Sensitive data and medical confidentiality

So far, you have learned the basics of data protection in light of the GDPR. However, for health data there is an additional set of rules.

Data concerning health means personal data related to the physical or mental health of persons, including the provision of healthcare, which reveal information about a persons’ health. The GDPR determines that certain types of data fall under a special category of personal data. This includes ‘data concerning health’ (Article 9 GDPR). This special category of personal data is also referred to as ‘sensitive data’, because these types of data require additional protection as they can go to the very core of a human being. Health data comes within a person’s most intimate sphere. Unauthorised disclosure may lead to various forms of discrimination and violation of fundamental rights. The risk of data processing generally does not depend on the contents of the data but on the context in which they are used. The processing of special categories of data is likely to lead to violation of individual rights and interests. Personal data, which are, by their nature, particularly sensitive in relation to fundamental rights and freedoms, merit specific protection as the context of their processing could create significant risks to the fundamental rights and freedoms.

Processing sensitive data

In principle, processing of sensitive data is prohibited, unless one of the exemptions mentioned in Article 9 GDPR applies and suitable safeguards, so as to protect the data, are put in place. Suitable safeguards include for example pseudonymisation (replacing the most identifying fields in a data record) and encryption (encoding the data in such a way that only authorised parties can access it) (see Article 32 GDPR). Derogating from the prohibition to process special categories of personal data including health data is allowed when for example:

• explicit consent was given by the data subject;
• processing is necessary to protect the vital interests of a person if this person is (physically or legally) incapable to give consent (for example in emergency situations or with minors);
• processing is necessary in order to provide healthcare if the data is processed by or under the responsibility of a professional subject to the obligation of professional secrecy.

Professional secrecy, also referred to as medical confidentiality, or doctor-patient privilege, or the Hippocratic Oath, prohibits a medical professional to disclose information about a patient’s case. This is a very old obligation within the medical profession which dates back at least to the father of Western medicine Hippocrates in ancient Greece. The obligation is of the utmost importance in order to create trust between a doctor and his patient and a trusting environment in which the patient feels comfortable. It is based upon the idea that, if patients cannot trust a physician’s discretion they will not seek medical care altogether or will withhold information during a consultation. If a physician does not have (accurate) information on a patient’s health, this may lead to an inaccurate diagnosis and improper treatment which may lead to great harm to the patient’s health.

Ethical and legal obligations

While the obligation has been around for ages, the duty of confidentiality was put in writing by the World Medical Association (WMA) only in 1948 in the WMA Declaration of Geneva. The Declaration is part of the internationally recognised ethical codes of conduct or guidelines and duties for medical professionals. In this Declaration all members to the medical profession promise to respect the secrets confided in them, even after a patient’s death. Confidentiality and privacy are related principles, both protecting the patient from disclosure of medical records. While confidentiality is generally considered as an ethical rule for medical professionals and privacy as a legal issue, many countries have also codified medical confidentiality within national laws or common law principles, meaning that medical information may not be disclosed without the consent of the patient. Healthcare providers are thus generally bound by law to the duty of confidentiality and privacy.

You will find out more about the obligations for healthcare providers in the next video.