NDPR 2019 Lacks Specific Health Data Provisions

NIGERIA DATA PROTECTION REGULATION 2019 · NIGERIA DATA PROTECTION REGULATION

HIE can therefore represent a wide array of electronic data sharing – ranging from sending flat PDF files via secure email to semantic interoperability, where standardized, structured, machine-readable data elements are transferred and integrated directly into the receiving organization’s EHR without manual intervention [ 10 , 11 ]. HIE can be a “push”, where a health system or provider sends patient data to another provider during a transition of care, or a “pull”, where the receiving system queries for any patient data available from other providers.

IV, S. 17(2)] where the core provisions of the Act, including penalties for breaches, may not apply. Thus, there are different standards of accountability for similar events. We provide a few examples to illustrate the quandaries that clinicians may face. At the risk of seeming presumptuous, we offer suggestions for the implementation of the DPDPA. The suggestions acknowledge the importance of data protection while addressing the practical realities of healthcare delivery in different settings.

GDPR also recognizes special categories of personal data and provides derogation “for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services” under clause (h) of paragraph 2 of article 9.

Reporting measures for exchanging data with public health agencies has been established at the national level for Promoting Interoperability and the Quality Payment Program. * Urgent care providers will report under Syndromic Surveillance. Non-urgent care providers may claim Syndromic Surveillance Reporting as a public health registry option. The on-boarding processes are identical. ** Under new changes in 2019, the Public Health Reporting Measures are combined with the Clinical Data Registry.

We propose that payers in CMS programs be able to participate in a trusted exchange network which would allow them to join any health information network they choose and be able to participate in nationwide exchange of data. This would enable the information to flow securely and privately between plans and providers throughout the healthcare system. We propose requiring MA organizations (including MA-PD plans), Medicaid managed care plans, CHIP managed care entities, and QHP issuers in the FFEs to participate in trust networks to improve interoperability.

In this sense, the Act also empowers the Commission to “designate categories of personal data that are subject to additional specified restrictions on transfer to another country.” This designation would be based on “the nature” of such personal data and on “risks” to data subjects. This provision opens the door to potential future data localization requirements for specific categories of personal data. 8. Enforcement: Legal Foundation for the Nigeria Data Protection Bureau, Creation of a Governing Council and Expected Regulations

There are no specific provisions in the NDPA for employee monitoring. The NDPA, however, applies to any kind of transaction in which the processing of the Personal Data of Nigerian residents is carried out.