he Act on Anonymized Medical Data That Are Meant to Contribute to Research and Development in the Medical Field (commonly known as the “Next-Generation Medical Infrastructure Law” [hereafter, NGMIL]) is a law enacted in May 2017 in Japan. Its purpose is to achieve both protection of personal information and promotion of the use of medical information/data, aiming to develop economic society and improve public health. It came into force in May 2018. But progress has been slow, and more cooperation is needed among different stakeholders to implement it in full. The NGMIL Supplementary Rules state: “At the time when 5 years have passed after the enforcement of the Act, the implementation status shall be examined, and measures shall be taken as necessary.” A working group for this purpose has already been established and started, and 2023 is the opportune time to discuss NGMIL.

Why the NGMIL?

The NGMIL stipulates a scheme to grant permission to certified business operators for handling medical information/data: Certified Producers of Anonymized Medical Data (hereafter, Certified Producers) and Enterprises Certified for Entrustment with Handling Medical and Related Information and Anonymized Medical Data (hereafter, Enterprises Certified for Handling). This made it possible for Certified Producers to collect medical information/data that had not been collected before the law was enacted and provide the collected data to third parties.

In addition, numerous medical information databases are currently available in Japan, but the medical information/data is kept in different ways. For example, medical information/data is available under the universal health insurance system in Japan, so the health records of all Japanese citizens can be collected, but medical insurers maintain separate medical information databases. This makes it difficult for researchers to select appropriate databases for conducting their studies. It would be helpful to establish a mechanism to gather and link medical information/data located and kept at different medical insurers or medical database owners to accelerate such research and/or data analyses.

Finally, the NGMIL was necessary to accommodate enforcement of the revised Act on the Protection of Personal Information which came into effect in May 2017. Per this revised act, when providing personal information including medical history to a third party, the consent of the subject must be obtained in advance, except for academic research. In the case of academic research, anonymized information may be provided to third parties under less stringent rules than personal information according to the act on the Protection of Personal Information. The NGMIL is issued as a special law of the Act on the Protection of Personal Information so that medical institutions simply need to notify relevant subjects and provide them the opportunity to say no before providing Certified Producers with their medical information/data. They do not need to obtain each subject’s consent.

Did NGMIL Resolve These Issues?

More than 20 studies using medical information databases provided by these Certified Producers and Enterprises Certified for Handling have begun. Such data sets are available for academia free of charge or at a lower cost than industry, but currently, more than two-thirds of these studies are company-sponsored. Because human resources are required, expenses have become an obstacle to promoting use of these data sets. One solution may be for companies to provide funds to academic researchers. These data set studies may move forward more quickly if companies promote them more.

Measures to establish a mechanism to link different sources of medical information/data are being discussed, but no solution has been reached. The availability of an extensive medical information database may improve this situation. The Expert Working Group on NGMIL established by the Japanese government came up with linking a medical database constructed by a certified producer with the NDB. The NDB has sufficient data volume because it contains medical information/data on a national scale, despite not including patient outcomes.

It is not necessary to obtain informed consent under the NGMIL, but it is mandatory to notify subjects individually before using their data; subjects have the right to opt out. This notification flow defined in the NGMIL requires considerable effort beyond posting notices on websites or internet message or bulletin boards. Each medical institution must establish its own notification mechanism, and some are assigning clerical staff to this specific purpose.

Future Utilization of Real-World Data