Clarifications from the Garante della Privacy (Italy's data protection authority) on the application of the rules for the processing of health data in healthcare
With decision no. 55 of 7 March 2019, the Garante della Privacy (Italy's data protection authority) provides some clarifications on the application of the rules for the processing of data relating to health in healthcare sector.
Following the new wording of theart. 75 of the code you no longer need to collect consent to data processing for the purpose of protecting the health and physical safety of the data subject.
When consent does NOT need to be requested
In particular, the following categories are listed, for which data processing is lawful without the prior consent of the data subject
- Reasons for substantial public interest on the basis of Union or Member State law
- reasons of public interest in the area of public health
- Processing is necessary for purposes of preventive medicine, diagnosis, health or social care or treatment, or management of health or social care systems and services
What is new is that the healthcare professional no longer has to ask the patient for consent for the processing of personal data where it is necessary to deliver the health service, whether you work in a medical practice or as a self-employed professional.
When consent IS needed instead
Consent must be asked for when the purposes of the data processing are not strictly necessary for care purposes. For example, we can list the following cases
- Use of medical apps that collect the data subject's data such as the practice management software BeebeeBoard
- Data processing for customer loyalty purposes of customers, such as loyalty points schemes.
- Use of data for promotional or advertising purpose such as promotions on their own programmes or hotel-style stays.
- Use for commercial or electoral purpose
- Processing through Electronic Health Record
- Delivery of the medical report online
So, to the question of whether I use practice management software to process my patients' data, such as BeebeeDoc can I skip asking them for consent to data processing? The answer is obviously no.
You can find an excellent infographic summarising data processing in healthcare directly on the the Garante della Privacy website.
