health-data-dpia skill

Assessing Health Data Processing

Overview

Health data is classified as a special category under GDPR Art. 9(1), requiring both a lawful basis under Art. 6(1) and an Art. 9(2) exemption for processing. Processing of health data on a large scale triggers a mandatory DPIA under Art. 35(3)(b). This skill provides a DPIA methodology for health data processing scenarios: electronic health records, clinical trials, health research, telemedicine, health applications, medical devices, and genetic data analysis.

Legal Framework

Art. 9(1) — Definition of Health Data

GDPR Art. 4(15) defines data concerning health as "personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status."

This includes:

• Medical records and diagnoses
• Prescription and medication data
• Laboratory results and imaging
• Mental health assessments
• Disability information
• Genetic data (Art. 4(13))
• Biometric data processed for health purposes
• Health insurance claims
• Fitness and wellness data that reveals health status
• Data inferred from non-health data that reveals health conditions

Art. 9(2) Exemptions for Health Data

EU Clinical Trials Regulation 536/2014

• Art. 28: Protection of subjects and informed consent.
• Art. 28(2): Informed consent must be separate from consent for data processing under GDPR.
• Art. 56: Transparency through the EU Clinical Trials Information System.
• Art. 61: Facility requirements including controlled access to clinical trial materials.

Health Data DPIA Methodology

Phase 1: Health Data Classification (Week 1)

1. Inventory all health data elements processed.
2. Classify each element:

• Direct health data (diagnoses, test results, prescriptions)
• Indirect health data (insurance claims, appointment records)
• Inferred health data (wellness app data, genetic risk scores)
• Genetic data (DNA sequences, genotype data, pharmacogenomic data)

1. Identify the Art. 9(2) exemption for each processing activity.
2. Verify that processing is under the responsibility of a health professional subject to professional secrecy (Art. 9(2)(h) and Art. 9(3)).

Phase 2: Lawful Basis and Exemption Analysis (Week 2)

For each health data processing activity, document:

Phase 3: Clinical Trial Specific Assessment (if applicable)

Phase 4: HIPAA Crosswalk (for transatlantic operations)

Phase 5: Risk Assessment (Week 3-4)

Phase 6: Genetic Data Specifics

Genetic data has unique privacy characteristics:

• Perpetual sensitivity: Genetic information does not change over a lifetime and reveals information about biological relatives.
• Familial implications: An individual's genetic data reveals information about parents, siblings, and children who have not consented to processing.
• Predictive power: Genetic data can predict future health conditions, creating insurance and employment discrimination risks.
• Irreversibility: Once genetic data is disclosed, it cannot be "unlearned" or reset.

Additional requirements for genetic data:

• Art. 9(4) permits Member States to impose further conditions on genetic data processing.
• Germany: Gendiagnostikgesetz (GenDG) imposes strict limitations on genetic testing in employment and insurance contexts.
• France: Code de la sante publique Art. L1131-1 restricts genetic testing to medical and scientific purposes.

Enforcement Precedents

• Finnish DPA vs Pihlajalinna (2021): EUR 608,000 fine for health services company where employees accessed patient records without clinical justification — inadequate access controls and logging.
• Portuguese DPA vs Hospital do Barreiro (2018): EUR 400,000 fine for hospital where non-clinical staff had access to patient records through failure to implement role-based access controls.
• Dutch DPA vs OLVG Hospital (2021): EUR 440,000 fine for inadequate access controls on electronic patient records — insufficient two-factor authentication and logging of access.
• Swedish DPA vs Capio St. Goran (2020): SEK 30 million fine for hospital failing to conduct DPIA for patient records system and failing to implement adequate access controls.
• ICO vs Pharmacy2U (2015): GBP 130,000 fine for selling patient data to marketing companies without consent.