AI innovation in healthcare and state platforms under a rights-based perspective: the case of Brazillian RNDS

Abstract

This article examines the National Health Data Network (RNDS), the platform launched by the Ministry of Health in Brazil as the primary tool for its Digital Health Strategy 2020–2028, including innovation aspects. The analysis is made through two distinct frameworks: Right to health and personal data protection in Brazil. The first approach is rooted in the legal framework shaped by Brazil’s trajectory on health since 1988, marked by the formal acknowledgment of the Right to health and the establishment of the Unified Health System, Brazil’s universal access health system, encompassing public healthcare and public health actions. The second approach stems from the repercussions of the General Data Protection Law, enacted in 2018 and the inclusion of Right to personal data protection in Brazilian’s Constitution. This legislation, akin to the EU’s General Data Protection Regulations, addressed the gap in personal data protection in Brazil and established principles and rules for data processing. The article begins by explanting the two approaches, and then it provides a brief history of health informatics policies in Brazil, leading to the current Digital Health Strategy and the RNDS. Subsequently, it delves into an analysis of the RNDS through the lenses of the two aforementioned approaches. In the final discussion sections, the article attempts to extract lessons from the analyses, particularly in light of ongoing discussions such as the secondary use of data for innovation in the context of different interpretations about innovation policies.

Policy Significance Statement

With the growing importance of Digital Health, states often adopt national platforms as tools for data processing aimed at enhancing information use and fostering data-driven innovation on health systems. Likewise, Brazil created its National Health Data Network (RNDS). In this article, we analyze the RNDS as a platform for innovation under two legal perspectives: Right to health and personal data protection, part of the Brazilian legal framework. The authors aim to provide inputs for the broader debate around Digital Health platforms, primarily but not exclusively centered in the Brazilian scenario, and raise concerns that should be addressed for an implementation that complies with data protection and fulfills Right to health, particularly in terms of universality, integrality, social participation, and decentralization.

Table 1. Main organizations included in the ESD28 of Brazil

1. Introduction

The emergence of Digital Health, particularly with artificial intelligence (AI) applications, has a significant impact in the health debate, with a wide range of potential transformations: in healthcare, in public health actions, and in research and innovation (World Health Organization [WHO] 2021). Potential benefits include improved diagnostics, enhanced patient monitoring, optimization of practitioners’ time and resources, outreaching to isolated communities, and better prevention of epidemics at populational level through early warning systems (Topol 2019).

However, in this scenario, potentials also come with risks to be addressed, including concerns around data protection, privacy, and safety-related issues, including unwanted bias (Da Silva et al. 2022), repurpose of personal health data for misuse, as highlighted by the WHO in its first ethical guidance on AI (WHO 2021), breaches of cybersecurity (Bhuyan et al. 2020), and the deployment of health digitalization as a tool for dismantling public health systems (Rachid et al. 2023).

Also, AI innovation brings up issues on data ownership involving economic interests. Singh and Gurumurthy point out different possible approaches for data governance, from a more individualist-property approach to a communitarian framework (Singh and Gurumurthy 2021). Johnson and Scassa (2023), in a study concerning state’s data sovereignty on spatial data, also point out different types of state ownership of data, from a complete control to retreat. Considering the high perceived economic value of health data, these discussions are equally important.

Furthermore, challenges to be addressed include the overcoming of connectivity and infrastructure barriers, in order to avoid the increase of existing inequalities among populations, territories, and countries. Shevchuk et al. discuss this matter pointing out that access to internet can potentially turn into a dimension of Right to health (Shevchuk et al. 2021).

In that context, Brazil’s implementation of Digital Health provides an interesting case study. With the largest population and Gross domestic product in Latin America, the country has notably a universal access health system, the Unified Health System (SUS), which is undergoing a process of digital transformation. The existence of a universal healthcare system could imply in big datasets under government supervision, with strong potential as well for AI innovation through secondary use.

In addition, Brazil’s constitutional order acknowledges both Right to health and Right to personal data protection, making this analysis not simply a theoretical exercise, but also a practical study of the existing institutional framework.

This article is aimed at providing a critical analysis of the National Health Data Network (RNDS), the main tool of Digital Health in Brazil, especially considering it as a platform for AI innovation under a rights-based perspective anchored on the two rights aforementioned.

In this sense, the article is organized as follows. Section 3, right after the data sources and analytical framework, explains the contents of Right to health and of personal data protection as understood in the Brazilian framework. Afterwards, it provides a basic overview of the institutional landscape of Brazil concerning health, which will be useful for the following sections. The next one provides a brief historic description of recent developments on health informatics policy in Brazil. The following session section details the RNDS. The following two sections analyze it under the two suggested approaches: Right to health and personal data protection. Finally, the last section discusses a few possibilities and possible ways to address the issues that were identified.

2. Data sources and analytical framework

In order to fulfill its aims, this article was based on a case study around the implementation of the RNDS. Data was gathered from a documental review of rules, policy documents, and the resume of meetings concerning the RNDS.

The case study seeks to respond what is the background of the creation of the RNDS, which is the development of health informatics policies in Brazil, the main actors involved in its governance and its relations with the policy documents retrieved in the documental review.

The documents were extracted from the website of the Ministry of Health, particularly from the webpages under the supervision of the Secretary for Information and Digital Health (portal available at: https://www.gov.br/saude/pt-br/composicao/seidigi/rnds, last access on March 20, 2024).

The results were analyzed under the perspective of Right to health and Right to personal data protection, as prescribed in the Constitution of Brazil.

3. Rights-based perspectives

In this section, it explains the two analytical frameworks presented, considering their historical backgrounds in the Brazilian constitutional history.

3.1. Right to health as a framework of analysis

The Right to health serves as a framework for analyzing health policies. Internationally, interpretations of the Right to health vary, but generally, they agree that it constitutes a social and economic right realized through health policy and individual protections, such as self-determination regarding the body and the mind. This perspective is encapsulated in the General Comment No. 14 of the Committee on Economic, Social and Cultural Rights of the United Nations (CESCR General Comment No. 14: The Right to the Highest Attainable Standard of Health [Art. 12]), a critical document interpreting the Right to health within the main international human rights treaties that mention it.

Eduardo Arenas (Catalán 2021), through a detailed analysis of international doctrine and jurisprudence, points out that this conception often limits Right to health to a legal right that is focused on individual entitlement and only vulnerable groups, missing out the reason why social rights were conceived, which is to tackle malaises such as poverty and social inequality.

His research introduces an alternative approach found in another key international document: the Declaration of Alma-Ata on Primary Healthcare. This approach puts the Right to health as socially determined, emphasizing the need of considering economic structures in its realization. Notably, the original conception of the Right to health in the Brazilian constitution aligns more closely with the latter perspective.

After a decade-long political movement in the 1970’s, the so-called Sanitary Reform, Brazil incorporated in its new Constitution of 1988, the Right to health, and established a universal access system, the SUS (Fleury, 2009). The Constitution defines universality, integrality of care, community participation, and decentralization as its principles (BRAZIL; Brazil Federative Republic Constitution, Arts 196 and 198).

Universality and integrality are the main foundational principles of the SUS and can be respectively understood as universal access and the need for a state’s response to all health needs of the population, both at individual and collective level. Decentralization and community participation originally aligned with an Alma-Ata idea that health as a right should be realized accordingly to the local context, that includes social, cultural, economic, and territorial aspects. Theoretically, it comes from the ideas of social determination of health.

In that regard, the use of technologies should be incorporated on a needs-based approach, accordingly to its social acceptability by the community that will benefit from that tool. The declaration introduces this notion by stating that primary healthcare, as the base of health systems, “is essential health care based on practical, scientifically sound and socially acceptable methods and technology made universally accessible^” (Alma-ata Declaration, https://cdn.who.int/media/docs/default-source/documents/almaata-declaration-en.pdf?sfvrsn=7b3c2167_2).

3.2. Brief overview of the institutional landscape of the SUS

The SUS is structured over two other administrative principles: decentralization and community participation. Decentralization not only prioritizes the delivering and formulation of health policies at local level but also defines binding attributions to the three levels of the Brazilian federation: federal, state, and municipal. Therefore, the SUS is at all federative levels of Brazil. In general, policymaking is a federal attribution whereas healthcare delivery are state and municipal ones. Funding responsibilities are shared among the three levels (BRAZIL; Brazil Federative Republic Constitution, Art 198 and Cf; Funcia 2019).

Federal cooperation became a topic of major importance in the context of the SUS, with a significant importance of the Tripartite Inter-managers Committee (CIT, in the Portuguese acronym), a consensus-oriented instance that brings together health authorities from the three levels of the Brazilian federation. As we discuss in the next sessions, the CIT plays an important role in current Digital Health policies.

Community participation is often translated into the legal framework as social participation meaning the oversight and formulation of health policies by different sectors of society, namely SUS’s users, health workers, and government officials. The two main institutions of social participation are the National Health Conferences, a conference that takes place every fourth year and approves the National Health Plan, and the National Health Council (BRAZIL; Law No. 8142/90).

Besides its core principles and the definition of services and actions on healthcare and public health, the SUS is charged with attributions concerning workforce formation, technology innovation, production of essential health products, and participation on policies for basic sanitation and on food systems (BRAZIL; Brazil Federative Republic Constitution, Art. 200).

Since its creation, the SUS has consistently improved the health of Brazilians; however, it still struggles with an agenda that imposes underfunding, understaffing, and lack of infrastructure (Funcia 2019). Parallel to the public system, Brazil has a significant drug retailing and healthcare insurance private sector, which is very similar to the US model.

Currently, this private sector accounts for about 50% of the national expenditure in healthcare and the private health insurance sector covers about 25% of the population, which is also covered by the SUS especially for the most complex procedures (Silveira et al. 2020).

Besides the whole administrative engine at the Ministry of Health and health state and municipal level secretaries, the SUS also has two regulatory bodies: the National Health Surveillance Agency (ANVISA), which basically regulates and oversees the system for safety, efficacy, and quality of health technologies and health services, and the National Supplementary Health Agency (ANS), which regulates the private health insurance sector. These are agencies created in the context of a managerial administrative reform of the Brazilian state in the 1990’s decade (Gomes and Lisboa 2021).

3.3. Right to personal data protection

Differently from Right to health, the legal implementation of personal data protection precedes its formal acknowledgement in the Constitution. It was formally incorporated in 2022 (BRAZIL; Brazil Federative Republic Constitution. Art. 5°, LXXIX), after the approval of the General Data Protection Regulations (GDPR)-inspired General Data Protection Law (LGPD). Thus, its content is strongly shaped by its legal counterpart and by the international debate.

The LGPD was enacted in 2018 (Law No. 13.709, 14 August 2018) and is very similar to the GDPR. A few studies have identified on similarities between the two frameworks (Erickson 2018; Gadoni Canaan 2023), particularly in being a consent-based model of data personal protections, having similar legal basis for authorized treatment of data and including personal health data in the list of sensitive data, which entails additional protection.

LGDP’s approval was driven both by strong civil society participation, especially digital rights, privacy protection, and consumer’s defense entities, and by relevant participation of the private sector, including transnational companies, that benefits of harmonization of data protection rules and certainty in the legal system.

The content of this right includes protection against discrimination through harmful or neglectful use of data, transparency over how data is processed, and self-determination of data use, which is concretely translated into the consent-based model (Jalil and Burlamaqui 2022).

3.4. Brief overview of the institutional landscape for personal data protection

Additionally, the LGPD laid the foundations of the National Data Protection Authority (ANPD). Initially, the ANPD operated under the auspices of the Presidency of the Republic, facing significant resource constraints during its early years. However, in 2022, amendments to the LGPD were enacted, transforming the ANPD into a regulatory entity endowed with increased autonomy. (It is noted that Provisional Measure No. 1,124/22, converted into Law No. 14,460/22, amended the General Personal Data Protection Law, transforming the ANPD into an agency of a special nature. Furthermore, from 2023 and through Decree No. 11,348/23, the ANPD is now under the responsibility of the Ministry of Justice and Public Security.)

The LGPD, differently to the GDPR, is a national law. The GDPR leaves room for national complementation, especially for additional protection on personal data. There is not a comparable attribution for states or municipalities in Brazilian legal framework.

In terms of health-related provisions, the LGPD includes personal health data in the category of sensitive data, which cannot be collected and processed without complying with one of the legal bases, considering its potential for discrimination and other risks (LGPD, Art. 5°, II). Consent, the first legal base, should specify clearly the authorized use of data (LGPD, Art. 11).

Also, there is a specific provision that explicitly prohibits the processing of personal data for risk-selection purposes. Essentially, this means that it is illegal to adjust pricing for health insurance products based on the risk profile of an individual, which is determined by their health conditions. Notably, this regulation was preemptively established by the ANS in 2017, underscoring its importance ahead of the broader LGPD mandates (ANS 2015).

4. Historical context—health informatics in Brazil

Although the implementation of the SUS in the decade of the 1990s pushed forward the agenda of health informatics, the first electronic information systems were created about two decades before, with WHO support. In 1971, the Ministry of Health created an Informatics Centre, and in 1975, it promoted the first national meeting on Information Systems in Health (Fornazin and Joia 2013).

Years later, in 1991, the Ministry created the Department of Informatics for the SUS (DATASUS) (BRAZIL; Decree n.° 100, de 1991). The still existing DATASUS was tasked with managing the informatics technical part of the Ministry in order to enhance the maintenance of federal information systems. In parallel, the unfolds of the principle of decentralization fostered the creation of information systems at regional level (Ferraz 2009).

Already back then, the challenge of tackling fragmentation of information systems, both within the Ministry of Health and among federative units, was identified as Moraes and Gómez (2007) explain in an article of 2007. Coelho Neto and Chioro (2021), more recently, point out how the issue has not been resolved yet. Fragmentation of informational systems is often portrayed as key topics of digitalization, to be addressed through interoperability, for instance in publications by the Pan-American Health Organization (PAHO) (Anon Introduction to Semantic Interoperability 2021; PAHO; Office of the WHO for the Americas region) and in the Ordinance the establishes the RNDS (Ordinance No. 1.434/GM/MS/2020), as we will discuss in coming sections.

In 1990, in a partnership with the World Bank, the Ministry created the National Health Card, commonly known as SUS Card, a personal identifier aimed at unifying all the health information of users. In 1996, in a joint initiative with PAHO, the Ministry created the Interagency Network of Information for Health (RIPSA, in the Portuguese acronym) (PAHO 2023), a decentralized network that brought together different actors, including academia, policymakers, and executive institutes to discuss the important indicators in health.

RIPSA took a comprehensive approach to health, considering information beyond clinical settings, such as demographics and social determinants of health (Risi Júnior 2006). Its structure was also decentralized, bringing together different organizations of the Brazilian state. In 2022, the RIPSA was reactivated (Ordinance GM/MS No. 1,915, published on June 27, 2022) after a hiatus.

An important step at policy level happened in 2004, when the first edition of the National Policy for Information, Informatics and Health (PNIIS) was created, as an output of the 12ª National Health Conference. PNIIS became since then a key reference, setting the guidelines, actions, and attributions for the federation levels (Union, States, and Municipalities) (Cavalcante et al. 2015). The PNIIS had later two new editions, one in 2015 (Ordinance No. 589/GM/MS/2015) and the other in 2021 (Resolution No. 659/CNS/2021), approved already in a context of emerging discussions around Digital Health globally.

In that global context, specially in 2012, the WHO and the International Telecommunication Union (ITU) launched a key milestone: the e-Health Strategy toolkit. The document emphasizes health systems efficiency and economic competition and advocates for private sector participation through funding and technical support from agencies, donors, non-governmental organizations, and consultants and through new business and economic opportunities brought by digital technologies.

In this scenario, the second edition of the PNIIS was approved in 2015 (Ordinance No. 589/GM/MS/2015) and right after, in 2016, the CIT established the Management Committee of the e-Health Strategy, formed by governments and the two agencies (ANVISA and ANS) (Resolution No. 05/CIT/2016, retrieved on November 20, available at. https://www.gov.br/saude/pt-br/acesso-a-informacao/gestao-do-sus/articulacao-interfederativa/cit/resolucoes/2016/resolu-es-n-5-e-6.pdf/view). This Committee was tasked with formulating the first e-Health Strategy, approved in 2017 (Resolution CIT No. 19/2017), proposing strategies for the informatization of the SUS and defining standards for interoperability and for electronic health records.

In May 2018, the 71° World Health Assembly, the WHO summit, adopted a key resolution on Digital Health (WHO 2018) calling for several actions by member states on the field of Digital Health, including policymaking and approving of new legislation. In April 2019, the first WHO guideline on digital health was published and, in 2021, the WHO launched the Global Digital Health Strategy 2020–2025 (WHO 2020), emphasizing that the expansion of the use of information and communication technologies has the potential to accelerate human progress, while reinforcing the role of the private sector as a partner.

In 2019, under the newly elected Bolsonaro government, the Brazilian Ministry of Health established a Digital Health Department, tasked with the development of a National Digital Health Policy. An important number of staff was relocated from the Ministry of Economy, a Ministry with assumed pro-market views and large political importance, being charged with attributions from at least four former ministries (innovation, labor, planning, and budget and finance) (Milhorance 2022).

In this context, The Digital Health Strategy for Brazil 2020–2028 was approved and the Digital Health Steering Committee (CGSD) (Brazil 2020) was created. The CGSD was created by the CIT (Resolution CIT No. 46/CIT/2019, retrieved in March 2, 2024 from https://www.in.gov.br/en/web/dou/-/resolucao-n-46-de-29-de-agosto-de-2019-221309239) replacing the previous e-Health Steering Committee. It is formed by the Ministry of Health, the ANS, the ANVISA, the National Council of Health Secretaries, the National Council of Municipal Health Secretaries, and the Oswaldo Cruz Foundation (Fiocruz), a key public health research foundation in Brazil under the Ministry of Health.

Although the CGSD does not formally provide a seat for non-governmental entities, some of the meeting minutes indicate participation of private hospitals as technical collaborators. (The minutes are fully available since 2023 in the page: https://www.gov.br/saude/pt-br/acesso-a-informacao/participacao-social/conselhos-e-orgaos-colegiados/cgsd/ata-de-reunioes. In the last access, in March 20, 2024, the only minutes available were of years 2023 and 2024, corresponding to the term of the federal government elected in 2022. Two of the minutes that indicate the presence of the PROADI partners are the one of April 9, 2021, and the one of March 26, 2021, retrieved by the authors through request for access to information, based on the Brazilian law of access to information; Law No. 12.527/2011.) These hospitals are particularly part of the Institutional Development Support Program of SUS—PROADI/SUS, a public private arrangement operated through tax waivers to elite hospitals mainly located in the southeast region of Brazil. These are institutions that operate under the legal regime of private law providing guidance for public policies (Penteado et al. 2023).

The ESD28 was published in a context influenced by the aforementioned international documents (Brazil 2020). Not only by the WHO, the Ministry of Health also signed bilateral agreements with other governments for cooperation, for example, one with the United Kingdom, in 2019 (available at https://www.gov.br/saude/pt-br/assuntos/noticias/2019/junho/brasil-e-reino-unido-iniciam-cooperacao-na-area-de-saude-publica). Reaffirming, updating, and expanding the content of the e-Health Strategy document for Brazil, the Digital Health Strategy indicates that by the year 2028 the RNDS—the platform that we explore in the next section—would be fully established as the digital platform for information and healthcare services.

In 2022, a proposition made by the Minister of Health was debated in Brazil, in spite of not being translated into policy, the Open Health. Inspired by the Open Finance in Brazil, a mechanism of interoperability put in place by the Central Bank of Brazil, the Open Health proposed the integration of health data and enhanced access by the private health insurance sector (MS, ANS, ME, BCB; Relatório Final do Grupo de Trabalho, Portaria GM/MS No 392, de 23 de fevereiro de 2022, retrieved from https://www.gov.br/saude/pt-br/centrais-de-conteudo/publicacoes/relatorios/2022/relatorio-final-do-grupo-de-trabalho).

5. Digital Health Strategy (ESD28) and the RNDS

The RNDS was established in 2019 and then incorporated into the ESD28 and the third version of the PNIIS (2021). The ESD28 refers to RNDS as the national platform of health data integration from all collaborating sectors (Brasil 2020), while the current PNIIS acknowledges it as the national platform of integration of health data (CNS 2021) and places it as the central instrument for its actions. Therefore, according to the policy, RNDS is a platform for interoperability, ensuring flow of data, including for innovation purposes. Both documents also place RNDS as an integrative tool for all spheres of the SUS, but also with the private sector.

The RNDS relies on the international Fast Healthcare Interoperability Resources Standard for exchange of data and plans to bring together existing and future information systems, for instance, those that contain data on healthcare units (CNES), ambulatory (SIA) and hospital (SIH) activities, vaccination (SIPNI), primary healthcare (SISAB), drug prescription and utilization (BNAFAR), and so forth Additionally, it would also include information from tax and personal identification databases held by the federal government (MS 2024).

Concerning security and infra-structure, RNDS was initially hosted at the Ministry of Health and then through the cloud computing service offered by Amazon Web Services (AWS), which was contracted by the Ministry of Health through a larger public bidding process that began in 2018 and involved other ministries (information concerning the role of the AWS and all the services used by the Brazilian government is available at the companies’ website in Portuguese as a case study, which indicate the use of 11 different products, available at: https://aws.amazon.com/pt/solutions/case-studies/datasus-case-study/, retrieved at March 19, 2024).

An initial project envisioned the RNDS as a blockchain system with 28 nodes, one in the Ministry of Health and each of the others in one of the states of Brazil or at the federal district (TCU 2020). However, there is no evidence of implementation.

During the Covid-19 pandemic, the Ministry of Health suffered three major security breaches that triggered an investigation by the Federal Public Prosecutor’s Office after a claim was filed by civil society organizations. Key findings from this procedure included the absence of compliance of the Ministry’s structure, therefore the RNDS as well, with personal data protection (IDEC 2022).

Concerning its implementation, the RNDS started with pilot projects in the state of Alagoas (Brasil 2020; de Fatima et al. 2022). In parallel, the application Conecte SUS (in January, 2024, the application Conecte SUS was renamed Meu Sus Digital (My Digital SUS) was created as its interface with public managers and users. The Covid-19 pandemic played a key role in the definition of the first information systems to be transferred to RNDS, being the data on immunization against Covid-19 the first significant amount of information to be fully integrated in the Network and displayed through the Conecte SUS application.

5.1. The RNDS and AI innovation

Both the Digital Health Strategy and the PNIIS mention the RNDS as potential tool for innovation, including Artificial Intelligence through secondary use of data. The strategy in particular mentions as its goals, the development of “initiatives on IoT, Big Data and secondary use of data” and the “implementation of a health data lake” (Brazil 2020).

This opens the possibility of the Network serving as massive source of datasets for training AI algorithmics and developing tools with data of Brazil’s population, which can be a meaningful contribution in terms of creating AI tools that work without unwanted bias to the particular needs of the country. However, this large amount of data could also mean risks with access are not well regulated and protected, as this article discusses in its final session.

6. The RNDS under the principles of Right to health

As noted in the section above, the RNDS has become an essential tool for the execution of Digital Health policy in Brazil. For that reason, it is important to assess its compliance with the principles and guidelines of Right to health established in the Constitution, under the idea that all health policies should reflect its advancement.

Concerning universality, it is important to remark that the Constitution not only acknowledges the Right to health but also defines the SUS as the means to achieve it, described in the Constitution as a regionalized system that acts in a network. The existence of the supplementary health insurance sector, despite permitted by Constitution, does not mean it should be fostered. Therefore, the Digital Health policy should focus on strengthening the SUS and not the private insurance sector.

As the RNDS opens the doors to interoperability between health information systems across all sectors being a “national innovation platform” that also targets the entities of the supplementary health insurance sector, it could imply a secondary data sharing for financial purposes that may weaken the public sector as a universal system. New developments could take into account the value of health data and how much it can be unduly appropriated by the private health insurance sector.

The RNDS also could further comply with the idea of social participation that inspires many other bodies and instances in the SUS administration by incorporating alternative forms of interaction and decisions that include users and health workers. Currently, the CGSD has only state actors.

Concerning decentralization, the RNDS has ultimately a centralized structure of data collection and processing that could be adjusted considering the federative status of health in the SUS. There is supporting literature that points out how this principle led to innovation on public policy across Brazil within the framework of local and regional attributions (Fleury 2014). The original plan of having nodes across the Brazilian states was one of the few initiatives to further decentralize the RNDS.

In terms of integrality, it noteworthy that this principle also includes aspects beyond clinical practice, in other words, to incorporate information on the socioeconomic factors that contribute to health status, such as the so-called social determinants of health. (The social determinants of health refer to, according to the WHO, non-medical factors that influence health outcomes, such as income and social protection and working life conditions. Some theories, particularly in the Social Medicine in Latin America, work with the framework of Social Determination of Health, going beyond these factors and understanding that health is ultimately determined by socioeconomic factors.) In that regard, it is key for the RNDS to incorporate other sources of data. Other experiences in Brazil, such as the recently reactivated RIPSA, can play an important role to fulfill that.

In terms of innovation, the RNDS is highly reliant on public–private interactions, through capacity-building and through purchase of services (e.g. cloud computing). The platform could potentially play a role as well on strengthening public capacities and fostering the development of infrastructure and new technologies in the public sector.

According to the Brazilian Constitution, among the SUS attributions are the production of technologies and the enhancement of technological innovation in its related fields. A few concrete examples of state-owned infrastructure already exist in Brazil, for instance, the Centre for Integration of Data and Knowledge for Health (CIDACS—Fiocruz), a unit of Fiocruz that has a data center for processing health data for research with a cohort of 100 million of Brazilians (https://cidacs.bahia.fiocruz.br/sobre/quem-somos/).

7. The RNDS under the Right to personal data protection and the LGPD

An important challenge for the RNDS is to be fully compliant with the LGPD. Recent efforts, especially in the year of 2023, have incorporated this task into the agenda of the Ministry of Health; however so far, the RNDS showed limited steps in that regard.

In a publication in June 2021, DATASUS mentions actions to adapt the RNDS to the General Data Protection Law (DATASUS 2020), mentioning that the implementation of the RNDS would have started in June 2019. It turns out that since the publication of this document, there was no detail of the ongoing actions or the confirmation that the RNDS is observing the legal LGPD requirements.

Until the end of 2022, the MS official response given to a request based by the authors based on Brazilian Access to Information Act pointed out that “to this date, there is no formal schedule for full adaptation of the RNDS to the LGPD.”

Breaches during the Covid-19 (https://idec.org.br/sites/default/files/right-to-health-personal-data-protection.pdf) pandemic also revealed the relevance of this compliance, not only from a technical point of view but also with requirements of informing potentials victims about the extent and quickly providing an assessment of damages.

Other key challenge in that regard is the administrative integration between the Ministry of Health and the ANPD. It would be relevant if the Ministry of Health anticipated the movements for elaborating an impact assessment, especially calling the society to participate in the process (do Nascimento Gonçalves et al. 2022). A recent development in that regard was the inclusion of the Ministry in the Director council of the authority in October of 2023 through a presidential decree (Decree No.11.758, 2023).

There are still concerns about the use of data by the private health insurance sector for risk selection. The Open Health project is a good example. In spite of being a provision of the LGPD, the enforcement has to be ensured by the ANPD and the Ministry of Health.

The current PNIIS views RNDS as an open innovation hub leveraging private sector initiative, which raises concerns about handling personal health data, which demands strict rules to prevent discrimination. Public sector data holds significant value and should be transparently regulated to avoid exploitation by private entities, without necessarily benefiting public health bodies equally.

8. Concluding remarks—RNDS for AI innovation under a rights-based framework

The RNDS, an evolving platform, stands at crossroads and incorporating insights from Right to health and data protection frameworks can significantly enhance its development. Addressing core issues such as decentralization, data privacy adherence, infrastructure, and regulation for AI-driven innovation is imperative.

The landscape of digital health in Brazil, characterized by significant international and private sector involvement, raises questions about data use, especially for AI. The alignment with global frameworks, as advocated by WHO, underscores the importance of data interoperability, a primary focus of the RNDS thus far. However, concerns about health data’s secondary use have intensified, particularly following the former Health Minister’s 2022 announcement of the “Open Health” initiative, which relies on the RNDS for data sharing and interoperability with private entities (Fornazin et al. 2022).

Leveraging data for AI innovation holds significant promise for advancing technology that meets the needs of Brazil’s SUS, aligned with the principles of social acceptability outlined in the Alma-Ata Declaration and Brazil’s Right to Health. To fulfill these ambitions, it is essential to ensure that these innovations adhere to the principles of universality and equity and are developed within a framework that prioritizes public interest, possibly favoring a model of public infrastructure over private transnational networks. Brazil’s experience with CIDACS provides a compelling example of how this can be achieved.

Furthermore, integrating the Right to personal data protection, especially in terms of transparency regarding the use and relationships between the public and private sectors, is crucial. This approach not only aligns with international standards but also enhances trust in how data is utilized. The complex network of interactions unveiled by the CGSD analysis underscores the need for clearer transparency in these partnerships.

It is also important to remember that the data integrated by the RNDS, aimed at fostering innovation, is primarily sourced from public resources. Therefore, the benefits derived from such innovations should be made accessible to all citizens, in a collective manner. Moving forward, the RNDS could greatly benefit from embracing discussions on technology benefit-sharing and exploring new paradigms in data governance, as suggested by Gurumurthy, extending beyond traditional data protection frameworks.