Legal aspects of Health Data protection Solvita Olsena Medical Law Institute Ltd.

Heath data protection “Protecting the privacy of patient information is a major challenge facing the health sector. Today’s patients expect, and are entitled by law to receive, a high standard of medical privacy”. Tranberg H., Rashbass J. “Medical records: Use and abuse”

Health Privacy rights are protected by: United Nations: Universal Declaration of Human Rights Council of Europe: Convention for the Protection Individuals with regard of the Automatic Processing of Data EC Directive 96/46/EC On the protection of individuals with regard to the processing of personal data and on the free movement of such data

Health privacy rights Informational privacy: Individuals' right to control the use and dissemination of their personal information Doctors Duty of confidentiality – prevents doctors from using or disclosing confidential information obtained within the confines of the doctor – patient relationship for any purpose other than that for which it was provided.

Examples of privacy breaches A secondhand laptop memory stick, purchased by UK estate agent, was found to contain confidential clinical records for 13 cancer patients A new IT system installed in a UK hospital mistakenly allowed general access to all laboratory tests ordered by general practitioners. The error was discovered when a nurse found her own test results on the system. Several thousand identifiable patient records at the University Michigan medical Center were accidentally posted on public internet sites. Tranberg H., Rashbass J. “Medical records: Use and abuse”, p.18-19

EC directive 95/46 Member States shall prohibit the processing of data concerning health or sex life, except: processing of the data is required for the purposes of preventive medicine, medical diagnosis, the provision of care or treatment or the management of health-care services, and where those data are processed by a health professional subject under national law or rules established by national competent bodies to the obligation of professional secrecy or by another person also subject to an equivalent obligation of secrecy

The most important Principles of Health data processing Fair processing Lawful processing Processing for one or more specified and lawful purpose In accordance with rights of the data subject

Health data protection Sir John Patisson, former Director of Research, Analysis and Information Department of Health, UK “We must ensure that the safeguards are in place to protect patient confidentiality and that when we need to use medical information for purposes not directly related to an individual’s own medical care, such as health service planning, performance monitoring and research, it is undertaken in a transparent and appropriate way”