COVID-19 vaccine recipients received unique health identifiers without their consent
In early May 2021, Sweta Sundar, 29, traveled with three members of her family to a public school in South Delhi to receive their first doses of the Covishield vaccine. Vaccination center staff insisted that they verify their identity by submitting their Aadhaar contact details, although, according to government-issued guidelines, beneficiaries can provide six other types of government identification. “At the time, I just did as I was told,” Sundar said. “I haven’t thought about it too much. When Sundar returned home, she saw that she had been issued a Unique Health Identifier or UHID with the number printed on her vaccination certificate above her beneficiary reference number. Sundar was unsure of the ID number. The three family members who had also been vaccinated after providing their information about Aadhaar had also been given a medical identification number. “They hadn’t told us anything about a medical ID or that they were giving us one,” Sundar told me. “There was no conversation around it, let alone a process of seeking consent. How could I give my consent when I didn’t even know what the health ID was? ”
The UHID that Sundar and his family found on their vaccination certificates is a unique identification code generated by the National Digital Health Mission or NDHM. The government launched the mission in August 2020 with the stated goal of leveraging technology for better health outcomes. The National Health Authority, the government body responsible for implementing various central health programs, including the NDHM, describes the mission on its website as one that “aims to develop the backbone necessary for supporting the country’s integrated digital health infrastructure “. UHID is supposed to connect each NDHM beneficiary with several other components of a digital health ecosystem by digitizing personal health records, providing access to health services, including online pharmacies and telemedicine providers. UHID is supposed to allow beneficiaries access to all of their health records such as lab reports, prescriptions and discharge summaries and all other personal health data. Despite assurances from the NHA to protect sensitive health data shared under the NDHM, concerns remain about how this data may be used as India still lacks a data protection law . The government has also claimed that registering by creating a UHID and opting out by requesting the removal of all personal data from the NDHM is completely voluntary. However, several people like Sundar had previously been assigned UHIDs without their consent.
On September 27, Prime Minister Narendra Modi announced the nationwide launch of NDHM, now called Ayushman Bharat Digital Mission, during a video conference. Prior to that, NDHM had only been implemented on a pilot basis in six Union Territories: Chandigarh, Ladakh, Dadra and Nagar Haveli and Daman and Diu, Pondicherry, Andaman and Nicobar Islands and Lakshadweep. Caravan reported in September 2020 how the Chandigarh administration was forcing healthcare workers to register for UHIDs and in December 2020 on aggressive pressure for registration among other residents.
From the start of the NDHM pilot in August 2020 until the end of September 2021 when the mission was launched nationwide, people residing outside the Union territories were not expected to be able to generate health identifiers on the NDHM website. However, Caravan spoke to six people across India living outside Union Territories who received UHIDs ahead of the nationwide launch and while verifying COVID-19 vaccinations. The six people had used their Aadhaar card as proof of their identity before September. Two of six people said their vaccination centers insisted that Aadhaar be proof of identity, one person said they did not know they could provide other documents as proof and three people submitted voluntarily their Aadhaar coordinates.