Kry – Violation Found (Sweden, 2020)

The caregiver Kry, provides health services via video calls. The patient downloads an app that is available for iOS and Android. The app allows the patient to have a video call with the doctor and renew certain prescriptions without a video call. At the time of the inspection, the caregiver's internal medical record system contained approximately 450,000 patient records accessible by 490 of the caregiver's employees. The DPA initiated the investigation on March 22, 2019 and conducted an on-site inspection on April 4, 2019. The inspection concerned: Risk-needs analysis *whether the caregiver had analyzed the risks to which data subjects were exposed as a result of the caregivers processing of personal data *whether the caregiver had properly assessed which of its employees needed access to which data How access to medical data was defined *how employees were granted access to the caregiver's internal medical records *how staff were granted access to other caregiver's medical records through the coherent medical record system (sammanhållen journalföring). *whether access and permissions were properly defined based on the risk-needs analysis. Logs *How the caregiver logged whenever a staff member accessed a patient's data. Risk- needs analysis The DPA concluded that the risk and necessity analysis did not meet all statutory requirements at the time of inspection. During the supervisory investigation, the caregiver submitted a revised risk analysis twice. The DPA considered the revisions to be significant improvements, but an even more thorough analysis was needed to meet the statutory requirements. The DPA said there was a need to assess risks based on categories of personal data, such as addictions, mental health, domestic violence. Access to medical records Although a caregiver has a legitimate interest in processing a lot of personal data about a person's health, permission to access personal data must be limited to what a healthcare worker needs to do their job. The risk and needs assessment is the caregiver's tool to determine who gets access to what. At the time of the inspection the caregiver had not implemented any technical means to limit what their staff can access within internal files or the coherent records (from other caregivers). The caregiver implemented organizational measures to prevent unauthorized access. The caregiver manually reviewed each instance in which a staff member had accessed medical records of a patient he was not currently treating. In addition, once a month the caregiver blocked a doctor's access to medical records if they were not due to attend work for the next 4 weeks. The DPA considered the lack of technical restrictions on access to patient records as a breach of Article 5(1)(f), Article 32(1) and Article 32(2). During the supervisory inspection, the caregiver made changes to restrict her employee's access to internal and coherent medical records. The changes resulted in the employee only being able to access the records of a patient for whom she had an appointment, and this access would be revoked four months later. The DPA considered these changes to be positive improvements but reminded the caregiver that the technical measures would need to be reevaluated once the risk and necessity analysis was completed, as required by the DPA. Logging of unauthorized access The caregiver logged access to internal medical records and the coherent medical records. After the inspection, the caregiver informed the DPA that he found that his system did not log when someone deleted an unsigned journal entry. The caregiver remedied this on May 16, 2019, and the DPA considered the caregiver's logging practices following the law as of that date. Sanctions charge The DPA considers violations of Article 5(1)(f), Article 32(1) and Article 32(2) to be sufficiently serious in most cases that a caregiver should be fined. In this case, the DPA found that the caregiver had made efforts to comply before and during the inspection. The DPA decided not to impose a financial penalty on the caregiver. Instead, the DPA directed the caregiver to take certain compliance measures. Instruction to implement compliance measures. The caregiver revised their needs and risk assessment twice during the inspection. The DPA considered these revisions before deciding to instruct the caregiver to make changes. The DPA found that the caregivers risk assessment had improved since the inspection began and it was now better at addressing the risks required by the law. The DPA directed the caregiver to undertake a more detailed analysis of the risks to the rights and freedoms of data subjects. According to the DPA, this analysis should form the basis of a new assessment of the way in which access rights to patient records are defined for the caregiver’s staff. The DPA required that these changes be implemented by the end of February 2021.