Servicio Extremeño de Salud – Complaint Upheld (Spain, 2021)

A data subject filed a complaint with the Spanish DPA (AEPD) claiming that a nurse employed by the regional health service of Extremadura (hereinafter “SES”) had unlawfully accessed his/her medical history without an authorisation from the complainant and without having any relation with the data subject that justified such access under national and EU law. As part of the investigation the AEPD requested the following information from the SES: # The causes that enabled the unlawful access from a third party; # Detailed descriptions of the actions taken to halt the undue access to the patient’s information and to minimise the adverse effect on the data subject; # Measures taken to prevent similar occurrences in the future; # A copy of the risks assessment carried out as well as the data protection impact assessment, if any; # Details of the technical and organizational measures adopted to guarantee a level of security appropriate to the risks detected with relation to the access by health personnel to the medical records of the patients and the security policy adopted by the entity in relation to it. The SES replied that the patient's right to access includes “knowing in any case who has accessed your health data, the reason for access and the use that has been made of it". In order to effectively execute this right, the IT system that supports clinical information of patients requires the existence of a relationship that legitimizes the access of the healthcare professional to a specific medical record. Hence, when a healthcare professional requests access to the history of a patient being treated the IT system automatically understand that the relation is “medical care” between a healthcare provider and a patient. The person requesting access must also provide a specific reason. The SES did not provide the risks assessment nor the data protection impact assessment as requested by the AEPD. The AEPD found that the access by the third party unrelated to the claimant to his clinical history was unlawful because the selection of the reason for accessing the clinical history of a patient had not been not verified with the actual profile of the user. Hence, it held that there had been a violating the principles of integrity and confidentiality established in Article 5(1)(f) GDPR. The AEPD held that medical histories are special categories of data under Article 9, the processing of which entails a number of risks that must be identified and addressed properly with adequate security measures to safeguarding the integrity and confidentiality of this data. These risks must be taken into account by the data controller who must establish the necessary technical and organizational measures to prevent the loss of control of the data by the person responsible for the treatment and, therefore, by the holders of the data that provided them. However, in its investigation the AEPD did not find evidence that the mandatory risk analysis and the recommended impact assessment had been carried out by the SES. Moreover, the AEPD pointed that the SES had failed to put in place a process of verification, evaluation and continuous assessment of the effectiveness of the technical and organizational measures to guarantee the security of the processing. As a result, the AEPD held that technical and organizational measures implemented in the IT system were deficient and in breach of Article 32(1)(b) and (2), for what it warned the controller.