“...a person’s private and personal life, honor, and image are inviolable, and he/she is entitled to compensation for any material or moral damage resulting from the violation thereof” (Brazilian Federal Constitution, 1988, art. 5, item X).

Healthcare data privacy is an urgent contemporary issue, and there are few studies on privacy in healthcare practices that use information and communication technologies (ICTs). Such privacy is a fundamental right based on the constitutional principle of personal dignity, which is still not universally acknowledged ¹1. Moraes IHS. Prefácio. In: Keinert TMM, Sarti FM, Cortizo CT, Paula SHB, organizadores. Proteção à privacidade e acesso às informações em saúde: tecnologias, direitos e ética. São Paulo: Instituto de Saúde; 2015. p. 9-20.^,22. Sarlet IW. Dignidade da pessoa humana e direitos fundamentais na Constituição Federal de 1988. 9ª Ed. Porto Alegre: Livraria do Advogado Editora; 2015..

Our point of departure is that we now live in the Information Society, based on the extensive development of ICTs, with exponential growth in the speed and amount of digitized personal data whose privacy is not always sufficiently protected ³3. Machlup F. The production and distribution of knowledge in the United States. Princenton: Princenton University Press; 1962..

We also assume the existence of a Risk Society in which scientific and technological development often escapes prediction and control, with serious consequences for human health ⁴4. Beck U. Sociedade de risco. Rumo a uma outra modernidade. 2ª Ed. São Paulo: Editora 34; 2011..

Paradoxically, in the context of the discussion on privacy, these same technologies foster the expansion and emergence of new experiences and practices in the exercise of citizenship. ICTs provide possibilities for social innovation through communication networks and the creation of cyberspace and cyberculture ⁵5. Castells M. A galáxia da internet: reflexões sobre a internet, os negócios e a sociedade. Rio de Janeiro: Zahar Editora; 2003.^,66. Lèvy P. Cibercultura. 3ª Ed. São Paulo: Editora 34; 2010..

However, privacy is seriously threatened by the so-called Surveillance Society, based on computational mediation through data mining, marketing, and oversight mechanisms that effectively eliminate people’s control over their own data. Surveillance capitalism threatens democratic norms, since governments and private companies take growing interest in gaining access to people’s data, with obvious repercussions on privacy ⁷7. Rodotá S. A vida na sociedade da vigilância: a privacidade hoje. Rio de Janeiro: Renovar; 2008.^,88. Zuboff S. Big other: surveillance capitalism and the prospects of an information civilization. Journal of Information Technology 2015; 30:75-89..

The data privacy issue has three major dimensions in this context that are subject to analysis: legal, political-cultural, and technological. In the legal dimension, the world has witnessed the need to innovate and consolidate laws and rulings into an appropriate and systemic body of legislation. As for the technological dimension, we highlight the need to increase data security with the acquisition of operational systems, database managers, the development of safe software, and data anonymization. The political-cultural or behavioral dimension highlights the fundamental importance of technical, technological, political, and ethical capacity-building for healthcare service providers, policymakers, professionals, and users ²2. Sarlet IW. Dignidade da pessoa humana e direitos fundamentais na Constituição Federal de 1988. 9ª Ed. Porto Alegre: Livraria do Advogado Editora; 2015.^,99. Moraes IHS, Gómez MNG. Informação e informática em saúde: caleidoscópio contemporâneo da saúde. Ciênc Saúde Coletiva 2007; 12:553-65.^,1010. Doneda D. Da privacidade à proteção dos dados pessoais. Rio de Janeiro: Renovar; 2006.^,1111. Kameda K. e-saúde e desafios à proteção da privacidade no Brasil. https://www.politics.org.br/sites/default/files/downloads/poliTICs_16.pdf (acessado em 05/Abr/2017).
https://www.politics.org.br/sites/defaul... .

Legal protection means guaranteeing the fundamental right to privacy based on the constitutional principle of human dignity. The prevention of total or partial leaking of information on people’s health neutralizes its power to discriminate against individuals ²2. Sarlet IW. Dignidade da pessoa humana e direitos fundamentais na Constituição Federal de 1988. 9ª Ed. Porto Alegre: Livraria do Advogado Editora; 2015.^,1212. Sarlet IW, Keinert TMM. O direito fundamental à privacidade e as informações em saúde: alguns desafios. In: Keinert TMM, Sarti FM, Cortizo CT, Paula SHB, organizadores. Proteção à privacidade e acesso às informações em saúde: tecnologias, direitos e ética. São Paulo: Instituto de Saúde; 2015. p. 113-45.. In 2005, the U.N. Special Rapporteur on the right to the highest attainable standard of health, in proposing a “legal analysis of the right to health”, called attention to the need for non-discrimination, equality, and protection of certain vulnerable groups, for example, persons with HIV or mental disabilities ¹³13. Naciones Unidas. Los derechos economicos, sociales y culturales. Informe del Relator Especial sobre el derecho de toda persona al disfrute del más alto nivel posible de salud física y mental, Sr. Paul Hunt. http://daccess-ods.un.org/access.nsf/Get?Open&DS=E/CN.4/2005/51&Lang=S.
http://daccess-ods.un.org/access.nsf/Get... .

The use of ICTs to mediate healthcare is called e-health. The term has been adopted by the World Health Organization (WHO) and applies patient care, research, workforce education and training, and healthcare monitoring and assessment. More specifically in Brazil, e-health processes include the National Health Card implemented in the Brazilian Unified National Health System (SUS), with teleconsultations, telediagnosis, second opinions, telesurgery, telemonitoring, remote surveillance, continuing education, distance education, and electronic patient files ¹¹11. Kameda K. e-saúde e desafios à proteção da privacidade no Brasil. https://www.politics.org.br/sites/default/files/downloads/poliTICs_16.pdf (acessado em 05/Abr/2017).
https://www.politics.org.br/sites/defaul... .

An extension of the physical body exists today, made of the personal data that circulate virtually, constituting a kind of “avatar” or “e-body”. Patients’ tutorship over their own “virtual personhood” should thus be extended as a logical spinoff of the principle of human dignity ⁷7. Rodotá S. A vida na sociedade da vigilância: a privacidade hoje. Rio de Janeiro: Renovar; 2008..

E-citizenship involves the right to self-determination in the use of one’s data, which belong to the person and not to the institutions that collect such data. Personal data are those in which the object of the information is the personal himself/herself, and where sensitive data are defined as those which, if disclosed, can discriminate against or cause harm to the individual or even society. Healthcare data are one type of such sensitive data ¹1. Moraes IHS. Prefácio. In: Keinert TMM, Sarti FM, Cortizo CT, Paula SHB, organizadores. Proteção à privacidade e acesso às informações em saúde: tecnologias, direitos e ética. São Paulo: Instituto de Saúde; 2015. p. 9-20.^,22. Sarlet IW. Dignidade da pessoa humana e direitos fundamentais na Constituição Federal de 1988. 9ª Ed. Porto Alegre: Livraria do Advogado Editora; 2015.^,77. Rodotá S. A vida na sociedade da vigilância: a privacidade hoje. Rio de Janeiro: Renovar; 2008.^,1010. Doneda D. Da privacidade à proteção dos dados pessoais. Rio de Janeiro: Renovar; 2006.^,1111. Kameda K. e-saúde e desafios à proteção da privacidade no Brasil. https://www.politics.org.br/sites/default/files/downloads/poliTICs_16.pdf (acessado em 05/Abr/2017).
https://www.politics.org.br/sites/defaul... .

In the private sector, the Brazilian National Supplementary Healthcare Agency (ANS) has set a mandatory standard for data exchange between health plan operators and service providers, called the TISS Standard (the acronym in Portuguese for Supplementary Healthcare Data Exchange). One of its components is data security and privacy, defining the requirements for data protection.

In SUS, at the 14th National Health Conference (CNS, 2012), the issues of healthcare data privacy, secrecy, and confidentiality were still not covered under Guideline no. 12, aimed at establishing a national information and communication policy.

The National Health Plan for 2016-2019, approved by the National Health Council, backs the promotion of measures to ensure the preservation of ethical issues, privacy, and confidentiality in all stages of information processing.

The National Policy on Healthcare Data and Information Technology (PNIIS, 2016) established some key principles aimed at ensuring the confidentiality, secrecy, and privacy of personal healthcare data as a universal individual right.

Based on the above, we conclude that there are still gaps in the safeguards for healthcare data confidentiality. However, there are initiatives under way to consolidate the legislation, develop more secure technologies, implement courses in professional ethics, and expand social participation in this process.

However, Brazil still lacks specific legislation to protect personal data. There is a bill of law under review that sets specific standards for sensitive data. We highlight the importance of the “Precautionary Principle”, which establishes the reversal of burden of proof: i.e., in practice any act which may cause individual or collective harm should be backed by proof. In the United States, for example, the Health Insurance Portability and Accountability Act aims to protect all personal data used in healthcare services provision.

The technological dimension involves the adoption of strong cryptography and inspected, approved, and spyware-free central switching and routing, aimed at increasing healthcare data’s transparency and security. The use of open-access software further contributes to increasing the governance of source codes used in the software used for healthcare data processing ¹⁴14. Cortizo CT. Sistemas de informática e informação da atenção básica do Sistema Único de Saúde e o software livre: possibilidades e perspectivas [Dissertação de Mestrado]. São Paulo: Faculdade de Saúde Pública, Universidade de São Paulo; 2007..

It is also necessary to invest in ethical, technical, and technological training and specific professional legislation on fundamental human rights. Greater expansion of social participation and continuing education can strengthen the urgent responses to the issues addressed here ¹⁵15. Moraes IHS. Política, tecnologia e informação em saúde: a utopia da emancipação. Salvador: Casa da Qualidade Editora; 2002..

To prevent undue access to personal data requires a policy for the administration of such information in order to avoid their careless handling (facilitated by public disclosure, whether accidental or intentional). In Italy, for example, there is a personal data protection authority called “Garante”. In Brazil, it is necessary to create a regulatory body with the characteristics of an independent agency and participation by civil society ⁷7. Rodotá S. A vida na sociedade da vigilância: a privacidade hoje. Rio de Janeiro: Renovar; 2008.^,1010. Doneda D. Da privacidade à proteção dos dados pessoais. Rio de Janeiro: Renovar; 2006.^,1111. Kameda K. e-saúde e desafios à proteção da privacidade no Brasil. https://www.politics.org.br/sites/default/files/downloads/poliTICs_16.pdf (acessado em 05/Abr/2017).
https://www.politics.org.br/sites/defaul... .

The discussion further highlights the importance of free and informed consent in studies involving human subjects, as well as the elaboration of specific protocols to protect the privacy of healthcare users ¹²12. Sarlet IW, Keinert TMM. O direito fundamental à privacidade e as informações em saúde: alguns desafios. In: Keinert TMM, Sarti FM, Cortizo CT, Paula SHB, organizadores. Proteção à privacidade e acesso às informações em saúde: tecnologias, direitos e ética. São Paulo: Instituto de Saúde; 2015. p. 113-45..

Publication Dates

History