BfDI on the consequences of the PDSG legislation
20.08.2020 17:34
The Federal Commissioner for Data Protection and Freedom of Information (BfDI), Professor Ulrich Kelber, points out the consequences of processing personal health data in violation of European law as a result of the Patient Data Protection Act (PDSG): "My authority will take supervisory measures against the statutory health insurance companies under my responsibility if the PDSG is to be implemented in its current version. In my opinion, introducing the electronic patient file (ePA) exclusively in accordance with the requirements of the PDSG violates the European General Data Protection Regulation (GDPR) in important places."
In its statements during the legislative process, the BfDI pointed out several times that patients must have full sovereignty over their data when the ePA is introduced. The PDSG passed by the German Bundestag and currently being discussed in the Bundesrat has deficiencies here: “Health data reveals the most intimate information about citizens. That’s why they are particularly protected in the GDPR, which applies across Europe. If the PDSG is passed unchanged, I will have to formally warn the statutory health insurance companies under my supervision, which have around 44.5 million insured persons, not to implement the ePA only in accordance with the requirements of the PDSG, as this would constitute behavior that violates European law. In this context, I am also preparing further measures to remedy the implementation of the ePA in violation of European law. According to the GDPR, in addition to instructions, I also have access to prohibitions.”
The PDSG only provides for users of suitable end devices such as mobile phones or tablets to have access to their own ePA that is sufficient under data protection law, namely document-specific control of which parties can see which information. And even this option should only be available a year after the introduction of the ePA. This means that there will be no document-level controls in 2021. Users are forced to adopt an “all or nothing” approach with regard to the data stored in the ePA by service providers. Any person to whom the insured persons allow access to this data can view all the information contained therein. For example, the treating dentist could see all the findings of the psychiatrist consulted.
The specifications relevant for the launch of the ePA on January 1st, 2021 do not enable health insurance companies to grant their insured persons so-called fine-grained access to the contents of the ePA stored by the service providers, beyond the legal requirements the Federal Commissioner with incomprehension: “Digitalization can never be an end in itself. The protection of insured persons and their health data must always be the top priority.”
In addition, the PDSG does not regulate the ability of people who cannot or do not want to use the so-called front end on their cell phone or tablet to independently view the ePA and also does not regulate access to the data. From 2022 onwards, a representative person will be able to control and view these frontend non-users, but the insured person will then have to give them full control over their data.
The BfDI is firmly against this unequal treatment of citizens' fundamental right to informational self-determination: “The ePA is an important step towards further improvements in health care. The resulting health data requires a level of data protection as required by the GDPR and as has been firmly agreed for the ePA in Germany for years. The PDSG in its current form does not do this justice sufficiently. As the responsible supervisory authority for the majority of statutory health insurance companies, I will therefore use the supervisory means at my disposal to ensure that these health insurance companies do not violate European law with the ePA they offer.”
Another point of criticism is the authentication process for the ePA, which insured people use to log in via the front end. This is not yet sufficiently secure from a data protection perspective and does not comply with the requirements of the GDPR. The BfDI is preparing appropriate warnings and instructions so that health insurance companies only allow access to health data after using a state-of-the-art, highly secure authentication process. This applies in particular to authentication procedures without the use of the electronic health card (so-called alternative authentications), for which a granted transition period expires in May 2021.
The BfDI is responsible for 65 statutory health insurance companies. A list of the affected health insurance companies is available here Website available from the BfDI.