As someone working in the field of health communication, my research constantly returns to a simple but urgent question, ‘How do people understand, share, and protect their health information?’ In Bangladesh, this question is becoming increasingly important as healthcare systems slowly digitise and data flows expand beyond clinic walls. Yet public understanding, and institutional practices have not evolved at the same pace.
Bangladesh does not yet have a comprehensive law dedicated to health data protection. Instead, the country relies on a scattered set of legal instruments such as the Cyber Security Act 2023 (which replaced the earlier Digital Security Act) and the Right to Information Act 2009. Both of which touch on data governance in broader terms.
More recently, the interim government introduced the Personal Data Protection Ordinance 2023, an important step toward formalising data privacy protections. However, as it currently stands, it remains an ordinance, yet to be fully enacted and institutionalised. This distinction matters.
Globally, the contrast is stark. The United States enforces strict protections under the Health Insurance Portability and Accountability Act (HIPAA), while several African and South Asian countries have already moved toward sector-specific data protection frameworks. Bangladesh, meanwhile, continues to operate without a clear and standard for health data.
At first glance, all personal data might seem equally sensitive. But health data occupies a distinct category. It includes medical records, diagnostic results, prescriptions, mental health history, reproductive health information, and even biometric identifiers. Misuse or exposure of such data can lead to stigma, discrimination, financial exploitation or psychological harm. For example, disclosure of mental health conditions or fertility treatments in a society like Bangladesh can have serious social consequences.
From a communication perspective, health data is not just information. It is trust. Patients share it with the expectation that it will be protected, used ethically and not disclosed without consent. When that trust is broken, it doesn’t just affect one individual. Rather it erodes confidence in the entire healthcare system.
Bangladesh’s healthcare system is currently in a hybrid phase. Much of the country still relies on paper-based records. Files stacked in hospital cabinets, handwritten prescriptions and manual data entry. This system, while seemingly low risk in terms of digital breaches, carries its own vulnerabilities including loss, unauthorised access and lack of traceability.
At the same time, private hospitals and some urban healthcare facilities are gradually adopting electronic health record (EHR) systems. This digital shift brings efficiency, but also introduces new risks, like data breaches, unauthorised sharing and weak cybersecurity practices.
Thus, Bangladesh needs a framework that addresses both realities. Securing physical records in traditional settings while ensuring robust digital safeguards in modern systems. Ignoring either side would leave significant gaps.
Perhaps the most critical and most overlooked aspect of health data is the privacy concern and patient’s consent. In theory, consent is the cornerstone of ethical data use. In practice, it is often reduced to a signature on a form, rarely explained and almost never questioned.
In many healthcare settings especially during emergencies, patients or their families sign documents without fully understanding what they are agreeing to. The urgency of medical care overrides the need for informed decision-making.
This raises several important questions: Are consent forms written in clear, accessible language? Do patients understand how their data will be used, stored, or shared? Are they given the option to refuse or limit data use?
Improving health data privacy is not solely the responsibility of policymakers. It requires a multi-layered approach involving government bodies, healthcare institutions and civil society.
Civil society organisations, media and public health communicators have a crucial role. Awareness campaigns through billboards, social media and community outreach can help citizens understand their rights. Just as people are educated about vaccination or hygiene, they should also be informed about data privacy.
Health communication strategies must move beyond technical jargon messaging like, what happens to your medical data? Who can access it? What rights do you have? Without this awareness, even the best policies will remain ineffective.
Ultimately, the issue of health data privacy in Bangladesh is not just legal or technological. It is cultural. It requires a shift in how institutions view patient information, not as a resource to be managed, but as a right to be protected. The growing digitisation of healthcare in Bangladesh presents both an opportunity and a risk. Without a dedicated framework for health data privacy, the country risks falling behind, not just technologically but also ethically.
The writer is an Assistant Professor, Mass Communication and Journalism, Bangladesh University of Professionals
