Pádraig Rice (Cork South-Central, Social Democrats)

I move amendment No. 4:

In page 9, between lines 30 and 31, to insert the following:

“Review of data protection compliance

7. The Minister shall, within 18 months of the passing of this Act, prepare and lay a report before both Houses of the Oireachtas evaluating compliance with relevant data protection legislation and regulations in the collection, usage, and storage of patient health data.”.

This is long overdue and much needed legislation that will provide for a legal basis for electronic health records and patient information sharing. More generally, it represents a critical step towards digitising our health services and this is crucially important. Digitisation is an area the health committee is quite interested in and one we will engage with the Department on and engage on during a public session.

However, it is important to note the process of transforming our health service from paper files to digital files comes not just with benefits but also with risks. Privacy and security risks are unavoidable but the majority can be prevented by having the right safeguards in place. I accept that safeguards are being put in place via the Bill but ehealth represents a big change for our health service that will undoubtedly have teething problems. Significant and meaningful ongoing engagement with the Data Protection Commissioner will be crucial and more tangible action is needed given the sensitivity of the data concerned. This is why I believe it is essential a review is carried out early and that it is put on a statutory footing. We need to be sure the safeguards put in place are working effectively and that we identify areas for improvement early because the opportunities for breaches will increase as we digitise, particularly as new systems are implemented. As we all know, healthcare data is a prime target for a cyber attack. We should not discount the impact on AI on future healthcare provision either.

I also have a concern regarding the level of preparedness in respect of the secondary use of data. Such use is vital for scientific research, policymaking and the development of treatments, but the State is poorly prepared to utilise it. In 2023, a pan-European steering committee stated that Ireland's infrastructure for secondary use of data will need to be built almost entirely from scratch and will be managed by people who are not yet on the payroll. I accept that the secondary use of data will be dealt with in future legislation, but all of these issues are interlinked. If we do not put these reviews on a statutory footing from day one, then I am not convinced they will happen. For those reasons, I am of the view that a review of data collection usage and storage needs to happen within 18 months.

See this speech in context