Personal Data Protection Issues in the Realm of Telemedicine. Blockchain, Civil Liability and other Methods to Overcome Them.

Markov Boris ORCID: 0000-0003-4106-3828 Postgraduate student, Chair of Civil and Business Law, The All-Russian State University of Justice (RLA of the Ministry of Justice of Russia) 117638, Russia, Moscow, Azovskaya str., 2, building 1 yoursailorsun@outlook.com

The provision of medical care using telemedicine technologies is always associated with the transmission and processing of information in electronic form. Unlike other service industries, this information includes not only a limited list of frequently used personal data, but also information about the patient's health. This underlines the importance of comprehensive and effective protection of such information.

However, information subject to protection in accordance with the legislation is subject to significant risks, the effectiveness of which cannot be considered satisfactory. Thus, by the end of 2021, the fact of compromising about 80.5 million records of personal data and payment information was revealed, which is 20% more than in 2020 ^{[1, p. 6]}. According to the results of the first half of 2022, the situation deteriorated significantly: the number of leaks increased by 46% (305 against 209 in the first half of 2021), and the volume of compromised information showed an unprecedented growth of 1675% (187.6 million records against 11.2 million in the first half of 2021) ^{[2, p. 5]}. At the same time, it should be noted that in three cases out of four leaks occur as a result of "intentional violations of an internal nature", that is, through the fault of an employee or an official of the personal data operator ^{[2, p. 9]}. This may indicate significant gaps in the organization of work with protected data. This fact suggests that the reasons for the insecurity of information are primarily of an organizational and legal nature, and not technical. Database storage systems are obviously sufficiently protected or attempts to hack them are impractical due to the large labor and time costs, while imperfections in the organization of work with personal data and legal mechanisms of control and responsibility for violations in this area become a prerequisite for such massive leaks.

These issues are also very relevant for the healthcare sector, including telemedicine. So, in 2020, there was a leak of personal data of 300,000 Muscovites who were ill with the new coronavirus infection COVID-19, which was monitored using telemedicine technologies.

The above gives rise to scientific interest in studying the problems of legal regulation of personal data protection in telemedicine and determines the relevance of this work.

By personal data, Russian legislation means any information that relates directly or indirectly to a specific or identifiable individual ^{[3, Article 3]}, that is, the range of such information is unusually wide. At the same time, processing of personal data, as a general rule, is possible only with the consent of this person – the subject of personal data. Obtaining the patient's consent to the processing of personal data is a mandatory procedure carried out by medical organizations when providing telemedicine services. The content of the consent is established normatively. Consent to the processing of personal data contains the surname, first name, patronymic of the patient, his address, the number of the identity document, and many other data. There is a natural question about the expediency of including all this information in the consent. The essence of telemedicine services is to overcome geographical barriers, territorial remoteness of subjects, because the patient's address is information that has no meaning. Information about an identity document is sometimes called superfluous ^{[4, p. 76]}. However, the medical organization must receive this information in any case, even if the patient is unwilling to transmit this information, otherwise the processing of personal data will be impossible, and the telemedicine consultation will not take place. It seems that the best way to protect personal data is the absence of such data. Therefore, the form of consent to the processing of personal data should be flexible. Telemedicine subjects should be able to independently determine the composition of the information indicated in it. In this case, the medical organization will be able to assess the need to obtain them and not take on an additional burden in the absence of expediency.

In addition, in order to provide telemedicine services, it is necessary to identify and authenticate participants in the Unified Identification and Authentication System (ESIA) ^{[5, Article 36.2]}. How does this requirement affect the possibility of anonymous consultations? Although there is no ban on their implementation using telemedicine technologies, there are no exceptions for such cases in the norms of legislation, which is noted by the Ministry of Health of Russia ^[6]. This makes it impossible to provide remote anonymous consultations. It is necessary to use all possible mechanisms to increase the coverage of medical care among people who do not want to disclose their identity. Telemedicine could be an effective mechanism for solving this problem, however, this is not possible with the current strict regulation. In addition, it should be noted that not all patients have a confirmed account in the ESIA, which means that telemedicine consultation will become an inaccessible form of receiving medical care for them, for which the current regulation has been repeatedly criticized in the literature ^{[7, p. 757],[8, p. 32]}.

If the subject of personal data fears for their safety, does not trust the operator of personal data or for any other reason does not want the information about him to be processed by the operator, he should have the right to demand their destruction. The legislation on personal data provides the possibility of revoking consent to processing and contacting the operator with a request to terminate processing ^{[3, Articles 9, 21]}. However, the law stipulates a number of exceptions, one of which grants the operator of personal data the right to continue processing them despite the withdrawal of consent to processing, if it is carried out by a person professionally engaged in medical activities and obliged to maintain medical secrecy in order to provide medical care. That is, even if the patient withdraws the previously given consent to the processing of personal data and demands that they stop processing them, the medical organization that provided him with telemedicine services can continue processing them. The compliance of this norm with the Constitution was also confirmed by the Constitutional Court of the Russian Federation, pointing out that this provision of the law grants such a right to medical organizations only for the realization of the right of citizens to health protection and medical care, while ensuring the protection of these data by legal norms, including provisions on medical secrecy ^[9]. Given the existence of facts of leaks of personal data, it can be stated that there is not a sufficient level of data security. Therefore, we believe that the possibility to withdraw consent to the processing of personal data and demand the termination of their processing, including the destruction of this information, should be an inalienable right of the patient. In this regard, it is necessary to establish the procedure for terminating the processing of personal data by a medical organization upon receipt of a withdrawal of consent for processing from a patient. At the same time, for the purposes of medical statistics, it should be possible to delete not all information, including diagnosis and prescribed treatment, but only information about the patient, information that will allow identifying a specific individual (name, phone number, place of residence, etc.). For example, it is sometimes proposed to designate the patient with letters ^{[10, p. 37]}. Such depersonalization of information will allow to adequately protect the rights of the consumer of telemedicine services.

It is also necessary to touch upon the technical aspects of information protection. One of the most recently discussed ways to solve some problems in the field of data protection is the use of blockchain technology. Blockchain is a distributed database, which is a chain of connected blocks in which information is stored. Blockchain can be widely used in the field of e-health and telemedicine and solve the problem of insufficient data protection obtained, for example, as a result of data encryption ^{[11, p. 199]}. However, the regulation of blockchain in Russia is at an initial stage, it requires the development and adoption of the necessary norms, while a balanced regulation should be achieved, since excessive state intervention may interfere with the expansion of the use of this technology ^{[12, p. 91]}. At the same time, the use of blockchain in different sectors of the economy may have differences that require different approaches to regulation ^{[13, p. 66]}.

One of the most obvious uses of blockchain in the healthcare sector is electronic medical records. Thanks to its use, it is possible to ensure reliable storage and processing of any patient data, to organize a control system for the transmission of this data ^[14].

Blockchain can also be of great importance in the field of pharmaceuticals and telephony. Transparency of all stages of development, clinical research (which is of great importance for achieving the goals of evidence-based medicine), the production of medicines, their supply to pharmacy chains, the organization of electronic prescriptions and remote sale of prescription drugs provided by the blockchain will significantly increase the effectiveness of combating the production and sale of counterfeit medical products and other violations in this area ^[15]. As a result of amendments to the current legislation from March 1, 2023, remote sale of prescription drugs became possible in some regions of Russia as part of the experiment ^[16].

The influence of blockchain in such a component of telemedicine as remote monitoring of the patient's health can also be invaluable. Thanks to the use of this technology, it will be possible to optimize the system of remote collection of information about the patient's health status, simultaneous analysis of this information by several healthcare institutions and its reliable storage.

Thus, the use of blockchain technology will simplify the process of processing information, ensure a high level of its security, including from unauthorized access, ensure transparency and accountability ^{[17, p. 366]}. We believe that it is necessary to regulate in detail the possibility and necessity of using blockchain in the field of healthcare and telemedicine, and the legal literature emphasizes the need to regulate not only the relations within which the use of this technology is possible, but also the blockchain itself as an information storage technology ^[18]. One of the key problems may be the risk of recognizing each participant in the chain containing personal data as a personal data operator, which means that they will be subject to requirements corresponding to the status of a personal data operator, they will be forced to bear the obligations established by the legislation on personal data ^{[19, p. 114]}. We believe that the approach to regulation should be differentiated depending on the type of blockchain system. In the field of telemedicine, a centralized blockchain will obviously be widely used – the organization of a distributed registry within even one enterprise. In this case, the medical organization will be the operator of personal data. When building a decentralized system, specific rules must be applied, according to which a participant in the system will not be recognized as a data operator. Formally, each participant does store some part of personal data. But this part is not a sufficiently isolated component, having it, it is impossible to build specific information about a person (name, phone number, etc.), as well as to determine the individual to whom this information belongs. Therefore, the application of the current legislation on personal data (especially in their literal interpretation) to the participants of the blockchain system does not meet the interests of society and professional industry participants.

Another topical issue in the field of personal data protection is liability in case of failure to take sufficient measures to protect information and its leakage. The current legal regulation provides for a completely insignificant punishment for such violations – an administrative fine of up to 100,000 rubles ^{[20, Article 13.11]}. In the case of telemedicine, information that constitutes a medical secret may be leaked, which qualifies as a different offense. The punishment in this case can be twice as severe – an administrative fine of up to 200,000 rubles ^{[20, Article 13.14]}. It seems quite obvious that such a level of responsibility does not correspond to the public danger of these offenses and the severity of their consequences, does not encourage personal data operators to strengthen the information protection system, since paying such fines for the personal data operator will be less costly than creating a reliable system for their processing and protection. The ongoing discussions on the need to tighten administrative responsibility to date have not led to any result.

Meanwhile, it is important to note that there is also no elaborated array of legal norms on civil liability ^{[21, p. 71]}, and this problem does not attract wide enough attention. Although, in our opinion, it is civil liability that should be the key, since only it is aimed directly at restoring the violated rights of the patient - the subject of personal data. We believe that it is necessary to establish the presumption of guilt of the personal data operator in the leakage of information, to release the subject of personal data from proving the fact of harm caused to him as a result of compromising information about him, and perhaps even to set some minimum compensation limits in case of leakage of specific types of information. Special attention should be paid to information about the health of patients, the compromise of which can cause much more harm than the leakage of other information.

Thus, there are significant problems in the field of personal data protection in the field of telemedicine and digital healthcare. To solve them, it is necessary, on the one hand, to soften the legal regulation regarding the work with the patient's consent to the processing of personal data, to make it more flexible. This will avoid burdening the medical organization with additional responsibilities for protecting information that is not required for conducting telemedicine consultations, and also legalizes anonymous telemedicine consultations, increasing the level of accessibility of medical care. On the other hand, it is necessary to tighten the rules on the responsibility of personal data operators. Particular attention should be paid to civil liability, as it will best be able to ensure the restoration of the violated rights of the patient-the subject of personal data. In addition, the use of blockchain technology can provide significant assistance in overcoming the above-mentioned problems of personal data protection. However, this requires the development of legal norms regulating the possibility and procedure for its use, dividing blockchain systems into centralized and decentralized, imposing different requirements on them.