The Russian market for medical data is nearing 5 billion rubles, according to a 2024 study by consulting firm Kept. Demand for anonymized health information about citizens is on the rise, yet experts note that this business operates largely in a «grey area.» Pharmaceutical companies account for 90% of medical data purchases, utilizing it for analyzing drug efficacy and planning future developments. Additionally, insurance services, neural network developers, and industrial enterprises show interest, aiming to detect employee diseases at early stages.
Businesses frequently acquire medical data from both state and private clinics. This information typically includes lab results, prescriptions, sick leave records, X-rays, MRIs, and other medical documents. Authorities are currently developing a legal framework to regulate and foster further growth in this market. Damir Sukhov, a partner at Kept, explained that each region maintains its own state health information system, which connects to Russia`s unified federal system (EGISZ). All state polyclinics are mandated to link to EGISZ and submit information on medical care provided. The state, through relevant ministries and agencies, acts as the operator and custodian of this data within the unified system.
The government leverages accumulated data for various purposes: monitoring and forecasting public health, morbidity, and mortality rates. It also supports pharmaceutical and pharmacological oversight and the compilation of mandatory statistical information. EGISZ also integrates other systems, such as VIMIS, which grant doctors immediate access to a patient`s treatment pathway. While regulatory hurdles for using this data currently exist, Russian federal authorities are discussing approximately 10 initiatives aimed at developing the market and removing these barriers. If these obstacles are removed, a significant market expansion and increased demand for data utilization are anticipated.
Indeed, the potential here is immense for patients, doctors, pharmaceutical companies, and developers alike.
RBC-polled insurance companies stated they do not purchase medical data. Instead, they collect client information directly with consent or obtain it from partner clinics. Artyom Dmitriev, managing partner at Comply, emphasized that acquiring citizens` health data is not yet fully legal: «We`ve had personal data, and now we have anonymized personal data. But the core principle remains unchanged. Even when a business anonymizes data correctly, according to approved methodologies, it must still observe and control processing times, despite the slightly broader scope for its use. Ultimately, if such information is processed unlawfully or, heaven forbid, leaked, the business will bear full responsibility.»
The only benefit of anonymized data in such cases is reduced risk if a leak occurs, leading to less harm to individuals. Consequently, businesses might face smaller fines compared to leaks of original personal data. However, the «buy-sell» concept for both personal and anonymized personal data is essentially prohibited in Russia. Such information always has an operator who collected it, and the buyer is generally not entitled to acquire and use it at their discretion. While it might not be explicitly forbidden under certain conditions, a clear legal structure allowing effective and lawful use of this data is currently absent.
An experimental legal regime, currently under active discussion, could help clarify the crucial question of what constitutes anonymous data. Presently, personal data is subject to a full range of legal restrictions, while anonymized personal data allows slightly more freedom. Anonymous data, however, would not be subject to these restrictions at all.
According to the Kept study, doctors often decide which metrics are included for processing, resulting in businesses receiving unstructured records in 80% of cases.
