PATIENT PRIVACY IN A MOBILE WORLD A FRAMEWORK TO ADDRESS PRIVACY LAW ISSUES IN MOBILE HEALTH JUNE 2013 PATIENT PRIVACY IN A MOBILE WORLD A FRAMEWORK TO ADDRESS PRIVACY LAW ISSUES IN MOBILE HEALTH JUNE 2013 ACKNOWLEDGEMENTS Thomson Reuters Foundation and the TrustLaw Connect team are truly grateful to each of the partners that contributed to and collaborated on this work: mHealth Alliance identified the need to examine this important issue and brought their expertise on mobile health in the global arena. We truly value their collaborative approach and ability to engage with multiple stakeholders to deliver this project. Baker & McKenzie and Merck dedicated significant resources as the international coordinators for this project, bringing a wealth of legal and commercial expertise on health, privacy and data protection laws. Baker & McKenzie also carried out the research for the Chilean and Peruvian case studies in this report. Doulah & Doulah for the Bangladesh research, MMAKS for the Ugandan research, Nisith Desai for the Indian research, Templars for the Nigerian research and Ubena John, Doctoral Candidate at Stockholm University for the Tanzanian research. The mHealth Alliance wishes to acknowledge a number of individuals who contributed to the production of this publication. First, we would like to thank Kathy Calvin, President and CEO of the United Nations Foundation, whose initial conversations with Monique Villa, President of the Thomson Reuters Foundation, led to the development of the TrustLaw Connect project that forms the basis for this publication. We also want to acknowledge and thank Patricia Mechael, Executive Director of the mHealth Alliance, whose leadership in addressing concerns around privacy, confidentiality and data security as key IV PATIENT PRIVACY IN A MOBILE WORLD – A FRAMEWORK TO ADDRESS PRIVACY ISSUES IN MOBILE HEALTH barriers to using mobile technology launched the work of the Alliance and led to the engagement with Thomson Reuters Foundation, Baker & McKenzie and Merck. The Alliance also wishes to thank William Philbrick, who, on behalf of the Alliance, oversaw and managed the project that led to this publication. His efforts were part of a larger team effort that included Chelsea Hedquist, Jon Payne, Madhu Deshmukh, Shariq Khoja, Avrille Hanzel, Adele Waugaman, Madhura Bhat, Francis Gonzales, Chelsea Solmo and Sarah Struble. Baker & McKenzie is proud to contribute to this paper and the efforts of the mHealth Alliance in championing the use of mobile technologies to improve health throughout the world. A very special thank you is due to the TrustLaw Connect network of the Thomson Reuters Foundation for organizing the project and undertaking the process of assembling the contributing lawyers. Baker & McKenzie is deeply grateful to Merck and its global team for co-leading this project and providing constant input and support. Also, this paper could not have been completed without the essential contributions of Doulah & Doulah from Bangladesh, MMAKS Advocates from Uganda, Nisith Desai Associates from India, Templars from Nigeria and Ubena John from Tanzania. Finally, we would like to thank the following individuals who comprised our global team: Michael J. Wagner (Chicago), Brian Hengesbaugh (Chicago), Karen Sewell (Chicago), Kate O Suilleabhain (Chicago), Amy de La Lama (Chicago), Peter R. George (Chicago), Lindsay M. Martin (Chicago), Jacqueline M. Wilkosz (Chicago), Deanna Bougie (Chicago), Erin Boo (Chicago), Teresa Tovar (Lima), Jorge Ossio (Lima), Viviana Chavez (Lima), Christoph Rittweger (Munich), Julia Wendler (Munich), Katherine T. Sakoda (Palo Alto), Antonio Ortuzar, Jr. (Santiago), and Rafael Pastor (Santiago). Merck wishes to express appreciation to both the mHealth Alliance and the TrustLaw Connect network of the Thomson Reuters Foundation for the opportunity to work on this important project, as well as the PATIENT PRIVACY IN A MOBILE WORLD – A FRAMEWORK TO ADDRESS PRIVACY ISSUES IN MOBILE HEALTH V excellent collaboration by both organizations throughout its planning and implementation. In addition, we wish to acknowledge the invaluable contribution made by Baker & McKenzie as well as the other participating law firms. Finally, but not least, we at Merck are very proud of the contribution made to the project by a global team including colleagues from our Office of General Counsel and Global Compliance Organization, in several locations in the US, Europe and Asia Pacific regions. As such, this project is an important milestone in the ongoing expansion and globalization of Merck’s long standing legal pro bono program. We acknowledge the contribution of all of the partners involved in the project and especially Nasir and Amina, partners at Doulah & Doulah, for the local research. Special thanks go to Karen Sewell at Baker & McKenzie and Serena Grant and Dianne Marcos at the Thomson Reuters Foundation for taking up the toughest job of cross-border co-ordination and consolidation. MMAKS Advocates acknowledges the work of Mr. Phillip Karugaba and Ms. Gloria Matovu who volunteered on the mHealth Alliance Research. We would like acknowledge the following members of the Templars team — Olumide Akpata, Ijeoma Uju, Chioma Oparadike, Oyeyemi Immanuel and Ebuka Uyanwa — for their contributions to this project. DISCLAIMER The material in this paper is of the nature of general comment only and is not intended to be a comprehensive exposition of all potential issues, nor of the law relating to such issues. It is not offered as advice on any particular matter and should not be taken as such. The precedent documents included in this paper have not been prepared with any particular matter in mind. Baker & McKenzie, Merck, Thomson Reuters Foundation, the editors and the contributing authors disclaim all liability to any person in respect of anything done and the consequences of anything done or permitted to be done or omitted to be done wholly or partly in reliance upon the whole or part of this paper. Before any action is taken or decision not to act is made, specific legal advice should be taken in light of the relevant circumstances and no reliance should be placed on the statements made or documents reproduced in this paper. TABLE OF CONTENTS ACKNOWLEDGEMENTS ................................................ III SELECTED DEFINITIONS ...............................................XI ACRONYMS ................................................................ XIII FOREWORD .................................................................. 1 EXECUTIVE SUMMARY ..................................................3 INTRODUCTION ............................................................5 OBJECTIVE ................................................................. 8 BACKGROUND ............................................................. 8 Technology’s Effects on mHealth Privacy and Security ................... 11 Culture’s Effect on mHealth Privacy and Security .........................12 Law’s Effect on mHealth Privacy and Security ............................13 Other Factors Affecting mHealth Privacy and Security ...................15 Uses of mHealth and the “mHealth Ecosystem” ..........................16 METHODOLOGY ...........................................................19 PATIENT PRIVACY IN A MOBILE WORLD – A FRAMEWORK TO ADDRESS PRIVACY ISSUES IN MOBILE HEALTH IX GLOBAL LANDSCAPE OF CURRENT mHEALTH PRIVACY AND SECURITY LAWS AND PATIENT CONFIDENTIALITY ..................................21 LAWS .......................................................................21 United States .............................................................. 23 European Union ........................................................... 35 Australia ....................................................................41 Japan ...................................................................... 44 Singapore .................................................................. 46 Argentina .................................................................. 49 Mexico ..................................................................... 54 Africa ....................................................................... 59 MEDICAL ETHICS ......................................................... 59 The Sources of Medical Ethics ............................................ 60 The United States, Canada and Europe ...................................61 Latin America .............................................................. 65 Middle East ................................................................ 67 Asia ........................................................................ 69 Africa ....................................................................... 70 CASE STUDIES FROM SELECT JURISDICTIONS IN ASIA, AFRICA AND LATIN AMERICA ......................... 73 BANGLADESH ............................................................ 73 CHILE ...................................................................... 74 INDIA ...................................................................... 77 X PATIENT PRIVACY IN A MOBILE WORLD – A FRAMEWORK TO ADDRESS PRIVACY ISSUES IN MOBILE HEALTH NIGERIA ................................................................... 78 PERU ...................................................................... 80 TANZANIA .................................................................81 UGANDA .................................................................. 82 WORKING TOWARD AN mHEALTH PRIVACY