President of the Personal Data Protection Office proposes new regulations to protect patients’ rights

What happens to medical records after a doctor dies? This issue has been raised by Mirosław Wróblewski, President of the Personal Data Protection Office, who has highlighted the case of a patient who was unable to access her medical records following the death of the doctor who had been treating her in an individual medical practice. In addition, regional medical chambers have been adopting internal regulations governing the processing of sensitive data, actions that have raised serious concerns for the President of the Personal Data Protection Office. This has prompted him to write to the Ministry of Health and put forward a proposal.

What is the problem?

The processing of personal data concerning health is subject to special protection under Article 9 of the General Data Protection Regulation (GDPR), as stated in a letter from President Mirosław Wróblewski.

However, an analysis conducted by the President of the Personal Data Protection Office, together with reports received by the Office, indicates that the current application of Article 30a(3)(3) of the Act on Patients’ Rights and the Patient Ombudsman Act, which concerns the transfer of medical records to the competent regional medical chamber in the event of a doctor’s death, is currently creating legal uncertainty regarding the proper handling of patients’ medical records.

Consequently, President Mirosław Wróblewski has submitted a request to the Minister of Health, Jolanta Sobierańska-Grenda, asking her to consider legislative action to comprehensively regulate the procedure for medical self-government bodies to take over the medical records of deceased doctors.

Who takes over the records, and what needs to be clarified?

Where there is no entity to take over a doctor’s responsibilities following their death, and the doctor practised their profession in the form of a professional practice within the meaning of Article 5 of the Act on Medical Activity, responsibility for storing and providing access to the medical records rests with the competent regional medical chamber.

In the supervisory authority’s assessment, the obligation arising from the aforementioned Article 30a(3)(3) of the Act on Patients’ Rights is imposed directly on the medical self-government body. In practice, however, regional medical chambers have been adopting resolutions to clarify the procedure to be followed in the event of a doctor’s death, due to the absence of provisions specifying how this obligation should be fulfilled. The procedures adopted through such resolutions provide for the transfer of medical records following the submission of an application by the person holding them. This applicant may also be an heir of the doctor who created the medical records in question. Other sets of instructions do not provide for such an application-based procedure.

“By issuing internal regulations governing the principles for processing sensitive data, medical chambers are therefore taking actions that raise serious concerns for the President of the Personal Data Protection Office in terms of compliance with the lawfulness requirements for data processing laid down in Article 6(1) and (3) and Article 9(2) of Regulation 2016/679,” the President of the Personal Data Protection Office states in his letter.

The GDPR protects patients’ rights

The President of the Personal Data Protection Office points out that a doctor’s death results in their removal from the register of members of the regional medical chamber and in changes being made to the Central Register of Physicians and the regional registers of physicians maintained by regional medical councils.

“These actions should trigger further measures by the medical self-government to take over the medical records of a deceased doctor, a process involving the collection and subsequent processing of special categories of personal data. However, the absence of statutory provisions explicitly specifying the obligation to take appropriate action with regard to patients’ medical records means that this does not happen.” Previously, in connection with the case of a patient who was unable to obtain access to her medical records after her doctor’s death, the President of the Personal Data Protection Office had asked the President of the Supreme Medical Chamber to take appropriate action as part of the supervision of regional medical chambers, with a view to ensuring adequate protection of the personal data contained in medical records following a doctor’s death. The President of the Supreme Medical Chamber, however, indicated that there were no provisions governing the search for and retrieval of medical records for the purpose of storing them.

In the view of the President of the Personal Data Protection Office, patients’ rights to access their medical records and to obtain information about their health are protected under the GDPR, as well as under civil law. In the event of a doctor’s death, responsibility for the medical records - and consequently for the processing of the personal data they contain - rests with the competent regional medical chamber, which has a statutory obligation in this regard. Furthermore, the fact that regional medical chambers have been designated as data controllers provides a sufficient legal basis for them to take the necessary measures to secure the data contained in medical records and to ensure that the rights of the data subjects are respected.

However, as the President of the Personal Data Protection Office emphasised in his letter to the Minister of Health, the medical self-government needs clear and transparent legal rules governing how it should fulfil its obligations to respect patients’ rights. At present, the actions of medical self-government bodies stem from legislation that obliges these professional bodies to take over medical records but does not specify, at statutory level, the procedure or the manner in which this obligation must be fulfilled. A situation in which internal regulations, rather than legislation, specify how obligations relating to the processing of health data are to be carried out should not be permitted. The lack of comprehensive regulations governing the transfer of medical records, as well as the enforcement of the obligation to hand them over, creates a range of risks for patients whose data are concerned, as well as for other individuals whose personal data appear in the records subject to transfer.

Criminal sanctions should be considered

With regard to the current legal framework governing the transfer of medical records following a doctor’s death, President Mirosław Wróblewski is calling for consideration to be given to adopting appropriate legal provisions specifying how medical self-government bodies must fulfil their obligations. These should include provisions requiring such bodies:

• to establish procedures for determining who holds a doctor’s medical records following the doctor’s death, as well as rules for processing the relevant information for the purpose of fulfilling the obligation to take over those records;
• to establish rules and procedures for the medical self-government to take over medical records when a doctor practising in the form of a professional practice, within the meaning of Article 5 of the Act of 15 April 2011 on Medical Activity, dies.

The amendments should also address individuals who hold the medical records of a deceased doctor by requiring them to transfer those records to the competent medical self-government body. They should establish procedures for enforcing this obligation in cases of non-compliance. Consideration should also be given to introducing criminal sanctions for failure to fulfil obligations relating to the transfer of medical records following a doctor’s death.

In the assessment of the President of the Personal Data Protection Office, it is therefore necessary to develop appropriate legal solutions that ensure a proper and comprehensive procedure is initiated following a doctor’s death. “Regulatory gaps should not be filled by internal regulations adopted by professional self-government bodies, as such regulations cannot provide a high level of protection for special categories of personal data,” the President of the Personal Data Protection Office concludes in his letter.