Costa Rica

Universal health data in Costa Rica: The potential for surveillance from a human rights perspective

Introduction

In May and June 2014, the guild for primary and secondary teachers in Costa Rica embarked on a lengthy strike over errors in the payment of their wages – the result of problems in the management of their personal data. The strike led to a lot of restlessness over the management of public computer systems in general, and showed the social, economic and political consequences of technological applications. National interest in the administration of personal data in public information systems such as health records grew.

Since the mid-20th century, Costa Rica has had a universal health care system based on a citizen partnership (or solidarity) model. In terms of data, every citizen of the country has a record containing their personal and health information. To date, most of these files are still paper-based, so that every time a patient is seen in consultation by the Costa Rican Social Security System (CCSS), the doctor should have a physical folder that includes all of the patient’s medical history.

It is easy to imagine the consequences that the manual handling of this information can generate in terms of errors, delays, loss of data and incomplete test results. Because of this, there has been an increase in legal actions brought before the Constitutional Court by Costa Ricans claiming that their right to health has been compromised. Addressing this issue is particularly important in a national context where there is strong pressure for privatisation.

Looking for a comprehensive and long-term solution, the Constitutional Court issued a ruling directing the CCSS to solve this problem by issuing a single electronic health record (EDUS) in 2012. This decision is supported by a bill passed by the Legislative Assembly in 2013, where the project has been declared a national project, and a period of five years given for its development. EDUS is described in the bill as follows:

The Single Electronic Health Record is the repository of patient data in digital form, stored and exchanged securely, and that can be accessed by multiple authorised users. It contains retrospective, current and prospective information and its main purpose is to support the efficiency, quality and integrity of health care. ¹

Due to the universal nature of the Costa Rican health care system, we can say that when EDUS is implemented it will be a national treasure of information and useful data for decision making in public health. It will help to improve the efficiency of the service, and support transparency, accountability and citizen oversight. However, EDUS may also be of high value to multiple interests outside the public health care system, such as private medical enterprises, insurers, employers, pension operators, banks, security agencies, advertising companies, the police and the judiciary, among others. Therefore, the implementation of EDUS by the CCSS is undoubtedly an important step towards strengthening the right to health among the Costa Rican population, but also represents a major national challenge in terms of the potential of this information for citizen surveillance, where the security and privacy of personal data are compromised.

Although pilots of some parts of the project² have started already, EDUS is still in the design and development phase. This is the right time to generate a national discussion – which has not happened – about what the electronic records may represent when it comes to public surveillance. With this purpose in mind, discussions have been held with national stakeholders: civil society, academia, lawyers, doctors, system designers and the CCSS. They have different perspectives on the issue, which are reflected in this report.

A human rights approach

This report focuses on citizen surveillance from a human rights perspective. It is considered a citizen's right to know how our data is managed, what information is generated from it, and for whom. Given this approach, it is crucial that Costa Ricans participate in defining how the health record is built, which data will be available in the digital files, who will have access to what data, what policies and procedures are governing the privacy and security of the information, and how to ensure that this information will not be used for surveillance and other private purposes. It is also necessary to define the mechanisms of public oversight to ensure processes and agreements on the management of the information are implemented properly.

With the understanding that this is a highly technical process, both from the information technology perspective and from a medical point of view, citizen participation in building EDUS has been absent so far. The process has been defined as a specialised health and computing process, not as a process that has to do with citizen information.

The analysis of EDUS must be performed from different perspectives, which are interrelated and indivisible:

From the perspective of the right to health

As indicated in the bill, the implementation of EDUS is an essential condition to improve the exercise of the right to health in Costa Rica:

The application of this technology in the CCSS aims to reduce waiting lists in health care services, improve the quality of care and eliminate duplication of administrative procedures related to the data of the insured…

The current fragmentation of health data can be solved through the standardisation and integration of information resulting from the integration of programming languages, technology platforms and operating costs in a single system. ³

From discussions with stakeholders, several important challenges have been identified:

• There is a great risk in seeing EDUS as the magic solution to the fundamental problems of the CCSS. But as noted by the Comptroller General of the Republic, following the implementation of the information system, a complete reorganisation of the institution must be undertaken, so that this public investment does not become an unnecessary expense.

• There is resistance to change by a large group of health care workers in general and doctors in particular, who consider EDUS a system that can be used to control their performance.

• Cost and time represent a major risk to project success. Some of those consulted feel that there is a lack of good analysis of what this means now, and what it will mean in the future for CCSS, and raise concerns that EDUS may unbalance CCSS’s budget if a good projection is not made.

• The success of EDUS will be determined by other national issues that are not under the control of the CCSS, such as access to the internet throughout the country.

• The need to think about other models where the electronic health record is administered by each citizen (as with personal bank accounts) has been proposed.

From the perspective of citizen oversight of the health care system

Having a system such as EDUS would have a high value for the control and supervision of health services, as well as accountability and transparency in the provision of universal service. A condition for this to be possible is to have accessible, updated and available information to enable citizens to learn, evaluate and propose actions to strengthen the universal health care system.

At present there is no information on the functioning of the health care system available for public examination. Those interested in exercising this role as citizens must look at various files (often with little information), request authorisation to access public information, and learn to analyse complex and disconnected data.

Until now, the development process of EDUS has not referred to the integration of information modules that allow citizen oversight. Civil society has not developed or proposed actions in this regard and seems to be unaware of the positive impact this can have on universal service and citizen surveillance.

From the perspective of citizen surveillance

In terms of citizen surveillance, it is important to mention that when the EDUS bill was discussed, the Commission on Technical Affairs of the Legislative Assembly addressed the confidentiality of data for the first time as a human rights issue that must be regulated. It indicated that the technological solution chosen for the creation of the records should have certain characteristics, including security: “The electronic record and the software solutions that interact with it must meet the criteria established for this purpose in the scientific, ethical and administrative technology field, in order to ensure integrity, confidentiality and availability in the use, management, storage, maintenance and ownership of the data included in the clinical record.” ⁴

However, in conversations for the preparation of this report, the issue of data security from the point of view of system functionality (user profiles related to access rights, for example) was emphasised, instead of the issue of citizen surveillance, which is not seen as an important issue in the development of EDUS. Nevertheless, you can think of citizen surveillance from two angles:

• The provision of health data for surveillance from the private sector, whose interests are very diverse, ranging from strengthening the private health schemes that compete with universal public service, to designing advertising campaigns for specific target audiences.

• The availability of health data for surveillance by the state, whose current and future interests may also be very different, starting with public safety to the repression of social and popular movements.

The information in the health record belongs by law to the CCSS. Currently the EDUS process involves developers, database administrators (responsible for the "data centre"), support staff and health personnel who have access to different groups of data, which are handled in line with confidentiality clauses. The policies or regulations that will constitute the legal framework for the management and protection of the health records are not yet defined. The existing regulatory framework dates from 1999 and corresponds to physical files. While there is a very good law for data protection in Costa Rica, its regulations and implementation remain weak.

According to the stakeholders interviewed for this report, in the CCSS there are multiple visions of what should be done in terms of the development of information and communications technologies (ICTs), as well as computer systems, including EDUS. A discussed and shared policy, updated in the light of major issues such as the governance of health technologies, citizen surveillance, open government, security and data privacy, and the use of cloud technology, among many other urgent technological considerations, is not available.

MONOCROMO, AQUÍ SE EMPIEZA A HABLAR DE LA TABLA

Discussions with stakeholders show that addressing citizen surveillance has not been a priority in the development of EDUS up until now. This is compounded by the lack of understanding of the topic and the risks entailed at the technical and political levels. It is possible that the issue of surveillance might not be a priority, because it is not visible.

One can tell that the development of EDUS is caught between two forces: On the one hand the political pressure and the mandates of the Constitutional Court, the Legislative Assembly and the Comptroller General's Office in terms of the right to health; and on the other hand, the need for clearly defined policies, the strengthening of knowledge and skills, and citizen participation to address the system from perspectives that go beyond the technical aspects of computing.

Action steps

To address the issue of citizen surveillance in Costa Rica, the following steps are proposed:

• Continue the discussion with academia, the CCSS, civil society and other stakeholders to strengthen understanding of the topic of citizen surveillance in Costa Rica, specifically in the case of EDUS.

• Civil society should participate in forums where the issue is being addressed (CCSS, the legislature, the Medical Association and the Bar Association, among others).

• Raise awareness in community health committees and associations on the subject of health information systems.

• Create opportunities for citizen participation in the design, development and implementation of EDUS so that it is not perceived as a technical issue but as a matter dealing with the right to information.

• Strengthen the training of staff in the judiciary, the CCSS and the legislature on issues such as citizen surveillance, security and data privacy.

• Strengthen the technical capacity of health staff on the development of public information systems and the importance of managing privacy and data security, as well as the risk of citizen surveillance.

Table 1

Summary of discussions on EDUS with key stakeholders

	Right to health	Citizen surveillance
Progress	Greater control and monitoring of the provision of health care services Greater efficiency in health care services Would strengthen universal service Facilitates the prioritisation of care according to health conditions	There is a good data protection law Favours an analysis of the health care system for decision making Facilitates accountability and transparency Allows greater control and oversight by citizens It is an opportunity to have an open database available to the public
Risks	Information should belong to the people, not the health care system. To ensure universality it is essential that all citizens have equal access to their electronic records, no matter where they are geographically. Doctors are seeing electronic records as a way to control their performance. There is resistance to change. The financial cost of the project is very high and the state does not have the resources to develop it. It also has associated long-term costs that are not contemplated. Implementation time is very short for the complete system. Need for thorough reorganisation of CCSS. Technological solution is seen as the magic solution.	Regulation: Despite the good data protection law, the regulations and accompanying implementation at national level are weak. Technology policies, agreements and conditions for the safeguarding of health data are unclear. There is no specific legal framework for health records. Internal process: There are different views within the CCSS on what to do in terms of technological development in general, and specifically when it comes to EDUS. There is a need to update staff at CCSS on the governance of health technologies, security and data privacy, open government and citizen surveillance. Development process: The CCSS, which oversees the implementation of EDUS, has emphasised the functional aspect of the system rather than the security and privacy of data and the potential of citizens monitoring the data. Civil society, health actors and decision makers are not informed about the development process of EDUS, nor have they discussed aspects of security, privacy and surveillance in these instances.

Source: Prepared by the authors.

References

1 Opinion prepared by the Commission on Science, Technology and Education of the Legislative Assembly (2010-2014), July 2011.

2 Mainly at the primary care level (according to the proposed plan). See: portal.ccss.sa.cr/EDUS_WEB/edus/EDUS.html

3 Affirmative opinion prepared by the Commission on Science, Technology and Education of the Legislative Assembly (2010-2014), July 2011.

4 Replacement text for Article 5 of the bill, proposed by the Committee on Technical Issues of the Legislative Assembly, 2012.