Healthcare

GDPR and health data: Main principles

Minimization principle

One of the main principles of the GDPR stipulates that the data processing operation be suited, relevant and limited to what is strictly necessary with regard to the purposes defined and the collection processes.

Information principle

Contrary to popular belief, even healthcare professionals have an obligation to inform.

The GDPR seeks to promote trust between data subjects and data processors (DP). For this reason, it requires DPs to inform data subjects and be transparent.

A DP must inform data subjects of the reasons their data was collected and of the way it will be processed.

• For direct data collection: When the data is collected
• For indirect data collection: As soon as possible, and at the most within 1 month.

The DP must also inform the data subject if the processing activity is substantially modified or in case of a special event. For example, creation of a new purpose, changing the procedure for making data subject requests, a data breach, etc. To simplify these processes and get all stakeholders involved, Data Legal Drive offers a GDPR compliance software program that is preconfigured for the healthcare sector.

The only exception concerns the protection of a person’s vital interests. The main access mode involves Reference Methodologies (MR), which are simplified procedures for accessing health data. This point is not part of the GDPR, but it remains important for SDISs (French departmental firefighting and emergency services) and other emergency services.

Collecting health data: how do you inform data subjects?

The information must be given in a way that is “concise, transparent, understandable and easily accessible, using clear and simple language”.

• Use simple vocabulary suited to the target audience
• Provide short and legible information
• Tailor the information to the situations and media
• Prioritize the items of information and don’t hesitate to deliver the information via a multi-level architecture

Principle of storage limitation and data destruction

From data collection to intermediate storage, to permanent archiving, to data destruction, to the storage times required by the GDPR, health data processing is governed by special rules clearly defined by the CNIL. To facilitate formalities for the medical entity, use of a GDPR compliance software such as Data Legal Drive facilitates monitoring of storage times for each processing activity.

What are the storage times in the healthcare sector?

• R112-7 CSP – Patient management by healthcare facilities: For the length of management + 20 years after last visit for care;

Exceptions: death (10 years) – minor (up to 28th birthday if storage time ends before 28th birthday); transfusion records (30 years after last visit) – suspension for recourse and legal proceedings.

• Management of medical and paramedical offices: 5 years in active database after last consultation + 15 years in intermediate storage.
• Pharmacies: storage mainly in intermediate database
• Medical labs: depends on processing. For basic processing – Patient record: 5 years after last operation + 15 years in intermediate storage.
• Remote transmission of treatment forms:
• 3 business days if direct payment by insured party (8 business days if fee waiver) + 90 days in intermediate storage.
• Social security reimbursement record: no active database, 2 years in active database. Starting on first day of quarter following quarter in which services were delivered.
• Pharmaceutical record: depends on data
• DMP (shared health record): use by patient + 10 years after closing of record.
• Other special data: screening for breast cancer – cancer of the colon – cervical cancer, healthcare prevention programs.

Adapting to the health situation

After a difficult health situation tied to Covid-19, the introduction of the Pass Sanitaire (French health pass) and the Tous AntiCovid app, the fight against the epidemic required the implementation pf new processing activities, namely:

• Processing tied to medical and vaccine research with the vaccination campaigns and health data considered to be sensitive
• Processing tied to population monitoring with use of videosurveillance drones by police in order to monitor populations and ensure lockdown measures are observed; in connection with thermal or smart cameras that detect sick persons.
• Processing relating to the identification of chains of infection with several practical cases such as: data collection by employers to keep an attendance book up to date and monitor employees following the hybrid work model (in-office and remote); the Tous AntiCovid app, designed according to the Privacy by design methodology; a reminder booklet made available in public spaces
• Processing performed by local government with authorization of the CNIL to use residence tax data in order to provide government communication on health policy and protective measures.

Hosting personal health data

If data relative to the physical or mental health of a person is hosted on digital media, the host must be a certified health data host.

What are the obligations regarding hosting of health data?

• Since July 1st, 2018, the former host approval process has been replaced by a certification procedure. Certification of health data hosts is issued by a certifying agency accredited by the French Accreditation Commission (COFRAC) or a European equivalent.
• The certification agency ensures that the host meets ISO standards 27001 and 20000, which are designed to guarantee the security of IT systems and ensure maximized protection for health data.

How do you choose the right host and the right service?

For a processing activity involving health data, when you opt for a hosting service for your website or database, it is important to choose a “health data” hosting service and not a standard hosting service.

What should be included in the data hosting agreement?

Keep in mind that for hosting health data, you must sign a hosting service agreement with the hosting company. Such an agreement is required to include information such as:

• The location of the servers (important: the CNIL does not condone data transfers to the United States);
• A customer contact person at the hosting company who can be contacted to deal with security incidents.

Certifying health data hosting is a security measure in the sense of the GDPR, which means that healthcare facilities may be held liable if they use the services of an uncertified host.

GDPR in healthcare: what are the potential sanctions?

Sanctions for uncertified health data hosting are 3 years of imprisonment and a €45,000 fine (article L.1115-1 of the French Public Health Code).

You may remember the sanctions issued in 2021 by the CNIL to several healthcare facilities. For example, an orthodontics office was fined €12,000, and two private practitioners were fined €6,000 and €3,000, respectively.

Healthcare facilities: Sign agreements with your data processors

Before you establish a contractual relationship with a data processor, one of the recommendations made to healthcare facilities is to choose your processors carefully: they must be GDPR compliant, and they must host their data in France, or at least in the European Union.

The contractual relationships established with processors must be covered in a written document.

Main obligations:

• Transparency and traceability
• Assistance, alerting and advice
• Privacy by design/Privacy by default
• IT Security

What clauses should the agreement with your processor contain?

• Purposes and instructions
• Data controller obligations
• Duty to assist, advise and notify
• Processor obligations
• Confidentiality
• Security measures
• Notification of breaches and data subject rights
• Subprocessing

GDPR in healthcare: What PIAs should be conducted?

A PIA or Privacy Impact Assessment relative to data protection is a tool for data processors that must be implemented before each processing activity.

Failure to conduct a PIA is subject to an administrative fine:

The amount of the fine is determined by the CNIL depending on the seriousness of the failure, i.e. what impacts did failure to conduct the PIA have? Were there harmful consequences for the data subjects? What is the scope of the processing activity, the sensitivity of the data, etc.?

PIA on health data: What criteria must be fulfilled?

• Sensitive data: collection and processing
• Highly private data: processing of French national registration number (NIR)
• Vulnerable persons: patients, minors, the elderly

Note: data concerning the state of health are sensitive data.