Secondary Use of Health Data Under Consent Frameworks

Introduction

Secondary use of health data means using medical information for a purpose different from the purpose for which it was originally collected. For example, a hospital may collect patient records for diagnosis and treatment, while researchers later use those records for disease research, pharmaceutical development, public-health analysis, or training predictive models.

Consent frameworks regulate whether such later use is lawful and ethically acceptable. The central questions are whether the patient was informed about future uses, whether the new purpose is compatible with the original purpose, whether the data is identifiable, and whether a fresh consent or ethics committee approval is required.

In India, secondary health-data use is governed by privacy principles, medical confidentiality, research-ethics guidelines, and applicable data-protection law. Consent for treatment should not automatically be treated as unrestricted consent for every future research or commercial use.

Consent Models and Legal Conditions

ICMR’s National Ethical Guidelines recognize several consent models for stored health data:

Specific consent: Permission for a defined research purpose. A materially different later use may require fresh consent.

Broad consent: Permission for a range of future research uses, subject to stated limits and ethics review.

Tiered consent: Participants choose which categories of future research or data sharing they permit.

Dynamic consent: Participants can review or update permissions over time through an ongoing process.

Waiver of consent: An Ethics Committee may approve a waiver in limited circumstances, such as certain retrospective studies involving de-identified data, where obtaining consent is impracticable and the waiver is justified.

The Ethics Committee should examine the original consent, the proposed new purpose, identifiability, risks, and data-security measures. An ethics waiver is not a blanket authorization for unrestricted commercial exploitation.

ncdirindia.org+2

Case Laws

1. Justice K.S. Puttaswamy (Retd.) v. Union of India (2017) 10 SCC 1

The Supreme Court recognized privacy as a fundamental right under Article 21, including informational privacy and personal autonomy. It emphasized that medical information attracts a strong expectation of privacy and that data-protection frameworks must balance individual interests with legitimate purposes such as innovation and public welfare. This case provides the constitutional foundation for protecting health data in secondary research.

Indian Kanoon+1

2. Samira Kohli v. Dr. Prabha Manchanda (2008) 2 SCC 1

The Supreme Court held that consent must be voluntary, informed, and related to the procedure proposed. Although the case concerned medical treatment, its reasoning is relevant to secondary data use: consent for diagnosis or treatment cannot automatically be interpreted as consent for a materially different research purpose. The judgment is an analogous authority, not a direct ruling on health-data reuse.

Indian Kanoon

3. Anivar A. Aravind v. Union of India (Karnataka High Court, 2021)

In proceedings concerning the Aarogya Setu application, the Karnataka High Court made interim observations that sharing users’ health-related response data without informed consent could infringe Article 21 privacy rights. The Court questioned whether users had been properly informed about data sharing and whether claimed anonymization had been independently tested. This case is particularly relevant to secondary use of health data for research or other purposes. The observations were interim findings, not a final general rule governing every form of anonymized data use.

Live Law

Conclusion

Secondary use of health data must be assessed through the original consent, the new purpose, the identifiability of the data, and the risks to participants. Broad or tiered consent may support future research within the authorized scope; specific consent may require renewal when the proposed use materially changes. Ethics Committees can consider waivers in limited, justified cases, especially for appropriately de-identified retrospective data.

India’s DPDP Act, 2023 establishes a framework for lawful processing of digital personal data, including consent requirements, but its provisions have staggered commencement dates under the 2025 notification. The operative provisions must therefore be checked for the date and circumstances of the proposed processing.

India Code+2

In conclusion, secondary health-data use is not automatically prohibited, but neither is it unrestricted. The governing principles are informed consent, purpose limitation, privacy, independent ethics review, and proportionate safeguards. These principles enable valuable health research while preserving individual autonomy and trust.