Azienda sanitaria dell'Alto Adige - Südtiroler Sanitätsbetrieb – €75,000 Fine (Italy, 2024)

The DPA received two complaints and two infringement notifications alleging unlawful processing of personal data carried out by Azienda sanitaria dell'Alto Adige - Südtiroler Sanitätsbetrieb (the controller) through their health data record system. Specifically, repeated accesses were made to the electronic health record (‘HER’) system by unauthorized healthcare personnel. In fact, some of the staff members had unrestricted access to the dossier of patients they did not treat. The data subjects complained about repeated access to the controller’s system concerning their health records during a period of time when he was not in the hospital or undergoing treatment. The controller argued that some of the accesses were repeated within a very short period of time for technical reasons. However, they admitted that some accesses were "unjustified" or limited to "only the list of health services performed and not the relevant details". The controller explained that the system currently allows healthcare workers to access the EHR if there is a clinical-administrative event present. In cases where no clinical-administrative event is traced in the system (e.g., patient calling the professional for post-hospitalization clarifications), the healthcare worker can access the EHR by selecting an appropriate reason from a predefined list. In one case, a healthcare worker was able to access the laboratory tests of her ex-husband without his knowledge. The worker was then subject to disciplinary proceedings and consequently suspended following a complaint for abusive access pursuant to Article 615-ter of the Italian Criminal Code. Additionally, the DPA discovered that EHR files were not protected by a system for detecting any anomalies that could constitute unlawful processing, such as alerts. The DPA emphasized the importance of using tools to detect alerts signaling anomalous or risky behavior by authorized data processors to comply with the principles under Article 5(1)(a) and (f) GDPR. Additionally, the DPA referred to the ‘Guidelines on the subject of the Health Dossier - 4 June 2015’ in which it recommended adoption of stringent security measures which pertain to such delicate processing operations involving sensitive data. Before the opening of the inquiry, there were two ways of accessing the dossier: either the patient was under the care of the health professional, or the professional made a self-declaration. The DPA ordered the controller to deactivate this self-declaration method and replace it with documented patient intake. Some other requirements laid down by the DPA for access to the EHR of a patient are as follows: 1. being medical personnel intervening in various capacities in the care process, 2. access limited to the time during which the care process takes place (without prejudice to the possibility of accessing the file again if this is necessary by virtue of the type of medical treatment to be given to the person concerned). Given the handling of particularly sensitive data and the necessity for strict access controls, it is evident that an organization must employ tools like a SIEM (Security Information and Event Management) integrated with an EDR (Endpoint Detection and Response) or XDR (Extended Detection and Response). These tools allow for the anonymous detection of anomalies in web traffic, access to file servers, and databases. If these anomalies reach a level that could compromise the computer systems, the organization can then proceed to an 'unencrypted' detection by intervening directly on the PC that caused the anomaly. In conclusion, the DPA found the controller in breach of Articles 5(1)(a) and (f), 9, 25 and 32 GDPR. A fine of €75,000 was imposed for allowing indiscriminate access to the EHR system by its employees and for failing to implement tools and systems capable of detecting anomalies in authentication and authorization procedures. In addition, the DPA ordered the controller to implement all the necessary technical and organizational measures to guarantee the security of the processed personal data and to prevent new abusive access.