Germany: Right To Information Under Data Protection Law In The Healthcare Sector

The right to information under data protection law pursuant to Art. 15 (3) of the General Data Protection Regulation (GDPR) provides patients with a complete copy of their treatment documentation free of charge. This is confirmed by the activity reports of the data protection supervisory authorities from 2019/2020 and a recent ruling by the Dresden Regional Court on the relationship between the various legal bases on which a request for information in the healthcare sector can generally be based.

Different legal grounds

Patients have a right to inspect and obtain information regarding treatment records relating to them. In German law, this right is derived from the constitutionally guaranteed right to informational self-determination and is anchored in law in several places, e.g., in the law on treatment contracts (Section 630g of the German Civil Code, "BGB"), in several professional regulations and in data protection law under EU law (Article 15 (3) of the GDPR). However, the various grounds for claims differ in their scope: whereas the law on treatment contracts, in particular, primarily provides for mere inspection of the patient file and only for electronic copies against payment, Article 15 (3) of the GDPR, according to its wording, grants the provision of a free copy of the entire treatment documentation without any further requirements.

Scope of Art. 15 GDPR

Despite the fundamentally open wording of Art. 15 (3) of the GDPR, the scope of the right to information is assessed differently by the data protection supervisory authorities.

Although the term "copy" in Article 15 (3) of the GDPR is not to be understood literally according to the (probably) predominant opinion, but rather generally in the sense of a mere listing of the personal data relating to a data subject, according to the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate, this concept should extend further with regard to particularly protected health data. The fact that Article 15 (3) of the GDPR extends to the provision of a complete copy of the treatment documentation free of charge is derived from recital 63 of the GDPR, which explicitly mentions data in patient files with diagnoses, examination results, findings of the treating physicians and information on treatments or interventions. Restrictions on the right to information would only apply if either significant personal rights of third parties conflict with this or, for example, for therapeutic reasons, information could lead to a significant health risk for the person concerned.

According to the Saarland State Commissioner for Data Protection and Freedom of Information, Article 15 (3) of the GDPR also establishes a right to a free copy of personal data, while Section 630g BGB requires the patient to reimburse the costs for a copy of the treatment documentation. The Saarland Independent Data Protection Center currently bases its handling of inquiries or complaints in this context on the concern of the patient involved in the specific case. If the patient's primary concern is the processing of his or her personal data (e.g., recipients, storage period), a request for information pursuant to Article 15 (3) of the GDPR is assumed. If, on the other hand, the focus is on the content of the course of treatment, such as in cases where the patient wants to take his file with him when he changes practice to a new doctor and therefore needs a complete copy, Section 630g BGB is relevant.

The Hessian Commissioner for Data Protection and Freedom of Information, on the other hand, does not consider the issue of individual copies, e.g. in the sense of a photocopy of certain documents, to be covered by the right to information pursuant to Article 15 (3) of the GDPR. The copy term of the provision is rather to be understood in the sense of a meaningfully structured summary. This is already supported by the wording of Article 15 (3) of the GDPR, which speaks of a copy of the "personal data" and not of a copy of the documents. It must therefore be sufficient in principle to fulfill the claim if the data referred to in recital 63 of the GDPR is summarized by the controller. For reasons of practicability, however, data controllers may also decide to hand over entire documents, such as a doctor's letter summarizing the treatment of a hospital stay of several days, including all findings and diagnoses. A copy of the patient's entire hospital file, however, is only to be handed over in accordance with Section 630g BGB.

Decisions of the Dresden Regional Court and the Federal Labor Court

In proceedings decided by the Dresden Regional Court in a judgment dated May 29, 2020 - Case No. 6 O 76/20, the plaintiff asserted claims for information against the defendant following treatment at the defendant's hospital. The court granted the request for information - in agreement with the above-mentioned opinions of the data protection commissioners from Rhineland-Palatinate and Saarland - and ruled that the initial release of copies of the treatment file to patients must be free of charge. The provision of Section 630g BGB, as a regulation at the national level, could not contain a priority relationship in relation to the European law regulation of Article 15 (3) of the GDPR. The fact that a request under Section 630g BGB also provides for the payment of costs for the initial information does not therefore prevent the right to information under Article 15(3) of the GDPR from being free of charge.

According to a recent press release, the Second Senate of the Federal Labor Court also had to deal with the right to information under data protection law in a recent ruling dated April 27, 2021 - 2 AZR 342/20. The plaintiff was employed by the defendant as a business lawyer and, after termination of the employment relationship, demanded from the defendant, among other things, information about his personal data processed by the defendant and the provision of a copy of this data. The Regional Labor Court ruled in the lower instance that the plaintiff was entitled to a copy of his personal data that were the subject of the defendant's information, but not to the copies of his e-mail correspondence and the e-mails that mention him by name that were also demanded. The Federal Labor Court could ultimately leave open whether the provision of a copy of e-mails is covered by the claim under Article 15 (3) of the GDPR. However, the decision underscores the considerable practical relevance of the right to information and, in view of the increasing number of proceedings being conducted on Article 15 (3) of the GDPR, is likely to result in further developments in case law, which can also and in particular be expected to have implications for the right to information in the healthcare sector.

Notes

Physicians and other healthcare professionals who maintain patient records should implement internal processes that can ensure the complete provision of information within the statutory period (one month). In view of the increasing number of requests for information in the past two and a half years, the individual gathering of the required information appears to be too strenuous. Difficulties arise when one's own files still contain "sleeping members" that should no longer be there at all. Thus, well-intentioned, comprehensive information can quickly reveal gaps in the implementation of the deletion concept.

Particular caution is also required in the - extremely practice-relevant - case where the heir of a patient wishes to assert the patient's right to information, e.g., in order to request co-payment receipts for submission to the health insurance fund or the tax office after the death of a pharmacy customer. The GDPR does not apply to the data of deceased persons (recital 27); however, in order not to violate the duty of confidentiality under criminal law as a professional secrecy holder when fulfilling such a right to information, it is necessary in such cases to determine the deceased person's actually expressed or at least presumed will. In doing so, the purpose of the desired provision of information must be questioned in particular.

Originally Published 17 May 2021

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.