted only when the applicant shows that: (Drug company, research school ， employer ） institution & administrative body) (1) it meets the standard set by the regulation for judging the ability to properly create and provide anonymized medical ⑨R&D in the medical field ⑤ P ublic data by collecting and collating data for medical R&D. ⑤’ Refusal = ③ Notification Announcemen Opting Out ⑩ Return of results (2) appropriate security measures are in place to prevent the t leakage, loss or damage of data. PATIENTS ④ Public Announcement (3) it has the ability to properly administer the security measures (STUDENTS/ EMPLOYEES) GENERAL PUBLIC prescribed in (2). [So far, no entity has been granted the accreditation.] 19 20
Recommend
More recommend
