Korea has accumulated a gold mine of healthcare data and cannot use it... A paradigm shift is needed [Daeryun’s Biz law forum]

We have world-class data and infrastructure
Compared to developed countries, the utilization of high value-added areas is low.
Technology advancement and system improvement must occur simultaneously

The 21st century economy is driven by data. In particular, healthcare data is a strategic resource that can simultaneously improve public health and drive future industrial growth. Although Korea has the world's best medical system and information technology (IT) infrastructure, it faces a structural limitation called the 'data paradox' as its laws and institutions cannot keep up with the pace of technological development.

The solution is not simply deregulation. A paradigm shift is needed to redesign laws and institutions to facilitate data use. There is a clear path to simultaneously create industrial development and social value while ensuring safety and trust. Developed countries are already leading the way.

EU and US find balance between information protection and utilization

While establishing a strict personal information protection system through the General Data Protection Regulation (GDPR), the European Union (EU) is presenting an innovative model that integrates and utilizes medical data from 27 member countries through the 'European Health Data Space (EHDS)'. This is an example that demonstrates that personal information protection and data utilization are not in conflict but rather are complementary to each other.

The US approach is more pragmatic. The '21st Century Cures Act' defines the refusal of legitimate data sharing requests by medical institutions as information blocking, making it subject to legal sanctions. By mandating standard APIs, we have built an ecosystem where patients, researchers, and companies can quickly access the data they need. A nationwide medical information exchange network is being established through the 'TEFCA (Trusted Exchange Framework and Common Agreement)', and currently, under the 10 'QHIN (Qualified Health Information Network)' systems, clinicians, hospitals, clinics, nursing facilities, public health authorities, etc. are forming a unique network of about 41,000. The Food and Drug Administration (FDA) is using real-world data (RWD) and real-world evidence (RWE) to significantly lower the barriers to market entry for innovative medical devices.

Korea is overflowing with resources but unable to utilize them

The healthcare big data held by major public institutions such as the Health Insurance Review and Assessment Service, National Health Insurance Service, and Korea Disease Control and Prevention Agency is the world's best in terms of scale and quality. However, its utilization in high value-added areas such as new drug development, precision medicine, and digital therapeutics is still limited.

The core problem is multi-layered. Data compatibility issues due to heterogeneous systems and lack of standardization among medical institutions, reduced analysis efficiency due to fragmented data structures, and, above all, expulsions due to conservative interpretation of legal regulations are causing a complex effect.

It appears that state-led integrated platform projects such as 'Establishment of National Integrated Bio Big Data' can become a key foundation for overcoming these structural limitations. Currently, the first stage (collection of genome data of 772,000 people) is in progress, but the recruitment of participants is delayed and institutional participation is low, which puts a red flag on achieving the goal. This is why technological advancement and institutional improvement must occur simultaneously.

More specifically, the sophistication of personal information de-identification and pseudonymization technology, compliance with international standards for electronic medical records (EMR), medical images, and genome data, and the safe opening and expansion of the scope of use of cutting-edge omics data such as spatial transcriptomes and single cell transcriptomes must be carried out in parallel.

Consistency of laws and guidelines is also an urgent task. Article 28-8 of the current Personal Information Protection Act prohibits overseas transfer of personal information in principle, but strictly requires safety measures and procedural requirements when exceptions are applied. In particular, detailed standards for overseas transfer and combination of pseudonym information are still being refined, so there is uncertainty in practice. It is time to rationally improve data transfer requirements and procedures for global research cooperation and industrial development, assuming appropriate safety measures.

What we can learn from the Ministry of Food and Drug Safety’s ‘AI medical device regulatory innovation’

The answer is already within us. The Ministry of Food and Drug Safety's innovation in regulating artificial intelligence (AI) medical devices is evidence of this. The results of establishing the world's first generative AI medical device approval and review guidelines and allowing rapid market entry on the premise of meeting Good Manufacturing Practices (GMP) and minimum performance requirements are surprising. The number of AI-based medical device approvals has more than doubled in three years, from 47 in 2022 to 108 last year. It is assessed that Korea has emerged as a leader in global digital healthcare regulatory innovation, both in name and reality.

This success was possible thanks to the adoption of the ‘promote use while adhering to principles’ approach rather than ‘permit after prohibition’. Safety and quality standards were clearly set, and the system was designed to enable rapid use without excessive procedural burden when these are met.

Need for a paradigm shift from ‘positive → negative’

There is a need to spread a pragmatic approach throughout data policy. The key points are as follows:

First, there is a clear definition of safety and standardization requirements. Ambiguous standards lead to overly conservative interpretations, which in turn lead to delays in innovation.

Second, it is procedural efficiency that ensures rapid utilization when requirements are met. The complex and lengthy approval process itself becomes a barrier to entry.

Third, there is a need for a fundamental shift from the existing 'positive method' to a 'negative method' that promotes utilization while adhering to basic principles such as safety and personal information protection, rather than simply expanding the scope of exceptions.

An era where law becomes a partner of innovation

Healthcare data is a key asset of the 21st century that can simultaneously realize the social value of industrial development and guaranteeing the people's right to health. If we simply continue to accumulate, this precious resource will simply go to waste.

Safety and innovation are not zero-sum games. The Ministry of Food and Drug Safety's AI medical device regulatory innovation case clearly proves this. Through appropriate institutional design, the two values ​​can be mutually reinforcing.

When the law functions as a partner rather than an obstacle to innovation, both values, industrial innovation and public convenience, can be realized. The golden time for change is now.

[View full article]
Korea has accumulated a gold mine of health care data and cannot use it... A paradigm shift is needed [Daeryun’s Biz law forum] (Shortcut)