European Standards on Confidentiality and Privacy in Healthcare Dr Colin M Harper Division of Psychiatry & Neuroscience Queen’s University Belfast Biotechnology, Culture, and Human Values in Asia and Beyond Eighth Asian Bioethics Conference Bangkok, Thailand March 19-23, 2007

“Europe isn’t a continent, it is a peninsula at the edge of Asia!”

Europe? European Union (EU)-- 25 (+2) Member states 457 million people Enacts ‘hard’ law for member states ‘Single Economic Market’ key focus Council of Europe (CoE) Member states 800 million people ‘Softer’ Standard setting Human rights / Democracy

European Norms in field of Privacy in Healthcare Confidentiality Ethics & Law (Human) Right to Privacy (CoE) Data Protection Law (EU)

European Standards on Confidentiality and Privacy in Healthcare (EuroSOCAP) European Commission (EU) funded project examining the fundamental ethical requirements of privacy and confidentiality of healthcare information in an EU context. It had a focus on ensuring that European level ethical guidance contained the effective protections necessary for vulnerable patient groups (e.g. prisoners, migrants, children). Examined healthcare confidentiality in the context of EU data protection law and both International and European human rights law.

EuroSOCAP Project Team Project Team: 18 healthcare professionals, legal experts and ethicists from 10 European states. Additional expertise recruited as considered necessary. Project coordinated from the Division of Psychiatry & Neuroscience, Queen’s University Belfast, Northern Ireland, UK.

EuroSOCAP Project Objectives to identify the main issues and social concerns surrounding the confidentiality of healthcare information together with the existing ethical obligations and legal requirements; to identify and review existing legal provision, policy documents and professional guidance on confidentiality impacting on healthcare; to prepare and disseminate European Ethical ‘Standards’ on confidentiality and privacy in healthcare to prepare web page on confidentiality and privacy for EU healthcare professionals and other relevant stakeholders.

Development of Standards Feb 2003Draft Standards developed by Project team through 5 Workshops - June 2005 June 2005Draft Standards circulated widely for consultation. September Workshop attended by 80 experts/stakeholders from 26 states: 2005 Patient Organizations, National Medical Associations, National Ministries of Health, National Data Protection Authorities, the European Commission, industry, universities, and relevant international organizations. October Revised Draft Standards prepared and circulated for a further 2005 round of consultation. NovemberStandards finalized at a meeting of the EuroSOCAP 2005Project Board.

Examples of issues where differences arose Confidentiality after death? Breach of confidence a criminal offence? Need for consent for secondary uses? What level of risk of harm to a third party justifies disclosure of confidential health information? Public benefit of medical research v individual right to privacy? Kinds of technology used in healthcare service?

European Standards on Confidentiality and Privacy in Healthcare

European Standards on Confidentiality and Privacy in Healthcare The Standards provide: Ethical Guidance on confidentiality and privacy to healthcare professionals. Recommendations to healthcare provider institutions on supporting frameworks for ethical best practice.

Contents of EuroSOCAP European Standards on Confidentiality and Privacy in Healthcare Ethical & Legal Foundations of the Standards Protection, Use and Disclosure of Patient Information— General Considerations (e.g. consent, lack of capacity) Protection, Use and Disclosure of Patient Information for their Healthcare Protection, Use and Disclosure of Patient Information for Healthcare Purposes not Directly Related to their Healthcare (audit, research, management of services) Obligations and Justifications for the Disclosure of Patient Identifiable Information for Purposes not Related to their Healthcare (e.g. crime prevention, public safety)

Dissemination and Take-up of Standards Work continues on promoting the Standards with stakeholder groups, in particular with European level healthcare professional organisations, focussing on training. Website is key resource.

Website The web site includes: the Standards in 5 languages and Guidance in a further 20 languages; an online searchable database of links to relevant material; an online searchable database of interests and contact details of individuals from across Europe interested in the area of healthcare confidentiality and privacy; an based news service. An online forum for discussion of healthcare confidentiality and privacy.

How are the European Standards being used in different contexts? Better take up at national level by data protection sector. Better take up by public health sector at European level. European Standards seen as relevant in different respects by different European countries e.g. electronic health record in UK and Netherlands, state accessing health records in post-Stalinist/post-Fascist states.