Report on the Ethical Review Systemin the Healthcare Sector –A Framework to Ensure
Ethical Utilization of Healthcare Data

March 2023
The PeOPLe Co-Creation and Utilization Consortium
Task Force on Healthcare Data and Ethics

1

内容
1. Introduction: Determining suitable regulations for data use in healthcare ................................ 3
2. Building a Hypothesis: Healthcare data issues, standards, and systems ..................................... 5
1) Research targets – The scope of the term “healthcare data” ............................................. 52) Issue awareness .............................................................................................................. 63) The three research theories ............................................................................................. 7
References: Preliminary work conducted before formation of the task force......................... 8
3 Theory testing and analysis: Suggestions obtained from opinions in the business field............ 10
1) Opinions of people in the field .................................................................................... 102) Additional investigations by second task force ............................................................ 103) Theory testing and analysis........................................................................................ 114) Suggestions received .................................................................................................. 124-1) Include diverse operational strategies ..................................................................... 124-2) The role of platform operators................................................................................ 124-3) The role of the public sector ................................................................................... 134-4) Regulation in line with objectives and risks ............................................................. 134-5) Using employee healthcare data .............................................................................. 144-6) Regulations on labeling and advertising .................................................................. 144-7) Invasiveness, privacy, and other values ................................................................... 144-8) Reviewing bodies and feedback............................................................................... 154-9) Standard and substantive reviews ........................................................................... 154-10) Internal and external auditing .............................................................................. 164-11) Other concerns, issues, and ideas .......................................................................... 16
5 Conclusion ........................................................................................................................................ 17
Appendix 1 ........................................................................................................................................... 18
Appendix 2 ........................................................................................................................................... 20
Appendix 3 ........................................................................................................................................... 26

2

1. Introduction: Determining suitable regulations for data use inhealthcare

With the increased desire for better well-being and the advent of the super-aging society,expectations regarding the use of healthcare data have been rising. That trend was further accelerated
during the COVID-19 pandemic.
Simultaneously, a number of issues connected to the handling of such data have arisen. As no
concrete rules are in place, there is a risk that proper data use has been hindered because the extent towhich legal, ethical, and social concerns must take precedence when applied to privacy, equality, andother values is still unknown.
We formed a task force consisting of experts in various fields as we believe it is necessary toengage in discussion about more appropriate guidelines and regulations for the utilization ofhealthcare data. Ethical research guidelines are already in place to govern the use of data in the areasof medical research and medical care, but the same cannot be said when it comes to the broader fieldof healthcare business operations. That is why the task force focused its multifaceted investigation on
healthcare businesses in particular. To ensure that the investigation was as efficient as possible, thetask force consulted with businesses actually utilizing healthcare data, in addition to working withresearchers conducting theoretical studies. This was achieved by harnessing the trusting relationships
built between members of the academic and industry communities through such efforts as Keio
University’s PeOPLe/OPERA operations.
After the first iteration of the task force released its interim report and summary, a broad range of
opinions were solicited from various stakeholders – including those overseas – and they wereincorporated into the report created by the second task force members. We greatly appreciate all
involved in providing us feedback regarding the interim report.
This report brings together theories, results, and analyses acquired through our consultations withorganizations working in the field. It was prepared to serve as a useful reference not only forcompanies engaged in healthcare operations, but also for local and national government bodies. We
welcome questions, comments, and critiques from all stakeholders regarding future investigation into
the issues touched upon here. We look forward to working with any and all interested in open, frank
discussions of this practical research approach.

3

Healthcare Data and Ethics Task Force Members
First Task Force Members (July 2020-March 2022) (Titles as of time of task force participation)●
Takehiro Ohya, Professor, Faculty of Law, Keio University (Task Force Chairperson)●
Soichi Ogishima, Professor, Advanced Research Center for Innovations in Next-Generation
Medicine, Tohoku University●
Fumiko Kudo, Visiting Researcher, Institute for Future Initiatives, University of Tokyo●
Hitomi Sano, Researcher, Keio Frontier Research & Education Collaborative Square at
Tonomachi●
Takashi Suyama, Researcher, Institute for Future Initiatives, University of Tokyo●
Yutaka Tomiyama, Researcher, Graduate School of Humanities and Sociology, University of
Tokyo●
Yusuke Nagato, Specially-Appointed Assistant Professor, Research Center on Ethical, Legaland Social Issues, Osaka University●
Takanori Fujita, Specially-Appointed Associate Professor, Keio University School of
Medicine; Head of the Healthcare Data Policy Project, Centre for the Fourth Industrial
Revolution Japan, World Economic Forum●
Natsuko Yamamoto, Specially-Appointed Lecturer, Institute for Datability Science, Osaka
University
Second Task Force Members (April 2022-March 2023) (Titles as of time of task force participation)●
Takehiro Ohya, Professor, Faculty of Law, Keio University (Task Force Chairperson)●
Kodai Zukeyama, Assistant Professor, Department of Regional Development, Faculty ofCollaborative Regional Development, Kyushu Sangyo University●
Takanori Fujita, Specially-Appointed Associate Professor, Keio University School of
Medicine; Head of the Healthcare Data Policy Project, Centre for the Fourth Industrial
Revolution Japan, World Economic Forum●
Seiichirō Yamamoto, Professor, Shizuoka Graduate University of Public Health●Yuki Yoshida, Researcher, Keio Frontier Research & Education Collaborative Square at
Tonomachi
Advisors●
Hiroaki Miyata, Professor, Keio University School of Medicine *General Manager
of PeOPLe/OPERA●
Tatsuhiko Yamamoto, Professor, Keio University Law School●
Shigeto Yonemura, Professor, Graduate Schools for Law and Politics, Universityof Tokyo42. Building a Hypothesis: Healthcare data issues, standards, andsystems
1) Research targets – The scope of the term “healthcare data”
The term “healthcare data” as used in this report includes body weight, body fat percentage, steps
walked per day, activity level, temperature, pulse rate, blood pressure, blood sugar level, heart rate,
respiratory rate, sleep records, food consumption records, facial imagery (for facial recognition), andmore. In the broadest sense, it includes all data concerning a healthy adult individual that can becontinuously acquired, collected, and analyzed with the object being the promotion of better healthand well-being.
There are several considerations to be taken into account when handling such data.
First, medical history and other similar data (as defined by Article 2 Paragraph 3 of Japan’s Act on
the Protection of Personal Information 1) was temporarily excluded from the scope of data. This
included information about medical care, pharmaceutical use, checkup results, health advice and allother information that could reveal the state of an individual’s health and potentially reveal or identify
an illness. This type of data can be considered equivalent to that which falls under the definition of“medical history” and would therefore require special handling considerations, and so was therefore
excluded as a core target for study2.
Second, we decided to exclude all data concerning minors, dementia patients, or any otherindividual from whom it would be difficult to obtain “consent” as defined by Article 16, Paragraph 1of the Act on the Protection of Personal Information 3. Genomic data is also considered outside thescope of the term as defined in this report as it should be considered subject to special consideration
as some of that data is shared with relatives. Similarly, we excluded any data that could be a problem
due to group privacy 4 issues. However, though some such data was removed from the scope of usable
information, we remained conscious of it while conducting our study. We were particularly careful
regarding checkup results, medical treatment history, and other such information because connectivity
often has such data handled by single services or apps that bundle it together with other healthcare
data.
Third, the data collected had to coincide with an individual in an “ordinary” state, during which
they aim to maintain and improve their health. All data considered to be taken in an “emergency” state

1 According to the Act on Anonymized Medical Data That Are Meant to Contribute to Research and Development in the

Medical Field (the so-called Next Generation Medical Infrastructure Act), “medical data” is deemed to be personal
information and defined to include "medical history," as defined in Article 2, Paragraph 3 of the Act on the Protection of
Personal Information. However, it can be extremely difficult to distinguish between healthcare data and what is generally
considered “medical data.” For example, daily blood pressure data would fall under the definition of medical history for
those with hypertension.
2 The Health Information Working Group is a part of the Study Group on the Utilization of Health, Medical and Nursing
Care Information, a joint effort between the Ministry of Internal Affairs and Communications, the Ministry of Health, Laborand Welfare, and the Ministry of Economy, Trade and Industry. The Study Group released two documents in April 2021, theBasic Guidelines for the Management of Health and other personal data by Private-sector PHR Business Operators and theReport from Study Team on Private Utilization. Our report coincides with the definitions included in those guidelines andreport, which state that companies exclusively handling data on vital signs and other health-related data for individuals were
not to be included as targets for study.
3 With the handling of nursing care data concerning dementia patients in mind, we propose an ethical framework for thehandling of data from individuals from whom consent is difficult to obtain in Good Data: Sharing Data and Fostering
Public Trust and Willingness, Takanori Fujita, Fumiko Kudo et al., World Economic Forum, 2021.
https://www.weforum.org/whitepapers/good-data-sharing-data-and-fostering-public-trust-and-willingness
4 Taylor, Linnet, Luciano Floridi, and Bart Van der Sloot, eds. Group privacy: New challenges of data technologies.
Philosophical Studies Series. 126. Springer; 2016.

5

(as defined by the Sections 2 and 3 of Paragraph 1, Article 23 of the Act on the Protection of Personal
Information) was excluded from this study.
However, we conducted the study without limiting methods for acquiring and storing data definedas “medical devices” according to Article 2, Paragraph 4 of the Pharmaceutical Affairs Act. It can bedifficult to determine the eligibility of medical devices or programs/software 5, but we decided toinclude a broad range of healthcare related devices and programs/software 6.

Medical data(treatment history, etc.)
Healthcare data

Type of data handled

How the data is used
Business operational data not
subject to medical ethics
board review

Research and other data
subject to medical ethics
board review
ExcludedPartially excluded

Excluded

IncludedArea covered by this report

2) Issue awarenessThe healthcare data used in this report is by definition neither invasive nor directly able to beconsidered personal in nature. However, continued acquisition, collection, and analysis of this data
could potentially allow it to be used to learn about or infer the state of illness for an individual at agiven moment. For example, daily records on sleep and food consumption fall under the definition ofhealthcare data, but disturbances to sleep patterns or a sudden tendency to overeat could be used toinfer an individual has entered a state of depression.
There are two possible approaches for the handling of such healthcare data. The first carefully treats
all information as sensitive from the beginning because it could eventually fall into that category.
Although this approach is extremely safe and strong, there is the concern that pre-symptomatic
research could become more difficult to conduct. The second approach takes a more flexible, riskbased response. The task force selected the latter approach for this study.
It should be noted that there are strong ethical concerns in the field of healthcare data. Traditionally,
the aim of those working in the field of medicine was to maximize patient benefit. Issues such as
See Pharmaceuticals and Medical Devices Agency Document 1228-2 (released 28 December 2018) for information on
partial revisions made to section titled “Basic thinking behind applicability to medical devices and programs/software”.
http://www.jaame.or.jp/mdsi/program-files/301228kanma12282.pdf
6 In South Korea, software and other non-medical devices used for exercise and health management are also subject toregulation under the country’s laws governing medical devices.
5

6

information asymmetry and the irreversibility and significance of information related to body andhealth could be broadly considered partially applicable to healthcare data also.
Therefore, we must find consider a means of data governance that is able to respond flexibly whileremaining ethical and compliant to regulations 7.

3) The three research theories
The task force proposed the following three hypotheses for its investigation.
●●●

Theory A (Problems): It is not yet clear the extent to which legal, ethical, and social
considerations must be taken in the handling of healthcare data, and this may be hindering
healthy business growth.
Theory B (Rules): It may be possible to support the growth of healthcare data businesses bygiving direction to ethical guidelines and codes of conduct from a third-part expert
perspective. This may help to prevent inappropriate business practices.
Theory C (Structure): Implementation may be made easier not only by presenting guidelines
and standards, but also by presenting a healthcare data governance structure (e.g. a system ofreview, procedures, etc.)

Theory A maintains the arguments surrounding potential issues posed in a previous study
published in December 2018 titled Proposal regarding profiling 8. It proposed that profiling is not
limited to medicine and healthcare, but is in fact spreading beyond advertising and marketing into
credit scores, personnel evaluation, and other areas that can potentially have significant impact on an
individual’s freedom and independence 9. The paper points out that accordingly, the social companies
that introduce or utilize profiling will have greater social responsibilities imposed upon them. In
addition, there are no concrete guidelines regarding how a company can fulfill its legal and social
responsibilities with regards to profiling in Japan. The authors suggest that this may have a chilling
effect on healthy business growth, and made some recommendations regarding rules that could be
implemented 10. It is hypothesized that the above points could also be considered applicable when it
comes to businesses operating in the field of healthcare data.
Regarding Theory A, it was pointed out near the beginning of the task force’s work that “if the useof healthcare data can be ultimately used to aid in making medical diagnoses and offering treatment,
all data gathered should be treated as ‘personal information requiring special consideration’ andmanaged extremely carefully.”

7 The task force does not propose that loopholes be found to subvert conventional medical research and treatment ethicalreviews, but in fact suggests that conventional ethical review is required for initiatives that fall within the purview of ethicalguidelines designed for research, clinical trials, etc.
8 Personal Data +α Research Group. Proposal regarding profiling. New Business Law. 2018; 1137: 64-85. Shojihomu Co.,Ltd.
9 The paper defined profiling as any action involving “the use of personal data and algorithms to analyze or predict a specificindividual’s interests, preferences, abilities, credit capability, knowledge, behavior, etc.” The EU’s General Data Protection
Regulations (GDPR) began to be implemented in May 2018, and it provides this definition: “…‘profiling’ means any formof automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating
to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work,
economic situation, health, personal preferences, interests, reliability, behaviour, location or movements;…”. (See GDPR
Article 4(4).)
10 Proposal regarding profiling was later updated, with Final proposals regarding profiling released 22 April 2022
(Available at https://wp.shojihomu.co.jp/shojihomu_nbl1211), but this description from the original paper was used as it waswhat the task force referred to during its investigation.

7

Theory B is based on actual practical application of what was proposed in Proposal regarding
profiling, mentioned above. Its Interim report including proposals takes a more definite direction
regarding ethical guidelines and codes of conduct with the included “Checklist for voluntary efforts.”
The People Analytics and HR Technology Association announced principles actually based on the
proposals in 2020, titled Principles for utilization of personnel data 11, which promoted the formationof an industry body that would provide self-regulation 12.
This theory was also based on suggestions received when investigating systems built for reviewing
medical research and treatment to use as reference points for this study 13, namely that medical
research and medical treatment ethical review boards may be unable to fully investigate issues related
to privacy protection. The reason given for this was that ethical review in these fields is fundamentallydesigned to protect subjects and patients from highly invasive physical procedures, so challenges may
arise by expanding review to encompass other types of values (e.g. protection of personal information,equality, social value of research, etc.)
This theory proposes therefore that it may be necessary to re-state the direction of ethical guidelines
and codes of conduct specific to the utilization of healthcare data.
Theory C is also based on suggestions obtained while investigating review systems in use in
medical research and medical treatment. Currently, ethical review boards in Japan are decentralized,
which helps ensure independence and autonomy. On the other hand, there is no system in place tocollect or receive feedback based in the knowledge of different individuals, so experience is only
gained on the local level. In addition, a series of institutional reforms were implemented throughout
the 2010s to improve the issues surrounding the so-called “The 3000 Ethics Committees Problem.”
They were expected to allow for greater consolidation and better quality assurance, but it is difficult tosay whether or not either objective was achieved 14.
That is why this theory proposes that it may be necessary to come up with a review system,
procedures, and other elements of a system of governance designed to handle the issues presented
above.

References: Preliminary work conducted before formation of the task force●

18 February 2020 – Held a study session on ethical review systems in the fields of medical
research and medical treatment in the era of AI medicine○
Lecturers: Yutaka Tomiyama (Researcher, Graduate School of Humanities andSociology, University of Tokyo), Yusuke Nagato (Specially-Appointed AssistantProfessor, Research Center on Ethical, Legal and Social Issues, Osaka
University)Moderator: Takehiro Ohya (Professor, Faculty of Law, Keio University)○
https://www.people-tonomachi.com/report/2019/200218.html

11 “Request for distribution of Principles for utilizing personnel data – Ver. 1 and its Explanatory Video,” The People
Analytics and HR Technology Association, 19 March 2020 Available at https://peopleanalytics.or.jp/news/2025/
12 In Ethical Issues Regarding the Use of Profiling Services for Recruiting: The Japanese Rikunabi Data Scandal, Fumiko
Kudo et al studied whether or not the “Checklist for voluntary efforts” mentioned here would have had any effect on
reducing or removing risk during the scandal surrounding issues with Rikunabi job offers. See Proceedings of the Annual
Conference of the Japanese Society for Artificial Intelligence, 2020.
13 See Appendix 1 for an overview.
14 Tashiro, Shimon. Trends in Reform of the Ethics Review Board System in Japan. Journal of Health Care and Society.
2018; 28 (1): 79-91

8●

5 June 2020 – Held a study session of the formation of rules governing the use of personal
data○
Lecturer: Fumiko Kudo (Visiting faculty, Research Center on Ethical, Legal andSocial Issues, Osaka University)○
Moderator: Takehiro Ohya (Professor, Faculty of Law, Keio University)○
https://www.people-tonomachi.com/report/2020/200605.html

9

3 Theory testing and analysis: Suggestions obtained from
opinions in the business field
1) Opinions of people in the field
The first task force held six discussion meetings over the course of its investigation. Details can befound below.
●
●
●
●
●
●

21 August 2020 (1st meeting): Discussed and decided task force objectives, administrative
rules, and how to proceed
29 September 2020 (2nd meeting): First hearing to survey of opinions in the field
6 November 2020 (3rd meeting): Second hearing to survey of opinions in the field
9 November 2020 (4th meeting): Third hearing to survey of opinions in the field
14 December 2020 (5th meeting): Discussed and decided how to proceed based on opinions
gathered
5 February 2021 (6th meeting): Discussed interim report proposal

It was decided that opinions gathered and discussed during the 2nd to 5th meetings would be handledin accordance with the Chatham House Rule. In principle, access to documents and other materials
was limited to members of the task force. Consequently, this report contains only an outline of theinformation obtained.

2) Additional investigations by second task force
An interim report was created to release the results of the six meetings of the first task force. The
second task force built upon that work through the four meetings detailed below, which were held
during its investigation.
●●●●

10 August 2022 (1st meeting): Discussion of whose (experts/businesses) perspectives should
be included in the interim report
15 December 2022 (2nd meeting): Hearing to survey of opinions in the field
28 December 2022 (3rd meeting): Review of opinions gathered in the field
27 February 2023 (4th meeting): Discussion of final report and future direction

As was the case for the first task force, it was decided that opinions gathered and discussed by thesecond task force would also be handled in accordance with the Chatham House Rule. In principle,
this meant that access to documents and other materials was limited to members of the task force, andtherefore this report contains only an outline of the information obtained.
In addition, a summary of the interim report was translated into English (Appendix 2), and wesolicited opinions on it from experts overseas (Appendix 3). This report reflects the results of these
additional investigations.

103) Theory testing and analysis
The following three theories were verified using the results of the investigations conducted by the
first and second task forces.
●●●

Theory A (Problems): It is not yet clear the extent to which of the legal, ethical, and social
considerations that must be taken in the handling of healthcare data, and this may behindering healthy business growth.
○
There is a chilling effect on businesses concerned about the potential risks to theirreputation due to the lack of any concrete rules. (Conventional ethical reviews do notnecessarily consider potential reputational risks.)○
Because of this chilling effect, healthcare data tends to be subjected to the same strict
handling rules designed for personal information requiring special consideration.
○
On the other hand, there is an incentive to avoid such difficulties by underestimating
the applicability of stricter rules to personal information because the procedures
involved in the handling of medical information are complicated.
○
We initially envisioned that businesses would be the primary users of healthcare data,
but later realized that other important stakeholders include businesses operating
platforms that distribute smartphone apps, government bodies, and other public sector
organizations 15.
Theory B (Rules): It may be possible to support the growth of healthcare data businesses bygiving direction to ethical guidelines and codes of conduct from a third-part expert
perspective. This may help to prevent inappropriate business practices.
○
Ethical guidelines and codes of conduct can go some way towards managing risk to
reputation.
○
It would be more effective to provide a defined code of conduct based on actual usage
cases rather than a set of abstract ethical guidelines. (It may be difficult to create acode that can be sufficiently generalized to meet different situations.)○
For example, there is definite need for a code of conduct on the utilization of
employee healthcare data.
○
There is already a lack of knowledge about such issues, not only among individual
employees, so it will be important to educate people not only within companies but
also on local and national levels.
○
Clearer guidelines regarding personal health promotion and privacy issues are alreadybeing formulated, but there is still a need for further consideration of and discussion
about other values (e.g. equality, social value of utilizing such data, etc.)○
The relationship between this type of data and the medical research data consideredoutside of the scope of this study should also be shown.
○
It was initially assumed that these regulations would apply to data acquisition anduse, but it may be beneficial to also consider what regulations may be needed
regarding the use of unjustifiable premiums in labeling, advertising, etc.
○
It is important to design guidelines that comply with norms.
Theory C (Structure): Implementation may be made easier not only by presenting guidelines
and standards, but also by presenting a healthcare data governance structure (e.g. a system ofreview, procedures, etc.)

15 See Appendix 4 below for further discussion on how stakeholders are categorized.

11

○

○

○

Healthcare data is less physically invasive so it falls outside of the purview of ethicalreview boards in the fields of medical research and medical treatment. There is
therefore room to review and restructure the system because there is a risk that
insufficient consideration will be given to privacy protection and other concerns. For
example, a possible approach would be to outsource to or work with the Personal
Information Protection Commission, so-called “Authorized Personal Information
Protection Organizations,” and other bodies that ensure personal information ishandled appropriately.
A decentralized ethical review system must have a means of maintaining review
quality. For example, information about the experience and knowledge of ethicalreview board members must be collected, and feedback provided to each review
board.
It is also necessary to ensure that actual operations run smoothly and promptly, allwhile maintaining the ability to collect a certain amount of information. A related
issue would be to ensure best practices are followed by determining terms of use
beforehand to distinguish between what sorts of information can be decided upon
using automated methods and what sorts of information require actual adjudication
through careful ethical review.

4) Suggestions received
The key findings of the investigations conducted by the first and second task forces are summarized
below.

4-1) Include diverse operational strategies
We observed that some companies are adopting business policies that take into account their social
reputation to differentiate themselves from other companies – in a similar way to how companies try
to create a “green” brand image. For such companies, the lack of clear and concrete guidelines
governing the use of healthcare data poses a potential risk to their reputation, and to a certain extent,
likely imposes a chilling effect on the decisions they make. This observation partially validates
Theory A and Theory B.
At the same time, we found that companies employ a diverse range of business strategies. In otherwords, each company has to make various decisions about whether to thoroughly comply withexisting regulations, or to proactively embark on a course of rule-making. Although it may be difficultin practice, any examination of what guidelines would be most appropriate should respect the businessdecisions each company makes.

4-2) The role of platform operators
We also confirmed the role played by Apple, Google, and other platform operators. Such operators
can serve as gatekeepers when reviewing apps to ensure they observe the rules governing healthcare
data. In addition, it was confirmed that they play an important role in providing health interventions in
the realm of COVID-19 countermeasures. However, there needs to be a guarantee that platform
operators will act appropriately.
12

It was for this reason that we revised Theory A to include platform operators as subjects.
See Appendix 4 below for more information regarding the stakeholders involved in designing areview system for healthcare data utilization.

4-3) The role of the public sector
We observed companies utilizing data from the point of diagnosis with the aim of monetizing suchwork and expanding their businesses. In other words, we are noticing a trend in operators adopting
business strategies resembling the B2B2C model, with the customer touchpoint being the time ofdiagnosis 16. Accordingly, there is a tendency to treat data as personal information requiring special
consideration because it is linked to diagnostic information, and to implement strict guidelines for
information management and utilization, so there have been no problems in the field regarding
healthcare data. This is a partial rejection of Theory A.
However, this could also be interpreted as showing a need for the public sector to formulate rules
regarding healthcare data. In brief, from a medical economic perspective, it is important to take anapproach that promotes the improvement and maintenance of good health and allows for presymptomatic data use (not only after symptoms have been discovered), and there is demand for theacquisition, collection, and analysis of healthcare state data of individuals while they are still healthy.
The reason for this is that there is always the possibility that project operators will not take it uponthemselves to formulate guidelines independently.
Therefore, we decided to revise Theory A and include government bodies and other public sector
organizations as subjects. It is a fact that there are cases in which healthcare data is not subjected tothe same sort of ethical review that is conventionally required in the academic sector – e.g. in healthpromotion projects – and ethical reviews should be conducted to ensure personal protection in a way
similar to those conducted by companies. The public sector also has a role to play in providing
education to improve knowledge of the issues, and in providing incentives.

4-4) Regulation in line with objectives and risks
One view expressed during the hearings was that if life-saving is the priority, data governance canbe used to achieve that goal. This may also coincide with Article 23, Paragraph 1, Item 2 of the Act on
the Protection of Personal Information. It is only reasonable to assume that a different form ofgovernance will be needed in ordinary times when the objective is health maintenance andimprovement (when compared to times of emergency). Moreover, even in ordinary times, data
management can be divided up into data management for treatment, data management for disease
discovery, data management for daily health, and other types of data management.
There were also concerns about what should be considered when the purpose of the data utilizationis changed due to subsequent operational developments.
Regarding Theory B, it was suggested that ethical guidelines and codes of conduct should beorganized in response to healthcare data usage objectives and risks, while keeping in mind concreteuse cases. Yet, healthcare data can be used in ways that do not require the ethical review described inthis report, so further clarification is required in this area also.

16 We received a comment suggesting that it would initially be more cost-effective to use indirect marketing aimed at doctors
and medical institutions that influence consumer and patient decisions rather than target the general public directly from the
beginning.

134-5) Using employee healthcare data
During the hearings process, it was discovered that there is a demand for the utilization of
employee healthcare data. For example, healthcare data acquired while an employee is working
remotely could be used to maintain physical and mental health, and to prevent turnover.
The aforementioned Principles for utilization of personnel data could provide some direction inpersonnel matters. However, special consideration and handling should be observed for data
connected to mental health as it could be a source of marriage-based or employment-based
discrimination.
In addition, employee data made be used internally in the development of products, but consent insuch cases may not be sufficiently voluntary. It is necessary to ensure that such consent is truly
voluntary by guaranteeing the ability to refuse and preventing peer pressure, and otherwise preventing
such data from being put to other uses based on weak consent. Moreover, the utilization of employee
data should be considered from the perspective of data reliability as well, by taking care to eliminate
any biases that favor particular product development.
It was suggested that business development could be aided by adding a sub-item to Theory B thatprovides a code of conduct that covers commensurability between personnel data and healthcare data.

4-6) Regulations on labeling and advertising
Concerns were raised during the hearings about the harm caused to consumers by non-scientificclaims made by the makers of “dubious” healthcare apps, and about overregulation resulting fromthose concerns.
This issue is reflected in Theory B. Consideration could be given to revising the Pharmaceutical
Affairs Act and other related legislation to include another category alongside “foods with function
claims” and “foods with specified health uses” in the medical device and program/software section. In
addition, we can expect a review of regulations governing unjustifiable premiums in labeling,
advertising, and other such areas in order to protect consumers. It is important to consider a review of
incentive implementation as well. This should be studied for its use as a system to ensure productreliability, for example through implementing policies to shift burden of proof, as proposed in the Act
against Unjustifiable Premiums and Misleading Representations.

4-7) Invasiveness, privacy, and other values
It was pointed out that ethical review boards in the medical research and treatment fields may beunable to give full consideration to privacy protections. Physical invasiveness is generally considered
to be low in the context of the utilization of healthcare data, and thereby such considerations falloutside the area of focus for medical ethics review boards.
One comment suggested that a possible approach would therefore be to outsource to or work with
the Personal Information Protection Commission, so-called “Authorized Personal Information
Protection Organizations,” and other bodies that ensure personal information is handled appropriately.
It was suggested that this alone may not be enough as there has been little progress made in theformulation of guidelines and practical application for equality, social value of utilizing such data, andother such non-privacy related values. For example, there remain a number of questions about how tosort out data and algorithm biases, and how evaluations should be made from the medical economics
perspective, and more.
14

In addition, there must be appropriate and well-informed oversight of outsourcing and cooperatingorganizations, rather than avoiding responsibility and simply strengthening bureaucratic authority.
This partially validates Theory B and Theory C.
There was also a proposal that it could be beneficial for a supervisory body to take a dual approach
involving administrative guidance and penalties if problems were to still arise after guidelines thattake into account a diverse range of values were formulated and promoted within the healthcare dataindustry. A system for reporting issues when they arise should also be considered.

4-8) Reviewing bodies and feedback
It was suggested that it remains uncertain who will undertake the work of conducting ethicalreviews of healthcare data utilization, and there is no means of assuring quality. For example, in thecase of research ethical reviews, it can be expected that a medical board will make appropriate
judgements fitting a situation even without policies governing that specific situation in place.
However, boards reviewing work conducted in other faculties without prior experience in ethicalreview may end up being more defensive in their judgements. Another comment stated that it will benecessary to also prevent so-called “forum shopping 17”. The opinion was expressed that specificguidelines would be necessary to prevent such actions.
This partially validates Theory B and Theory C.
As discussed above, the adoption of a decentralized review system makes it more difficult toaccumulate knowledge and could lead to inconsistent standards. This lesson was learned from the
ethical review system in place for medical research and medical treatment. It is necessary to absorb
and gather the knowledge and experiences of each ethical review board, and to provide feedback to
each.
Here it was suggested that financial incentives for auditing bodies be considered. For example,
software platform operators review apps as a part of their business, so it can be said that they have afinancial incentive to do so. However, it is still necessary to ensure that the reviews conducted by
platform operators are appropriate.

4-9) Standard and substantive reviews
It was decided that smooth, prompt processing should be considered. For example, it was noted thattens of thousands of applications are submitted regarding genome analysis, so consent acquisition andother usage terms based on consent are processed regularly and automatically matched.
A dual system could also be considered for healthcare data as well – through standardized handlingof consent confirmation and terms of use – followed by more in-depth review of items that takes into
account uncertain potential risk, flexible personal interest of the reviewee, etc. We can envision apost-inspection model in which project research is launched and problems dealt with when they arise,
and a pre-inspection model in which projects cannot be launched without being subject to social
review. Consent and conditions of use must be regularly confirmed for healthcare data as well, but adual system can be considered for when future risk is uncertain, or when review is conducted basedon more flexible interests of the reviewee. Regarding promptness and simplification, the opinion was
expressed that perhaps it would be possible to make up a notification system in advance to ensure notarget cases are overlooked, and then make it possible to conduct audits afterward.
17 Forum shopping is a term generally used in legal contexts to refer to a plaintiff choosing a court more likely to rule in theplaintiff’s favor when a case could be held in multiple jurisdictions.

15

For Theory B and Theory C, one suggestion proposed that once conditions of use are decided, itwould be beneficial to determine which parts will be determined automatically and which will
undergo substantive ethical review, while other issues were raised regarding how reviews would beassessed.

4-10) Internal and external auditing
As mentioned previously, ethical guidelines and codes of conduct should be designed in accordancewith the objectives of healthcare data use and any potential risks. It was suggested that it would be
subsequently possible to have a selection of auditing frameworks available, including internal andexternal audits, and audits conducted by third-party committees. In addition, there are multiple
options available for the auditing of holding companies and other groups of connected companies,
from where to establish the review board, to whether to provide only a report of target operations or to
go as far as providing a full audit, etc.
It was also suggested that attention should be paid to maintaining diversity among auditing
personnel, securing the personnel needed to conduct audits, and securing administrative functions.
Some rules in place for clinical trials were noted. For example, in clinical trial review, board members
must include an individual whose expertise lies outside of the realm of medicine, dentistry, andpharmacology and who has no specialized knowledge regarding clinical trials. Another rule states thatthe board must include an individual independent of the medical institution conducting the trial 18.
Another proposal stated that in addition to the forming of ethics committees to regulate data usage, it
is also conceivable to have data use promotion committees that advocate for the social value of datautilization. Other ideas received include the establishment of numerous expert sub-committees, andstructuring the main committee such that it provides summaries of all projects being undertaken.
The methods by which votes are placed, whether through unanimous decision, supermajority, etc.,
can also have a major effect on actual operations.

4-11) Other concerns, issues, and ideas
It was noted during the hearings that other factors that serve as hindrances to the healthcare databusiness include issues surrounding standardization and data interoperability. Interoperability may
need to be achieved under the guidance of the public sector. (This is connected to Theory B.) Also,
technical standards that incorporate Privacy by Design and other ethical aspects are being formulated.
We would like to discuss this point in cooperation with JIS and other working groups in the future.
It was also pointed out that other obstacles include the difficulties in coordinating data sharing
between national governments, local governments, and the private sector. This became particularly
apparent when data was being shared between local governments while introducing countermeasures
to combat the spread of COVID-19. However, work is being done to address this issue through the2021 Amendments to the Act on the Protection of Personal Information, which aim to unify data
usage rules that are adaptable to the characteristics of different data handling organizations. There arealso international issues surrounding the linking of medical research and treatment data withhealthcare data. However, there has been greater movement toward collecting and utilizing such data
together since the COVID-19 crisis began, and those trends should be watched.

18 Article 28 Paragraph 1 Items 3,4 of the Ministerial Ordinance on Standards for Conducting Clinical Trials of
Pharmaceuticals https://www.pmda.go.jp/int-activities/int-harmony/ich/0076.html

16

5 Conclusion

This report is built upon the results released in the interim report in which theories on the ideal
ethical review system for the field of healthcare were proposed; consultations were undertaken to
obtain the opinions of businesses actually working in the field; and the results were reviewed andanalyzed. This report improves upon the original by reflecting the opinions of various stakeholders
both in Japan and around the world.
The future plan is to formulate practical guidance for those working in the field by creating
questionnaires (check sheets) for use in self-evaluation and third-party evaluation and organizing adata handling framework for the rules and systems covering healthcare data usage and ethicalconcerns while keeping concrete use cases in mind, and thereby continue with a multistakeholder
perspective. In parallel with the publication of this report, we are also creating educational materials
for use in the field, but we believe that the addition of check sheets and other such tools will only
them more useful and enriching as educational materials.
This is an experimental endeavor and therefore we expect various questions, opinions, and critiques
to arise. We warmly welcome all feedback.
There is great potential for the utilization of healthcare data, yet there is naturally some concern
about how it will be used. In order to build (or re-build) public trust, industries, governments,
academia, and the various other stakeholders must cooperate in the creation of more appropriate
guidelines for the use of data in the healthcare field.

17

Appendix 1

Overview of the findings of the Study Group on Ethical Review Systems in Medical Researchand Medical Treatment
Issues● 1. Overabundance of accredited ethical review boards○ There are a large number of accredited boards, which has hindered consolidation. In
addition, accreditation is no more than a formality, and there is no way to prevent“ethics board shopping” where reviewees flock to review boards that conduct lax
investigations.
○ Is the accreditation system not fulfilling its expected function of consolidation andquality assurance? (Tashiro, 2018(a))● 2. Insufficient discussion of privacy issues○ In both medical research and genome guidelines, personal identification codes andpersonal information requiring special consideration as defined in the revised Act on
the Protection of Personal Information are handled in an ad hoc way, and discussionof this has been insufficient.
● 3. Ambiguity of privacy-related values○ There is ambiguous treatment of values (such as social value of research) that are notdirectly connected to the protection of subjects that ethical review boards are
responsible for ensuring (Tashiro, 2018(b)).
● 4. Unspecialized functionality○ There are two ethical review boards (IRB and HEC) handling research ethics andclinical trial ethics, two fields that are in principle independent, and the boards
themselves are unspecialized. It is suggested that this has resulted in boards not
fulfilling their function of resolving ethical issues that arise in the field of medicine(the role of HEC) (Ikka, 2012).
● 5. Lack of personnel to conduct ethical reviews○ 57.3% of research institutions do not train board members○ 12.4% of boards have no external members○ (The 8th Joint Meeting on the Review of Ethical Guidelines for Epidemiological andClinical Research, Document 6. http://www.mhlw.go.jp/stf/shingi/0000031891.html)
Examination● New challenges connected to Issue 2 above○ The primary aims of the Next-Generation Medical Infrastructure Act (2018) and its
AI medicine components are to facilitate the “big data” analysis of medical
information that is collected from individuals, to develop diagnostic support softwarethat harnesses artificial intelligence (AI), to provide optimal treatment regimens foreach individual patient, and to make it easier to evaluate treatment results that
integrate information from different medical institutions and different fields.
○ The ethical, legal, and social issues (ELSI) surrounding AI medicine are one of themost pressing problems in the fields of information ethics and bioethics.
○ The problems inherent to AI-IRB may be more serious than many people think.
■ Problems surrounding the use of AI itself● Algorithm biases, the blackbox nature of AI, potential for attacks

18

●

●

Issues with sharing responsibilities between humans and AI, training
users to give them greater knowledge■ Problems specific to medical treatment and research● Notification, informed consent, the physician-subject(patient)
relationship● Equal access to medical care, the roles and abilities of medical care
professionals■ Problems in the review system● Consolidation, quality assurance● Securing the personnel needed to conduct reviews
As in Issue 3, it is important to defend other values in addition to those surrounding subject
protection.
○ The primary missions of the ethical review system are 1) to protect the subjects, butalso 2) to ensure social value of research and keep it open to the public○ However, this has not been subject to much discussion in deliberative bodies such as
the Ministry of Health, Labor and Welfare.
○ The Clinical Trials Act lays out a legal obligation for specified clinical research
regarding the usage of unapproved pharmaceutical drugs, as well as requiring
companies to self-fund evaluations of their products.
○ “The purpose of this Act is to…promote the conduct of clinical trials throughensuring the confidence in clinical trials of citizens including clinical trial subjects inorder to contribute to the improvement of public health and hygiene.” (Article 1)

Primary literature cited● Ikka, Tsunakai. Reconsideration of hospital ethics committee for its revision. Bioethics. 2012;23(1).
● Tashiro, Shimon. Trends in Reform of the Ethics Review Board System in Japan. Journal of
Health Care and Society. 2018; 28(1): 79-91. [2018(a) above]● Tashiro, Shimon. Rethinking the Role of Ethical Review Boards: From Subject Protection toSocial Trust. The Annals of Legal Philosophy. 2018 [2018(b) above]19

Appendix 2Interim Report on the Ethical Review System in the Healthcare Sector,
The PeOPLe Co-Creation and Utilization Consortium Task Force on Healthcare Data andEthics – Executive Summary (Proposal)
Issue AwarenessSocietal expectations regarding the use of data gathered in the healthcare field have been rising inrespect to people’s well-being, super-aging societies, and other factors. Simultaneously, a number ofissues tied to the handling of such data have arisen, including legal, ethical, and social considerations
regarding privacy, equality, and other values, and obstacles to proper data utilization due to a lack ofreal discipline in handling that data. It is therefore necessary to implement appropriate rules that will
govern data utilization in the healthcare field.
Extent of Healthcare Data and Related Issues
The term “healthcare data” as used in this interim report includes weight, body fat percentage, steps
taken, amount of exercise, body temperature, pulse, blood pressure, blood glucose levels, heart rate,
respiratory rate, sleep records, dietary records, facial images (for recognition of expressions), andother information. In a broad sense, it includes all such data intended to be acquired, collected, andanalyzed by healthy adults in their daily lives for the purpose of promoting better health and wellbeing.
By definition, this type of healthcare data is not directly invasive, and does not directly correspondto the type of personal information requiring more considerate handling under the Act on theProtection of Personal Information. However, when such data is continuously acquired, collected, andanalyzed, and under other potential conditions, at a certain point of time, such sensitive data could be
used by others to learn private information about the state of an individual’s illness or predict its
future course. (For example, sleep and dietary records could be used to infer that an individual is in astate of depression.)
In handling such healthcare data, the first approach may be to understand the possibility that the
information could become sensitive, and therefore consider it as personal information requiring
careful protection from the outset. However, while that information will now be carefully protected,
one concern is that such an approach would make it more difficult to search for pre-symptomatic
illnesses. A second risk-based approach could allow for a more flexible response. This task force is
examining the latter approach, and there are major ethical concerns in the field of healthcare data dueto the fact that there is some validity to previously noted concerns in the medical field about
information asymmetry, the irreversibility and importance of physical health, etc. For that reason, theissue lies in how to create a form of data governance that can be to some extent flexible, while at thesame time ensuring that data is handled in an ethical way and compliance is maintained.
Three Research Theories – Testing and Analysis
These three theories were designed to consider three perspectives – problems, rules, and structure –and they were tested and analyzed after consultation with businesses working in the field. This
resulted in the following suggestions being received.
● Theory A (Problems): It is not yet clear the extent of the legal, ethical, and social
considerations that must be taken in handling healthcare data, and this may be hindering healthybusiness growth 19.
19 This provisional model builds on the issues raised by the Personal Data +α Research Group in “Proposal regarding

20

・Chilling effect: Healthcare data tends to be as carefully handled and applied as if it werepersonal information requiring protection, but as there are no concrete rules in place, there
has been a chilling effect on businesses that are considering potential risks to theirreputation.

・Stakeholders: Important stakeholders include not only businesses using healthcare data, butalso platforms distributing smartphone apps, and government bodies.
● Theory B (Rules)
It may be possible to support the growth of healthcare data businesses by giving direction to
ethical guidelines and codes of conduct from a third-part expert perspective. This may help toprevent inappropriate business practices. 20.
・Ethical guidelines and codes of conduct can help manage risk to reputation to a certain
extent, but they are even more useful when a concrete code of conduct is in place. For
example, there is a certain need for the use of employee healthcare data.

・Unlike with promoting better health in individuals, where standards have been clarified tosome extent, further review into the social value of impartiality and data use is necessary.
Here, not only do the acquisition and use of data need to be reviewed, but the use of
consumer-retention prizes and advertising in dubious healthcare apps with no scientificfoundation also merits review.
● Theory C (Structure): Implementation may be made easier not only by presenting guidelines
and standards, but also by presenting a healthcare data governance structure (e.g. system ofreview, procedures).

・There is room to re-build the structure to govern healthcare data as it lies outside of the areaof focus of medical ethics review boards.

・When more extensive review is required, it could be entrusted to or conducted incooperation with an organization able to guarantee that personal information will behandled appropriately (e.g. the Personal Information Protection Commission.)・More decentralized reviews will require experience and knowledge sharing, and feedback,to ensure that each review committee is able to ensure high quality reviews.

・Consideration must be given to smoothness of operation and system speed. The best current
example is a method by which any formal decisions can be kept separate from substantive
ethical analyses.
Suggestions Received
The key findings of the consultations are summarized below.
・Include diverse business strategies

profiling,” pp 64-85, New Business Law Volume 1137 (2018), published by Shojihomu Co., Ltd.
20 Connected in a practical way to the previously mentioned “Proposal regarding profiling.” In addition, an example of thisin practice can be found in the People Analytics and HR Technology Association article, “Request to distribute Personnel
Data Utilization Principles 1st Ed. and the Explanatory Video,” posted on 19 March 2020,
https://peopleanalytics.or.jp/news/2025/

21

The lack of clear and concrete standards regarding the handling of healthcare data poses a
potential reputational risk for companies that want to maintain a clean brand image andsocietal approval, and therefore that lack of clarity can have a chilling effect on businessgrowth. However, there is great variety in business strategies, and each company makes its
own decisions on whether to thoroughly comply with current law, or to proactively engage inrule-making. Any review must ensure that rules appropriately respect the judgement of eachcompany.
・The role of platform operators
Platform operators such as Apple and Google can function as gatekeepers by reviewing
healthcare data apps to determine rule compliance.
・The role of the public sector
It is necessary to assume that government bodies and other public sector organizations willplay major roles in this effort. From the perspective of monetizing data and business growth,
there is a tendency among companies managing and using personal information linked todiagnoses and other data to carefully protect it, and there have been no issues related tohealthcare data in practice. On the other hand, from a medical economics perspective, there isdemand for the acquisition, collection, and analysis of healthcare data from healthy subjects(not only for data that begins to be gathered after the discovery of an illness), although it ispossible that business operators may not voluntarily proceed forward with formulating theirown rules. For that reason, there is some merit to having healthcare data regulations beformulated by the public sector.
・Regulating objectives and risks
Different forms of governance are required during ordinary times, when health maintenanceand improvement is the objective, and during emergencies, when life-saving becomes thepriority. Moreover, it is possible to further divide data management during non-emergencies
into what is required for medical treatment and what is required for detecting illness, and whenneither of those apply, what is required for the management of everyday health. Additionally,
when it comes to business growth, there are also concerns about what must be kept in mind
when the data utilization objective changes after the fact. Ethical guidelines and codes ofconduct should be designed in accordance with the objective of the use of healthcare data, andany potential risks, by considering specific use cases.
・Use of employee healthcare data
There is demand for the use of employee healthcare data, for example, by obtaining datafrom those working remotely in order to maintain physical and mental health, and to prevent
employee turnover. Data related to mental health may require special consideration andhandling due to the potential of it being used to discriminate on the basis of marital status or
occupation. Here, business growth can be promoted by providing a code of conduct onconnecting company personnel data with healthcare data.
・Rules regarding display content and advertisements

22Issues have arisen regarding consumers harmed through the use of dubious, non-scientifichealthcare apps, and regarding subsequent over-regulation. In response to this problem, it may
be possible to consider adding new app categories to the Act on Securing Quality, Efficacy
and Safety of Products Including Pharmaceuticals and Medical Devices, in a way that
corresponds to the current food categories that allow for regulation of “foods with functional
claims" and "foods for specified health use." In addition, it can be assumed that regulations ofprize display and advertising will also be considered in order to protect consumers.
・Invasiveness, privacy, and other value-based issues
The use of healthcare data is generally not considered to be very invasive and it lies outside
the scope of medicine and the purview of ethics review boards in the medical fields, so there is
the risk that such bodies will not sufficiently consider privacy protections. For that reason, inorder to maintain such protections, consideration should be given to outsourcing such work toor collaborating with organizations with experience in the appropriate handling of personal
information like the Personal Information Protection Commission or organizations certified in
the protection of personal information. Of course, there has been little progress in theformulation of laws or the practical operation of systems for non-privacy-related values (e.g.
impartiality and the social value of data use). For example, there are still open questions
regarding how to manage bias hidden in data and algorithms, and how to conduct evaluations
from a medical economics perspective.
・Reviewing bodies and feedback
It was suggested that there are uncertainties regarding who will conduct ethical reviews ofhealthcare data utilization and that quality cannot be assured. It will also be necessary to
prevent so-called “forum shopping.” Certain guidelines may need to be implemented in orderto prevent this sort of situation. In addition, it will be difficult to gather knowledge if adecentralized review system is adopted, and there will be a problem with inconsistent
standards. It will therefore likely be necessary to gather information about the experiences andknowledge of each review board, and generate feedback to be provided in return. Any
economic incentives for the reviewing body should also be considered, e.g. in the case of aplatform operator reviewing applications for apps to be sold on its platform.
・Regular and substantive reviews
Consideration must be given to smooth, rapid processing of reviews. For example, reviews
related to genome analysis have application numbers in the tens of thousands, so theacquisition of consent and conditions of use based on that consent are processed regularly andautomatically matched. Consent and conditions of use must be regularly confirmed for
healthcare data as well, but a type of dual system can be considered for when future risk is
uncertain, or when review is conducted based on more flexible interests of the reviewee. Once
conditions of use are decided, it would be beneficial to determine which parts will be
determined automatically, and which will undergo substantive ethical review.
・Internal audits and external audits
As mentioned previously, ethical guidelines and codes of conduct should be designed inaccordance with the objectives of healthcare data use and any potential risks. Subsequently,that makes it possible to have a selection of auditing frameworks available, including internal
23

and external audits, and audits conducted by third-party committees. At the same time,attention should be paid to maintaining diversity among auditing personnel, to securing thepersonnel needed to conduct audits, and to securing administrative functions. In addition to theforming of ethics committees to regulate data usage, it is also conceivable to have data use
promotion committees that advocate for the societal value of data utilization. Other ideas
received include the establishment of numerous expert sub-committees, and structuring themain committee such that it provides summaries of all projects being undertaken. The methodsby which votes are placed, whether through unanimous decision, supermajority, etc., can also
have a major effect on actual operations.
・Other considerations
Other factors that are serving as hindrances to the healthcare data business include issues
surrounding standardization and data interoperability. Interoperability may need to beachieved under the guidance of the public sector. Also, technical standards that incorporate
Privacy by Design and other ethical aspects are being formulated. We would like to discuss
this point in cooperation with JIS and other working groups in the future. Other obstacles
include the difficulties in coordinating data sharing between national governments, local
governments, and the private sector. However, this issue is being addressed through the 2021
Amendments to the Act on the Protection of Personal Information, which aims to unify data
usage rules that adapt to the characteristics of different data handling organizations. These
trends should be watched.
Towards the Future
For this interim report, theories on the ideal ethical review system for the field of healthcare were
proposed; consultations were undertaken to obtain the opinions of businesses actually working in thefield; and the results were reviewed and analyzed.
The plan for the future is to create questionnaires (check sheets) for use in self-evaluation and thirdparty evaluation, and to organize a data handling framework for rules and systems that account for
healthcare data usage and ethical concerns in consideration of concrete use cases.
Healthcare Data and Ethics Task Force Members(Honorifics omitted; includes positions and affiliations at time of publication)
Members● Takehiro Ohya, Professor, Faculty of Law, Keio University (Task Force Chairperson)● Soichi Ogishima, Professor, Advanced Research Center for Innovations in Next-Generation
Medicine, Tohoku University● Fumiko Kudo, Visiting Researcher, Institute for Future Initiatives, University of Tokyo● Hitomi Sano, Researcher, Graduate School of Media and Governance, Keio University● Takashi Suyama, Researcher, Institute for Future Initiatives, University of Tokyo● Yutaka Tomiyama, Researcher, Graduate School of Humanities and Sociology, University ofTokyo● Yusuke Nagato, Specially-Appointed Assistant Professor, Research Center on Ethical Legal andSocial Issues, Osaka University● Takanori Fujita, Specially-Appointed Associate Professor, Keio University School of Medicine● Natsuko Yamamoto, Specially-Appointed Lecturer, Institute for Datability Science, Osaka
University.
24Advisors● Hiroaki Miyata, Professor, Keio University School of Medicine *General Manager of
PeOPLe/OPERA● Tatsuhiko Yamamoto, Professor, Keio University Law School● Shigeto Yonemura, Professor, Graduate Schools for Law and Politics, University of Tokyo

25

Appendix 3

Overview of comments received from overseas experts regarding the summary of the interim report

1. (USA) Supheakmungkol Sarin
Head of Data and AI Ecosystems, World Economic Forum
Overall comments:•

Definition of healthcare data: The text defines "healthcare data" as information gathered byhealthy adults in their daily lives for promoting better health and well-being. However,healthcare data can also include information collected by healthcare professionals or derived
from medical tests and examinations, as well as data related to individuals with chronic
illnesses or those seeking medical care. Is it better to use another term?

•

Invasiveness: The text states that healthcare data is "not directly invasive." However, theinvasiveness of healthcare data depends on the context in which it is collected, used, anddisclosed. If used improperly, healthcare data can be invasive and violate an individual's
privacy.

•

Personal information protection: The text suggests that healthcare data does not require "moreconsiderate handling" under personal information protection laws. This statement is notaccurate, as many jurisdictions have strict regulations in place for handling healthcare data or
sensitive personal information, such as GDPR in the European Union or HIPAA in the UnitedStates.

•Sensitive data: The text acknowledges that sensitive data could be used to infer private
information about a person's health. However, it's worth noting that even without continuous
data collection or under specific conditions, individual data points (like sleep and dietary
records) can still be sensitive and reveal information about a person's health or well-being.

Individual comments: Nine remarks (omitted here) made about content of the document

2. (South Korea) Son Hyeungseob
Professor, Kyungsung University
Question 1: In South Korea, are there any special rules (e.g. privacy laws or laxer guidelines)
regarding the handling of everyday “healthcare data,” i.e. that data which differs from the medical
information handled by hospitals?
Response 1: The Republic of Korea’s Ministry of Food and Drug Safety has guidelines governing thelicensing and review of AI medical devices. In accordance with Article 2 of the Medical Device Act,
those guidelines are applied to devices that provide disease diagnosis and management using medical
data analysis, and to machine learning-enabled medical devices (MLMDs).
MLMDs are unlike medical software that is used to detect or diagnose issues through existing
medical image analysis in that users or manufacturers can use training datasets to change the analysis
algorithms in real time.
26

This provision to the law includes software that falls under the definition of “medical device”, andsoftware that does not (e.g. exercise and leisure software, daily health management software, etc.) The
Ministry of Food and Drug Safety can classify and administer a device as “medical” even when it
originally falls under the “non-medical device” description if, when it analyzes both domestic andforeign documentation to determine applicability of the law, it discovers any risk in a product underdevelopment.
Question 2: Is the distinction between medical and non-medical devices stipulated in the Medical
Device Act? Also, are there any differences between how the two types of device are evaluated?
Response 2: According to Article 2, Paragraph 1 of the Medical Device Act, “medical devices” refers
to instruments, machines, devices, materials, software, and other similar products controlled by or
used in conjunction with either human individuals or animals, and that fall under any of the following
categorizations: 1) products used for the purpose of diagnosis, curing, alleviation of symptoms,
treatment or prevention of disease; 2) products used for the purpose of diagnosis, healing, alleviationof symptoms or otherwise correcting an injury or disability; 3) products used for the purpose of
examination, substitution, or transformation of body structure or functionality; and 4) products used toregulate pregnancy.
In the “Permit and inspection guidelines for medical devices to which big data and artificial
intelligence (AI) technologies are applied” released in 2019 by public request, there is a distinction
made between medical software categorized as “medical device” and medical software that is not.
Examples of the latter include software that collects data on insurance claim to support theadministrative work done by medical institutions, and software used for exercise and healthmanagement.
Question 3: Are there any particular penalties in place regarding the handling of non-medical devices
in the Ministry of Food and Drug Safety guidelines governing the licensing of AI medical devices(Complainant Guide).
Response 3: Article 51 (Penalties) of the Medical Device Act requires that any individual ororganization that obtains a manufacturing license (Article 6, Paragraphs 1 and 2), certification, or
report from the Ministry of Food and Drug Safety through deception or other wrongful means be
subject to a penalty that could include imprisonment of five years or less and a fine of no more than
50 million won. It is easy for forgery and other forms of deception to become apparent during theactual review process. In addition, the Ministry of Food and Drug safety has also introduced
regulations (by notification) governing permissions, notifications, examinations, etc. of medical
devices.
Question 4: When conducting clinical trials, do universities and other research institutions conduct
ethical reviews even when the objective of the trial is not the development of pharmaceutical products
or medical devices?
Response 4: At universities, ethical reviews of research are conducted by institutional bioethics
committees. The relevant law is the Bioethics and Safety Act. This is the same as the United States.
Article 10 of the Act requires that review boards examine the ethical and scientific validity of research
proposals, and examine any measures in place to protect personal information.
27

The “Medical device manufacturing and quality control standards” require that good manufacturing
practices (GMP) be implemented for high-level quality control of medical devices. This involves aninitial review, additional reviews, reviews when changes are implemented and periodic checks as
well. These reviews are conducted on-site in a joint effort by the head of the local Food and Drug
Safety Agency and the head of the quality control inspection office.
We also have U-healthcare systems harnessing ICT (defined in the guidelines for licensing andexamination of medical devices (released by public request)). Such systems fall under the definitionof medical device.
Question 5: Is there currently any movement towards creating a framework for the governance of
healthcare data (e.g. review systems and other procedures.) If not, would it be possible to implement
the type of company-by-company ethical review proposed by this report in South Korea?
Response 5: The certification and review of medical devices is based on Article 26 of the Regulations
on licensing, reporting and review of medical devices. That is based on Article 6 of the Medical
Devices Act (which states that a manufacturing license must be obtained from the Ministry of Foodand Drug Safety). There are specific provisions laid out for the licensing, reporting, and review of
medical devices. It allows for B2B sales, in which a company licensed for medical devices provides
its own corporate information to other companies, and B2C, which uses remote diagnosis to provide
services to consumers. Genetic testing is conducted with permission of the Ministry of Food and Drug
Safety. Users of personalized healthcare information, biotechnology associations, and remotediagnosis operations are revitalizing their marketing platform businesses using the MyData program.
For healthcare ethical review, it would likely be a good idea to provide general guidelines on the useof healthcare data, then set up either voluntary or legislated review procedures. Medical data forpatients that receive treatment is kept at each different hospital. Hospital data systems are designed tosupport hospital administrations in a comprehensive way by dealing with treatment, administration,
finances, legal issues, services, and more. It is necessary to develop a set of ethical and reliable rules
and guidelines in cases that a user visiting a hospital has cancelled their cloud computing contract andtheir healthcare data is to be uploaded to the cloud.
Question 6: Have you heard anything about businesses handling healthcare data (including public
sector operations) not being able to grow? For example, are there any businesses that avoid moving
into business areas where regulations are unclear because they want to avoid damaging theirreputation and becoming the focus of criticism?
Response 6: IoT equipment and other devices connected to digital healthcare are growing in number,and the MyData platform is being actively used as a means of acquiring consent. Healthcare data
includes a wide range of information about an individual’s illnesses and state of health, and that
information can be separated into different categories, including medical treatment data, dielectric
data, public sanitation data, and more. Digital therapeutics and remote diagnosis are currently being
implemented (by more than 20 companies in a regulatory sandbox). Public data is provided by thegovernment through the My Healthway program, and the plan is to commercialize this in the future(three years from now.) In South Korea, the 2020 revision to the Credit Information Use andProtection Act allows financial information to be used, and revisions to the Personal Information
Protection Act recognize the right to transfer information, so we are preparing for being able to use
medical data. There are still psychological barriers when it comes to medical data, but when using
only specific data in analyses, it will be able to be used in many areas.
28

Question 7: Do you think it would be useful to provide ethical guidelines and codes of conduct basedin specific use case examples to companies and other related stakeholders? One example would
include the creation of a code of conduct for the use of employee healthcare data.
Response 7: Nurses and other medical staff in health promotion teams at large companies use healthdata internally to look after employee welfare. Mid-sized companies collect data by having employees
exercise in gyms, checking their exercise amount, and then providing health advice. However, there
are no guidelines in place, and no means of conducting review yet. Such data is expected to be usedinternally through the consent of individual employees. However, it is highly likely that people areunaware about whether or not such consent extends beyond in-company use (for the purposes of
employee welfare) to research and commercial purposes, so it is necessary to implement concrete
procedures to obtain such consent.
Question 8: Do you have any opinions about creating an ethical review system governing healthcare
data usage at companies (including those not involved in medical research or advanced medical care),or about implementing a similar ethics review system for local or national government bodies that
handle healthcare data?
Response 8: Review procedures are currently being implemented in South Korea to allow medical
devices to receive approval of the Ministry of Food and Drug Safety, and smart health devices definedas “medical devices” are included. However, review procedures for non-medical healthcare devices
are not being properly observed. With medical data, this becomes an issue in South Korea under the
Personal Information Protection Act. There needs to be a standardized system of ethical review forcompanies using non-medical ICT devices as they come into more common use, even when they arebeing used internally. This is particularly true when it comes to healthcare devices with cognitive
functionality – ethical guidelines and regulations for review need to be formulated. If such ethicalregulations do not function well enough to prevent their use becoming a social issue, the laws
themselves will have to be amended to include such types of ethical review. If safety standards for
medical and non-medical ICT healthcare equipment can be implemented, local governments can thenestablish bodies that review the safety standards in light of the law just as the central government
would do, rather than create ethical standards that differ by locality. If Japan is able to introduce
ethical and review standards in both the private and public sectors governing healthcare products,
artificial intelligence, and other issues, I expect that this will have a positive influence on similar
efforts in South Korea and other neighboring countries.

3. (Malaysia) Chin Hai Teo
Senior Lecturer, Universiti Malaya
The publication of the Interim Summary of "Report on the Ethical Review System in the Healthcare
Sector” by the PeOPLe Co-Creation and Utilization Consortium’s Task Force on Healthcare Data andEthics is timely and commendable. Although data privacy and confidentiality is a well-known issue,
there is a lack of official guideline that could guide healthcare institutions and companies in managing
personal health data of the people particularly wellbeing data obtained on a daily basis. This halts theeffort to untap the true potential of big data in health care. The effort led by the PeOPLe Task Forcecould potentially bring a solution to this persistent issue.

29

Many of lifestyle monitoring mobile apps offer rather good benefits to the users in monitoring theirhealth, hence leading to consistent use of the apps by the users. However, the users often do not give
much attention to how the app providers would use their data and how they keep the data safe. As
witnessed in other countries particularly the developing countries, the public’s awareness about data
privacy is still low. The people often fail to give sufficient attention to data privacy, perhaps they are
not aware about the potential risk of their information being abused. In most cases, people do not readthe terms of use of apps that they install and accept the terms without much thought. Studies have also
shown that the people have low e-literacy skills in appraising quality and trustworthiness of healthapps. These could potentially put them at risk of their information being abused. Japan is a highly
looked-up developed countries but there bound to be some population with lower literacy that may not
be aware and do not take proactive precaution about their personal data. Knowing the public’s needs
and providing sufficient education to the public on data protection is also crucial besides enhancing
data management from the healthcare providers’ perspective.
That aside, this report looked at the management of wellbeing data such as diet, physical activity andpulse instead of disease-based data. This complies with the current norm or practice as disease-based
information are considered sensitive and could potentially cause discrimination or bias in various
aspects including finance, opportunity and social status. That being said, as technology matures
particularly in this big data digital era, synergising wellbeing data with disease data could help makehealth prediction more accurate, so that doctors could provide more precise intervention or
management to the patients (precision medicine), preventing patients’ condition from deteriorating
and improve their survivability. With sufficient data, strong prediction could be done even atprevention stage before someone developing diseases. Currently, the wellbeing data or so-called
patient-generated health data are not well-integrated with the medical data in the hospital. This isperhaps due to the lack of guideline and uncertainties faced by health institutions to move thisforward. There are still debates about who is the owner of the patient data in the hospital to date. Data
are now scattered sporadically and not well consolidated. Only when ‘all is one’, a powerful potential
could be unleashed. It would be great if the PeOPLe Task Force could somehow include this when
discussing and proposing the way forward in managing health care data.
At one point in the report, it was mentioned that the governance of health data in ‘ordinary times’
should be different from ‘emergency times’, which is very much agreed upon. During the COVID-19
pandemic, many countries made it compulsory for personal data of the people such as COVID-19
status and locality to be submitted to a central application typically managed by the government. That
has enabled effective surveillance to be done to control the outbreak of COVID-19. An all-in-one
perhaps nationally integrated health data warehouse could be powerful in improving health care. To
date, it has been a struggle to integrate health systems into one in many countries. A top-down
approach by the government during COVID-19 pandemic has shown us a glimpse of the great
potential of having an integrated health data system. However, this brings us back to the autonomy
ethics principle where everyone has the rights to their own data and should not be forced to share thedata with others. There is a need to strike a balance in creating policy on this matter so that the
maximum potential of health care using big data could be unleashed while keeping in-tact thepeople’s autonomy. Learning from successful countries such as Estonia in implementing an integrated
health system would be advisable, to adopt their effective strategies and policies in health data
governance considering multiple perspectives including the government, healthcare institutions andthe people.
The PeOPLe Task Force’s effort in getting views from the business leaders in healthcare is also
praiseworthy. Nothing worth more than hearing first hand from the end users to identify the gaps andneeds in health data management. The 11 suggestions from healthcare business leaders compiled by
the task force will serve as a good base to start off towards the formation of a guideline on ethical useof healthcare data. They are very comprehensive views covering multiple perspectives. I am
particularly fond of the idea of creating a check sheet which would be beneficial and practical inensuring the important criteria in managing health data are met. Perhaps, the formation of the checksheet could benefit from the Delphi methods, by gathering consensus from a big group of stakeholders
30

of different roles such as policy makers, healthcare directors, health system technicians, lawyers,
academicians and others to ensure that the check sheet is comprehensive and applicable to most. Thismammoth task will only show fruit via a concerted effort by multiple parties, led by trustable,passionate and empathic leaders in Keio University. I sincerely hope my humble opinions could offersome use to the team and I look forward to the next interesting outcomes from the project!

31