Health Surveillance — The Control-Grid Component

Health surveillance is the component with the most sympathetic cover story and the cleanest demonstrated abuse. A health credential is built for an emergency — a pandemic, a benefits system, a continuity-of-care record — and then persists, repurposable, after the emergency ends. The pandemic produced the proof-of-concept everywhere; what varies is whether the infrastructure was dismantled, federated, or kept. Scored in the Convergence Index.

China

China supplied the definitive case that a health credential becomes a control credential. During COVID, the mandatory health-code app gated movement by color status — and in Zhengzhou in 2022, authorities turned depositors’ codes red to block them from physically reaching a bank where their savings were frozen, an explicit repurposing of a health tool to suppress a protest (CNN). The capability did not retire with the pandemic; it demonstrated its second use and stayed. No limit, full integration with the identity layer.

European Union

The EU built the cleanest version and then helped globalize the standard. The EU Digital COVID Certificate was interoperable and time-bounded by its own founding regulation, which wrote a twelve-month sunset into the instrument itself (Regulation (EU) 2021/953) — but its technical model became the seed of the WHO Global Digital Health Certification Network, which adopted the EU system as the basis for a worldwide health-credential standard (European Commission). The bounded national deployment is the good-governance story; the export of the standard to a permanent global network is where the persistence risk re-enters.

India

India is building a permanent national health stack by design. The Ayushman Bharat Digital Mission assigns every citizen a health ID linking records across providers (ABDM) — the health layer of India Stack, sitting on the Aadhaar identity rail. It is framed as continuity-of-care and is genuinely useful for that; it is also a unified, identity-linked health record of a billion-plus people, which is exactly the asset that, elsewhere, got repurposed. Comprehensive and growing; limits are the ordinary data-protection kind under the DPDP Act’s government carve-outs — and those carve-outs are written into the statute, which lets the central government exempt any State instrumentality it notifies from most of the Act’s obligations (Digital Personal Data Protection Act, 2023, §17 — India Code).

United States

The US has no unified health-surveillance system — and a privacy law with law-enforcement-shaped holes. HIPAA is real protection, but its own text permits disclosure to law enforcement under a range of conditions without patient consent (HHS). After Dobbs, those permitted-disclosure provisions became the live fight over whether health records (period-tracking, out-of-state care) could be subpoenaed in prosecutions. Fragmented, no central system — but the carve-outs are the door, and the data brokers around HIPAA’s edges are the wall with no door at all.

United Kingdom

Where the US health-data grid runs through HIPAA carve-outs and private insurers, the UK centralizes into a single national provider and hands it the plumbing. NHS England awarded the Federated Data Platform to a Palantir-led consortium in November 2023, a contract worth up to £330m over seven years (Digital Health). The precedent is care.data, the 2013 scheme to pool GP records for third-party access, abandoned in 2016 on the day the National Data Guardian published a review finding the consent model unfit — the programme was closed rather than defended (National Data Guardian — Review of Data Security, Consent and Opt-Outs; Wikipedia — care.data). The parliamentary-sovereignty shape: no entrenched health-privacy right to litigate against, only the political brake, which killed care.data but not the FDP.

The counter-argument

Health data integration saves lives — unified records prevent fatal drug interactions, speed emergency care, and let a public-health system see an outbreak coming. The pandemic credential, in its bounded form, let societies reopen. The defect is persistence and repurposing: infrastructure justified by an emergency that outlives the emergency, under an identity link that lets a medical fact gate a non-medical outcome. The component scores the surveillance capability; whether it was sunset, federated, or kept is what the “limit” axis tracks. See also payment freezing — Zhengzhou is where the two components met.

Part of the Convergence Index component set — scored in the convergence table.

Related research

• The body layer · Healthcare data — the fuller receipt trail
• Payment freezing — Zhengzhou is where the health-code and the account-freeze met