Surveilling Care, Protecting People: Legal Reforms for the Data-Driven Clinic

This study explores the concept and potential applications of healthcare big data, focusing on the legal and institutional challenges arising from the imperative to protect personal information. Healthcare big data holds transformative promise across multiple domains, including precision medicine, public health policymaking, and drug development, contributing to enhanced population health and medical innovation. However, ongoing legal tensions between data utilization and privacy protection persist, largely due to the sensitive nature of medical data and the inherent risk of re-identification.

This paper conducts a comparative legal analysis to examine the consistency of legal frameworks governing healthcare big data. It analyzes U.S. laws specifically, the Health Insurance Portability and Accountability Act (HIPAA) and the 21st Century Cures Act alongside corresponding Korean statutes, including the Medical Service Act and the Bioethics and Safety Act.

The comparative analysis identifies ongoing legal tensions between data utilization and privacy protection. These tensions arise from ambiguous definitions of pseudonymized and anonymized data, the limited flexibility of consent mechanisms for data subjects, and inconsistent de-identification standards. Additionally, although technology-based security safeguards are advancing, legal frameworks have not evolved at the same pace, resulting in regulatory gaps that hinder effective governance of healthcare big data.

This paper proposes several key reforms: refining the legal definitions of pseudonymized and anonymized data, introducing more flexible consent mechanisms for data subjects, enhancing de-identification standards, and strengthening technology-based security safeguards. The paper emphasizes the urgent need to reconcile conflicts and inconsistencies among these laws. For healthcare big data to serve as a trust-based public resource, a regulatory environment that ensures both robust privacy protections and the responsible use of data must be established.