Moe Miura
The following is a translation of a Japanese article by Public Affairs Team at Ubie AI Lab.
What is the Next-Generation Medical Infrastructure Act?
The recent cabinet decision involves an amendment, which means there’s an existing law. Let me introduce that first.
The law’s official name is the "Act on Anonymous Medical Information for Promoting Research and Development in the Medical Field." It focuses on creating a framework for using anonymized medical information for research and development.
Medical institutions and local authorities have patients' medical information, including not only basic personal details but also a significant amount of "sensitive personal information," or "personal health information," such as medical history, prescription records, test results, and diagnostic information.
As per the Personal Information Protection Law, sensitive personal information requires the individual's consent to disclose it to third parties. Therefore, in the past, healthcare institutions and local authorities couldn't utilize patients' information, even if they had it.
Hence, the Next-Generation Medical Infrastructure Act was established as a special provision under the Personal Information Protection Law, intending to allow the utilization of medical information under a legal framework without needing patients' consent.
Specifically, it permits using medical information for research and development after anonymizing it, with the crucial element being the "anonymization" process.
The "Anonymous Processed Medical Information" defined in this Act is similar to what the Personal Information Protection Act refers to as "anonymously processed information." The requirement is to process the original data, which is medical information, by removing personal and related data so that the information source can't be reconstructed.
Once it's anonymized, it becomes impossible to identify the original information owner (individual), so it can be freely used for research and development.
However, the entities responsible for anonymizing medical information will be handling sensitive information, including personal data. Thus, only entities that meet the government's strict criteria are allowed to do this. These certified entities are known as "Certified Anonymous Processed Medical Information Creation Operators."
For simplicity, I'll refer to them as "AnonMed Operators" (note: this isn't the official abbreviation).
Becoming a trusted third-party organization in Japan includes various requirements, such as appointing a responsible party, establishing medium to long-term plans, and implementing an effective review system, among other things.
Details are available in the guidelines provided by the government. However, becoming a trusted third-party organization can be challenging for most companies.
In fact, only three entities, which are incorporated associations or public interest corporations, have been certified as trusted third-party organizations. These certified entities are responsible for safely processing and utilizing patient data.
Reference. Cabinet Office Health and Medical Strategy Promotion Office Document Posted on October 2022
Purpose of the Recent Amendment
So far, we've been discussing the current regulations. The question is, what changes with the upcoming amendment?
In a nutshell, what's changing is that previously, only usable data in an anonymized form can now be used in a pseudonymized form. In other words, the processing requirements are being relaxed.
This is quite revolutionary!
As mentioned earlier, the requirements for anonymized data involve ensuring that “it is impossible to reverse the information back to its source.” This has required various measures, such as aggregating ages into age groups, removing potentially identifiable information that could be considered edge cases, and eliminating any information that might lead to identifying individuals when cross-referenced with other data.
On the other hand, pseudonymized information is defined as "individual information that has been processed in a way that, without cross-referencing with other information, cannot identify specific individuals." This means that, as long as the data is not cross-referenced with other information, you don't need to be concerned about the ability to identify individuals from the data on its own.
In essence, while the data still cannot identify individuals, it can be handled as more specific and concrete case data, enhancing its value as a foundational resource for research and development.
By the way, the name of the law is also expected to be changed to "Law on Anonymized and Pseudonymized Medical Information for Research and Development in the Medical Field" to reflect these amendments.
For those of you who have read this far and are thinking, "Wait, does this mean my medical information will be circulated as is?" please rest assured. Various provisions have been added to ensure the safe utilization of pseudonymized medical information.
There are two key aspects to ensure the safe utilization of pseudonymized medical information.
First, similar to trusted third-party organizations for anonymized data, businesses that create pseudonymized medical information must obtain certification based on stringent national standards ("Certified Pseudonymized Medical Information Creation Businesses").
Secondly, pseudonymized medical information has less stringent processing requirements than anonymized data. Unlike businesses handling anonymized medical information, entities looking to utilize this data must also obtain national certification. These certified users are referred to as "Certified Utilization Businesses."
The requirements for Certified Utilization Businesses are yet to be outlined, as they will be defined in ministerial ordinances. However, it is expected that measures such as the prohibition of re-identification and penalties for unauthorized use will be applied to ensure the safe utilization of data.
Furthermore, while third-party provision of pseudonymized information is generally prohibited under the Personal Information Protection Act, the Next Generation Medical Infrastructure Act includes a particular requirement. It allows for the provision of pseudonymized medical information, limited to transfers from Certified Pseudonymized Medical Information Creation Businesses to Certified Utilization Businesses.
Conclusion
We researched the Next-Generation Medical Infrastructure Law in Japan this time, but the Japanese government is also advancing various initiatives for collecting and utilizing medical data.
Medical digitallization is indeed at a pivotal stage and is an industry full of potential for significant growth in the future.
Riding the waves of such regulations and market conditions, I am genuinely stimulated and delighted to think about how we can effectively contribute to people's health in our daily work.
In the future, we at Ubie will continue investigating and sharing various topics related to the healthcare industry and medical digitalization.
About Ubie's AI Symptom Checker:
US Version: https://ubiehealth.com
Japanese Version: https://ubie.app
Ubie's AI Symptom Checker enables users to easily access healthcare information and find appropriate healthcare providers. Available in both Japanese and English, it supports users in identifying symptoms and connecting with the right healthcare providers.
About Ubie:
Ubie, Inc., established in 2017, is at the forefront of the digital health revolution. As an innovative startup, Ubie harnesses the power of artificial intelligence to seamlessly navigate individuals towards appropriate healthcare services. Our mission is rooted in the belief that everyone, regardless of location or circumstance, deserves access to comprehensive healthcare. We are committed to transforming this vision into reality by creating a more accessible and user-friendly healthcare experience.
Our global presence is anchored at our headquarters in Tokyo, Japan, situated at the heart of Nihonbashi-Horidomecho, and our U.S. headquarters in the bustling hub of New York City. These strategic locations enable us to cultivate and expand our impact on the healthcare industry worldwide.
U.S. Headquarters:
1460 Broadway, New York, NY 10036
Japan Headquarters:
6th Floor, Nihonbashi-Horidomecho 2-chome Bldg.
2-4-3, Horidomecho, Nihonbashi, Chuo-ku, Tokyo, 103-0012
Inception:
May 2017 - Japan Operations
October 2022 - U.S. Operations
Leadership:
Co-founders, Kota Kubo and Dr. Yoshinori Abe, spearhead our ambitious journey with a shared dedication to enhancing healthcare accessibility through innovative solutions.
Discover more about our vision and endeavors at: https://ubiehealth.com/company
Disclaimer: Please be advised that Ubie's AI Symptom Checker is intended solely for informational purposes and does not constitute a substitute for professional medical diagnosis, advice, or a treatment plan. Users should always seek the advice of qualified health professionals regarding any medical conditions or treatment decisions.
Author
Moe Miura
Public Affairs Lead, Ubie AI Lab
Moe is the leader of the Public Affairs Team at Ubie AI Lab. After a stint at the Ministry of Internal Affairs and Communications, where she was involved in overseeing Japan's telecommunications industry and other related areas, she has been focusing on Public Affairs at Ubie since 2021.