I. Introduction
Medical treatment approaches are increasingly data-driven, utilizing a variety of medical data collected from individual patients through diverse tests, medical examinations, and history-taking. Data-driven care not only facilitates precise treatment, but also increases the survival rate and improves quality of life by enabling the early prediction of diseases [1,2]. In medicine, the term “data” typically refers to information generated during an individual’s medical treatment, including medical and nursing records, diagnoses, test names and results, medication usage, surgical procedures, and imaging and genomic information [3]. Historically, the scope of medical data was confined to data obtained through treatment within medical institutions. However, there has been a significant expansion in their scope recently, driven by increased societal interest in health, a greater understanding of health issues, and the advent of concepts such as smart healthcare [4]. Medical data now include not only traditional records of specific disease treatments and changes in medical institutions but also personal health-related data such as food photo logs, vital signs, and daily step counts. This shift has been characterized by the innovative use of medical data, leading to improvements in the quality and efficiency of medical services, the implementation of patient-centered care, and an effective response to the rising number of patients with chronic diseases in an aging society. In summary, while medical data in the past were primarily generated through direct patient-doctor interactions in hospitals, they now broadly encompass all health-related data [5].
In addition, the growing role of advanced digital technology and regular preventive healthcare based on personal medical data is evident. Consequently, interest in the use of personal health information is on the rise [6]. With the introduction of MyData, a concept that consolidates scattered personal information into a single system managed by the data provider, individuals can now actively utilize and share their personal information with desired services [5]. This approach, when applied to healthcare, is referred to as medical MyData.
In today’s society, it is rare for individuals to receive medical services from only one institution throughout their lives. If an individual’s medical history can be tracked without the constraints of physical location and time, it becomes feasible to provide accurate, personalized treatments and more convenient medical service delivery [7]. The right to self-determine medical MyData ensures that individuals, as data providers, have the authority to make decisions about their data. This right allows for medical data derived from an individual to be made available in a usable form to third parties, but only with the individual’s consent [8]. It includes the right to decide on data usage and the right to data portability, which encompasses the ability to request data transfers. Having control over one’s medical data empowers individuals to directly manage and process their information. This shift has led to a new paradigm where the focus of data utilization has moved from public institutions and companies to individuals [9]. In essence, managing personal health and improving quality of life by relying solely on medical records from a single medical institution has its limitations. Addressing these challenges requires a connection between national and public medical institutions and related public entities, as well as the organic sharing and management of medical data [10].
MyHealthWay is a national system designed to manage and utilize personal health records (PHRs). It integrates data from medical devices, public health information, and scattered medical records from various medical institutions, serving as a key infrastructure for implementing MyData. MyHealthWay functions as an information relay system that facilitates the easy provision of PHRs in an integrated and standardized form, allowing individuals to share them as they choose. This study explores the emergence, role, current status, and legal issues associated with MyHealthWay, a Korean healthcare platform that enables the seamless relay of medical data from multiple institutions. Through MyHealthWay, a comprehensive dataset that includes medical records from various individuals and information from related public institutions is made available. The platform provides access to medical records, such as medical checkups and drug prescription information, to MyData service institutions. It ensures the safe and reliable transmission of patients’ medical data using advanced technology and strict security policies. Additionally, the security of patient data is prioritized by regular improvements of its security systems and initiatives to promote transparent data management.
II. MyHealthWay
MyHealthWay is a platform built on the concept of medical MyData. It enables individuals to share their health information with medical professionals or institutions at their own discretion, based on their consent. This capability of sharing enables personalized precision care and assists individuals in overcoming the barriers to accessing medical care posed by physical distance. MyHealthWay increases the utility of medical data by facilitating the transmission of personal medical information, which aligns with its primary goal of serving as treatment data. The platform seamlessly integrates various individual medical records with information from relevant public institutions, creating a comprehensive dataset. These integrated data are essential for medical service providers to review an individual’s medical history (Figure 1).
1. Sharing of Multi-Center Medical Data
Medical data have the potential to deliver social and economic benefits in research, system development, and personalized treatments [11]. Although the primary function of medical data relates to clinical applications, such as treatment and surgery, medical data also possess considerable secondary value in fields such as digital healthcare, research, and machine learning-based analysis. As a result, the extent of data sharing between medical institutions, and between individuals and these institutions, is on the rise [12,13] (Figure 2).
2. Data Linkage
Using the MyHealthWay platform, patients can directly consent to the use of their medical data. This facilitates the consolidation, viewing, storage, and transmission of medical data, which are often dispersed across various medical and public institutions, to a chosen location. This process upholds an individual’s right to control their personal data. Previously, the information available through MyHealthWay was limited to medical diagnoses and dosage details from the past year, vaccination history over a lifetime, medical checkup data from the past 10 years, and life log data (such as steps and sleep time). However, as of September 2023, the Korean government has significantly expanded the network of medical data-providing institutions connected to the health information highway by incorporating 860 medical institutions nationwide. The expanded MyHealthWay network now includes data from nine tertiary general hospitals, 13 general hospitals, and 838 hospitals and clinics. The scope of the data provided has been broadened to include 113 items across 12 categories, such as diagnostic details, drug prescription information, diagnostic and pathology tests, and surgery details (Figure 3). Consequently, individual patients can now easily access a broader range of personal health information at once, based on their consent. Additionally, medical doctors can access more comprehensive medical histories, including recent medical exams, diagnoses, and surgeries, along with the patient’s diagnosis and dosage information.
3. Data Security and Management
National-level security against information leaks and hacking for MyHealthWay, a medical data-sharing platform, is provided through a robust system managed by the National Information Resource Service. The platform and its users are protected by database encryption solutions that use unique keys for each entity and exclusive channels to block external access, thereby strengthening data security. Vulnerabilities in MyHealthWay’s web services, apps, and infrastructure operations are continually evaluated, and it is maintained as a high-security system that has received partial Information Protection Management System (ISMS) certifications, covering physical, managerial, and technical aspects. Data-providing institutions protect against external access by using unique security channels for transferring data between electronic medical record (EMR) systems and Fast Healthcare Interoperability Resources (FHIR) servers. Moreover, all data linkage processes utilize transport layer security (TLS) technology for network encryption. Data transmission and reception occur through hypertext transfer protocol secure (HTTPS) channels. To ensure the highest level of security, individual identifiers such as resident registration numbers and specialized medical data are safeguarded using both asymmetric and symmetric encryption methods. Access is further restricted by assigning designated unique Internet protocol (IP) addresses to the MyHealthWay platform and the participating institutions.
III. Case Comparison
This section systematically examines, compares, and validates the progress, introduction, and application of medical data sharing systems similar to MyHealthWay in various countries, highlighting a trend of progressive development in this sector. In the United States and Europe, medical MyData systems, which are based on advanced IT technology and utilize acquired personal medical information, are being actively established. These systems operate based on comprehensive consent and offer the option to opt-out. Furthermore, in Finland, the Act of Secondary Use of Personal Medical Data is being developed and made openly available to the public. In Hong Kong, personal medical information is accumulated in public institutions under the national health insurance system. We present international examples of state-led medical MyData models that operate for a similar purpose to MyHealthWay.
1. Republic of Korea
Since its pilot in 2022, which included 245 medical institutions, MyHealthWay expanded in September 2023 to over 600 additional institutions. This expansion has facilitated the integration of a broad spectrum of medical data from public sources, organized into 12 standardized categories such as health histories, prescriptions, diagnostics, and more. Users can access this data through the MyHealth Records app, which enables direct sharing of data with healthcare staff in a viewer format at healthcare facilities. MyHealthWay emphasizes interoperability and adheres to international standards such as FHIR and the Korean Core Data for Interoperability (KR CDI) system. The KR Core transmission standard promotes effective data exchange, while forthcoming guidelines for patient-generated health data (PGHD) are set to standardize major data initiatives and promote integration across healthcare projects.
2. The United State: Blue Button+
In 2010, the US Department of Veterans Affairs, in collaboration with the Insurance Agency and the Department of Defense, launched a system to access the medical information of retired military personnel. This system utilizes the American Standard Code for Information Interchange (ASCII) to convert records into electronic formats. In 2012, the Coordinator for Health Information Technology introduced Blue Button+, an expansion under the HITECH bill, to include general medical institutions and individuals. This expansion employs HL7 CDA standards for content and a certificate-based information protection ecosystem [14].
In 2013, under the 21st Century Cures Act, the Center for Medicare and Medicaid Services broadened its services to include PHR services for individuals, utilizing Medicaid and Medicare claims data. These PHR services enable individuals to access comprehensive medical information, including previous prescriptions, treatments, and procedures, via Medicaid and Medicare billing data. This enhancement facilitates data sharing with new healthcare providers, aims to reduce redundant testing, and improves the continuity of care, all while complying with the Health Insurance Portability and Accountability Act (HIPAA). The objective is to encourage the voluntary sharing of medical data by improving external access standards for personal medical data and strengthening rights to personal medical data ownership. This system permits the sharing of medical data, such as prescription histories and test results, with family, medical professionals, and hospitals, which is particularly beneficial in the context of new treatments or different doctors by preventing redundant tests and reducing costs [15].
Currently, over 17,000 medical institutions are participating in this data-sharing system, which has also expanded to include government agencies and the private sector. This expansion is standardizing data formats to improve the exchange of medical data and facilitate the use of third-party applications with individual consent. This system actively supports personal health management by leveraging a variety of information shared through the system, including medications taken, allergy information, treatment details from hospitals and doctors, health insurance claim data, and blood test results.
3. Hong Kong: Electronic Health Record Sharing System (eHRS)
This system, which was developed in 2016, facilitates the sharing of medical data between public and private medical institutions. It provides a comprehensive range of data, including personal identifiers, demographic information, allergy and drug side effects, diagnostic procedures and medications, hospital appointments, clinical records and summaries, birth and vaccination records, blood and imaging results, other reports, and customized medical recommendations. To ensure privacy, the system uses cryptographic storage for all medical data, maintains detailed system access history records, and imposes restrictions on data downloads. It is designed to permit downloads following appropriate procedures, support seamless patient treatment, and assist in clinical decision-making. Medical professionals can access patient information for legitimate purposes, such as previsit preparation or follow-up management after treatment. The system offers two types of consent for the provision and sharing of information: indefinite consent, which remains valid until the patient withdraws or cancels it, and 1-year consent, which includes the option for immediate withdrawal 1 year after giving consent. This approach ensures informed decision-making in the sharing and provision of personal information.
4. Finland: MyKanta
MyKanta integrates social security services by extracting personal health and prescription data, allowing users to access their medical records, examination results, and welfare service data. The platform ensures data accessibility and transparency by recording separate access logs for each user, managing information about every user accessing the data and their individual access records [16,17]. In 2019, Finland navigated the EU’s General Data Protection Regulation (GDPR) by establishing its own legislation, the “Law on Secondary Use of Health and Welfare Data,” which permits the controlled use of healthcare data. This legislation has enabled public research institutes, universities, companies, and local governments to utilize healthcare data for health promotion and management. On October 25, 2023, a new version of the platform was released that simplifies prescription renewal requests and incorporates management of life-sustaining medical rights and post-organ donation records, safeguarding individuals’ rights to their health data.
5. EU: European Health Data Space
The European Health Data Space (EHDS), established in 2022, enables individuals to manage their medical data and facilitates data sharing among healthcare professionals, researchers, industries, and policymakers. It adheres to GDPR for data protection, the Data Governance Act to promote data sharing, and the Network Information Service regulation to ensure system and data security. The EHDS is planned to incorporate the Cyber Resilience Act for cyber-security in hardware and software, with the goal of establishing a robust data system by 2025. It plans to utilize medical data from approximately 450 million EU residents for cross-border healthcare and research [18]. The economic benefits derived from personal health data include primary uses such as improving telemedicine and reducing healthcare costs, as well as secondary uses in research, analysis, and the formulation of public health policies. The EU is committed to empowering individuals with control over their medical data, thereby strengthening self-determination in healthcare and advancing medical services and treatments [19].
IV. Challenges and Recommendations
1. Data Management
Currently, MyHealthWay is managed by several key organizations. The Ministry of Health and Welfare plays a pivotal role in the implementation of health services, responsible for establishing the legal foundations for MyHealthWay, formulating policies, developing operational strategies and guidelines, and providing budgetary support. It sets objectives, monitors outcomes, and performs strategic analyses in healthcare. The Korea Health Industry Development Institute plays a crucial role in the research and development aspects of MyHealthWay. It enacts related legislation, develops evaluation guidelines for organizations, promotes the nationwide utilization of services, and supports the commercialization of the healthcare industry. The Korea Health Information Service is responsible for planning and executing health service construction projects. It manages communications among stakeholders, coordinates and supports MyHealthWay service programs, and maintains and develops the technological infrastructure. Additionally, it provides backup and support for information systems. To maximize MyHealthWay’s impact on the healthcare ecosystem, foster collaboration with related organizations, stakeholders, and medical institutions, and manage further data expansion, it is advisable to either establish a dedicated organization or strengthen ties with existing ministry-affiliated institutions. This strategy would ensure systematic data management and support the sustained growth of MyHealthWay.
2. Data Standardization
Integrating health and medical data sharing involves significant costs, time, and active collaboration among healthcare institutions [20]. Although state-led investment is crucial from a public-interest perspective, relying solely on government funding may not be adequate in all areas [21]. Depending solely on initial national investment without compensation mechanisms can result in only short-term benefits, as medical institutions might not immediately recognize the advantages of data quality management and standardization. Over the long term, it is essential to foster an environment where sustainable business models utilizing healthcare data can be developed. Moreover, when involving multiple institutions and individuals, it is critical to prioritize consent and trust in the handling of personal data. While individuals benefit from overseeing and managing their information, the risk of personal data breaches remains a significant concern. It is advisable to evaluate potential barriers to accessing, exchanging, or using electronic health information, rather than indiscriminately using individual medical data. Implementing national measures against illegal activities, such as imposing restrictions on research participation and data use, can bolster user confidence and security.
1) Standardization plans and models
Standardization efforts are underway, including a certification system for EMRs, which would be essential for MyHealthWay. However, clinical trial data in South Korea face challenges due to the absence of a standardized model, unlike the United States, which adheres to Clinical Data Interchange Standards Consortium standards for clinical trials. The United States also utilizes the Biomedical Research Integrated Domain Group model for interoperability, integrating general care data (HL7 FHIR) and clinical trial data, which facilitates data exchange and mapping. This complexity can escalate when considering data integration in daily life, where different formats and standards may exist, leading to diverse challenges in data integration and standardization. Detailed standard specifications for correlating and exchanging personal health records using MyHealthWay have been established. However, these specifications, while addressing general medical institutional characteristics, may not fully meet the specific needs of specialized treatment fields. Therefore, it is anticipated that future efforts will be required to develop detailed specifications tailored to each specialized field, ensuring that all relevant data can be effectively standardized. To improve data quality management and ensure data reliability and validity, comprehensive periodic management practices are necessary. While rapid data collection is leading to a quantitative expansion of medical data, ensuring high-quality and beneficial data necessitates adherence to a step-by-step manual aligned with established guidelines. This manual should cover the entire lifecycle of data, including its generation, secure storage and extraction, use, and disposal. Additionally, the EMR of various medical institutions needs to be aligned with the specific FHIR standards.
To address these challenges and streamline future multi-center data collection, the HL7 Korea FHIR KR Core Implementation Guide should be systematically and efficiently incorporated into the interoperability criteria of the EMR certification standards. Additionally, electronic data standardization is recommended to include attempts and efforts related to Systematized Nomenclature of Medicine Clinical Terms (SNOMED CT) and Korean Standard Terminology of Medicine (KOSTOM). SNOMED CT is a comprehensive, multilingual clinical healthcare terminology that provides a standardized language enabling consistent capturing, sharing, and aggregating of health data across specialties and sites of care. It facilitates the effective exchange of health information among different health systems and IT applications, covers a broad range of clinical specialties, allows detailed representation of patient data, supports a wide array of clinical content, and can represent complex concepts specific to healthcare. However, its extensive scope and depth make it complex to implement, require significant training, and necessitate ongoing updates and management to keep up with medical advancements, which can be resource-intensive. KOSTOM is a localized clinical terminology and extension of SNOMED CT adapted for use in Korea. It is tailored to meet the specific needs of the Korean healthcare system, including integration of traditional medicine, works in conjunction with international standards like SNOMED CT, improving interoperability while maintaining local relevance, and addresses both Western and traditional Korean medical practices, promoting comprehensive healthcare service. However, it has limitations as it is primarily focused on the Korean context, which may limit its use in international settings, is primarily in Korean, posing challenges for non-Korean speakers, and limiting its broader adoption. Integrating traditional and Western medical terminologies presents unique challenges and complexities. This approach will help to ensure that data from diverse medical institutions adhere to standardized procedures and formats. Clear standardization guidelines are vital for maintaining data quality and consistency. High-quality data, secured through effective data quality management and improvement efforts, can significantly increase data utilization and improve the overall quality.
3. Legal and Ethical Issues
1) Ethical issues following the revision of the Personal Information Protection Act
Both legal and ethical issues must be considered when handling sensitive personal medical information in digital healthcare [22]. It is crucial to be aware of the ethical implications and potential risks associated with the commercialization of medical data for both individual and corporate profits. To address these concerns, robust ethical guidelines must be established to govern the use, sharing, consent, responsible data stewardship, and protection of sensitive medical information. Additionally, oversight and supervision mechanisms should be implemented to ensure adherence to these ethical standards. Stakeholders, including government agencies, healthcare institutions, technology providers, and the public, should collaborate to create a framework that promotes responsible data usage while protecting individuals’ rights and interests.
2) Differences in perspectives regarding the third-party provision of medical data
Relevant institutions and organizations have different perspectives regarding the third-party provision of medical data, and the sharing, utilization, and linkage of sensitive personal medical information [23]. Medical institutions and organizations have expressed concerns about the third-party provision of medical data from individual patients, including potential gaps in the management and supervision of sensitive medical information, information leakage, potential commercial transactions, and legal disputes. The recently revised request for Personal Information Transmission of the Personal Information Protection Act in 2023 established the right of data subjects to request personal information management agencies to transmit their personal information to a third party. The personal information that a data subject can request to be transmitted is limited to information processed by devices such as computers. Information created by analyzing and processing personal information collected by the data processor is not subject to the right to request transmission and is excluded. Upon receiving a request for transmission, the data processor is obligated to transmit the information within a reasonable range of time, cost, and technology. They may refuse the request or suspend transmission if the identity of the data subject cannot be verified. Furthermore, the revised law specifies that exercising the right to request the transmission of personal information must not infringe on the rights or legitimate interests of others. This right constitutes a foundational element for expanding the MyData business beyond the financial and public sectors to other industrial sectors, and growth is anticipated in related industries following this revision. However, since detailed regulations are deferred to the Enforcement Decree, it is necessary to continue monitoring related discussions.
It has also been argued that the right to transmit personal information, as stipulated in the Personal Information Protection Act, contradicts the objectives of the Medical Law, which prioritizes medical information protection, as it allows the transmission of all medical records upon the request of individual patients. Simultaneously, concerns have arisen regarding practical issues, such as the potential increase in administrative tasks resulting from data transmission and the storage and management of medical records. Finally, third-party involvement in the transmission and management of patients’ medical records may undermine the objectives of the Personal Information Protection Act [24]. For medical consumers who are data subjects, a system capable of mandating a confirmation of third-party transmission history, interrupting transmission, and destroying data destruction should be established to strengthen individual sovereignty over medical information [25]. Systematic improvement measures are necessary to adequately inform individuals about the purpose of data collection, usage methods, and third-party provisions to prevent the commercialization of personal information and ensure individuals’ right to know. The Ministry of Health and Welfare has emphasized that such a system could increase public satisfaction and play a significant role in enabling individuals to directly access and manage their medical data, medications, treatment, and examination records through dedicated applications [24].
3) Personal consent stability and reliability
In situations where the stability and reliability of personal consent are in conflict, the public benefit derived from the use of personal information must be weighed against the risk of data breaches [26]. In the realm of large-scale medical big data collection and linkage, individuals are typically notified individually and asked for their consent to use their data. However, this often results in data subjects not fully understanding how their personal medical information is being processed. While there are benefits to various forms of information collection and provision, the authenticity of consent has become a significant concern due to the complexity of the consent items [22]. In the context of big data, the volume of data and the policies governing its processing that require consent from information providers are continually increasing. This expansion has led to a growing information gap between personal information controllers and subjects. This complexity is particularly evident in everyday life, where data use and linkage agreements are presented to individuals [27]. Furthermore, personal consent often serves more as a criterion for deciding whether to use a service rather than as a means to make an informed choice about how one’s data are processed [28]. Therefore, there is a need to highlight the key points and provide summaries within the existing narrative to improve users’ understanding of the provision and utilization of personal medical data [29].
V. Discussion
This report examines the emergence of medical MyData and the official introduction of the MyHealthWay platform service in Korea in 2023. It explores MyHealthWay’s operational status and its linkage structure, both within Korea and on an international scale, while also discussing its legal and ethical dimensions. MyHealthWay’s system is in line with global trends and aims for progressive changes informed by its status abroad. In the future, this system is anticipated to make significant contributions to national interests and public health by continuing to improve treatment, personal health, and information management.
PDF Links
PubReader
ePub Link
XML Download
Full text via DOI
Download Citation
