Jamaicans are being urged to explore avenues to protect their health data as hackers, diplomats and pharmaceutical giants intensify efforts to benefit financially and politically from digitised medical records.
The warning comes as several African countries buckle under pressure from the Donald Trump administration to give the US access to their citizens medical data, in order to receive lifesaving aid. This new arrangement is a central feature of the Trump administration’s new America First Global Health Strategy that seeks to leverage the desperate need for medical treatments abroad.
Outraged, officials in Zambia, Zimbabwe and Ghana have so far rejected the requests. However, following closed door meetings, more than 30 countries have already signed the controversial agreement.
It is not known whether the Jamaican government is engaged in any bi-lateral talks about the sharing of the health data of citizens. However, the privacy of Jamaicans have been compromised in other ways. Earlier this month, there was a data breach which resulted in 2.9 terabytes of data at the National Health Fund (NHF) being hacked. The breach came to the attention of the government after the hacker group, Pear, listed the NHF on its leak site.
“This data is about medication and maybe who benefits from what kind of medication. It is confidential data; we don’t reveal our history of medication administration,” health minister Dr Christopher Tufton said during a post cabinet press briefing after the incident. He stated at the time that the cyber breach had been reported to the Office of Information Commissioner and the Major Organised Crime and Anti-Corruption Agency (MOCA).
According to the NHF data rights and protection information on its website, the organisation stores a wide variety of data on beneficiaries, including identity data, contact data, health records, benefits data and even the IP addresses, location and operating system and platform for those who browse its website.
Thirteen of Jamaica’s health facilities has an electronic health records (EHR) system, eCare. This was implemented under a US$148-million Health Systems Strengthening Programme (HSSP), which is jointly financed by the Government of Jamaica (US$87 Million), the Inter-American Development Bank (US$50 Million in loan) and the European Union (US$11 Million in grant funding).
US based epidemiologist and cyber security professional DeAnna Stephens noted that health data is valuable currency and is therefore in high demand. She said medical records provide a lot of details about an individual which are needed by data brokers and advertising agencies.
“It can be used in multiple crimes. Your medical records for example includes your name; it includes your address, it includes your insurance details, it includes diagnosis, prescription, and that data helps to support identity theft. So it’s hard now to say, ‘that really wasn’t me’. It can also lead to insurance fraud, it leads to extortion, it can even lead to blackmail. Health data especially is very attractive because it is richer in personal details than any other information. So if I was supposed to hack in a bank, the most I would get is your name, your address, and maybe how much money you have in your account, but health data have so much deeply personal, valuable information. Unlike a credit card number, which can be canceled, much of a medical record cannot be changed, and that’s very valuable. So stolen health data stays useful for a very long time, and criminals use it to impersonate patients; they use it also to file fraudulent claims, they use it to buy prescription drugs,” Stephens explained.
According to ProPublica, which is an independent, non-profit newsmedia, an analysis of some of the agreements signed between the Trump administration for the access to health data has several red flags. There is the risk that individuals’ personal data could be exposed, misused or commercialized without their consent.
“In the Ugandan data deal, the U.S. will get direct, real-time access to nine of the nation’s health data systems for seven years, including the central repository that stores all of its health information, lab data, data collected by community health workers and, critically, its system for managing individuals’ electronic medical records,” ProPublica reported.
In exchange for this data, the US government will provide Uganda with up to $1.7 billion over five years for global health security and the treatment and prevention of deadly conditions such as malaria, tuberculosis, HIV and polio.
The Nigerian government is already facing a lawsuit challenging the health cooperation agreement with the US. The lawsuit filed by a citizen was brought against the government in March of this year and raises concerns about data privacy, constitutional breaches and transparency. The defendants in the case include the President, the Attorney-General of the Federation, the Federal Ministry of Health and Social Welfare, the Senate President and the Speaker of the House of Representatives.
Caribbean targeted in secret data deal
The terms of a Memorandum of Understanding (MoU) for access to health data between the US and the Nigerian government signed in December, remains a secret. The MoU allegedly allows for the collection and transfer of sensitive health data of Nigerians to the United States government. The data could include medical records, blood samples, pathogen testing and genetic sequencing. The US government is to provide $2.1 billion in funding over five years, subject to annual approval by the US Congress. While the majority of countries that have signed on so far to the agreement are in Africa, Latin America and the Caribbean are also being targeted by the Trump Administration under its America First Global Health Strategy. Dominica Republic, El Salvador, Guatamala and Panama have already signed agreements, with a focus on disease surveillance.