he APDCAT and the GAIP approve common criteria to resolve people's access claims to the traceability of their medical history

The Catalan Data Protection Authority (APDCAT) and the Right of Access to Public Information Guarantee Commission (GAIP) have approved common interpretation criteria on the application of regulatory rules and the processing of complaints of people's access to the traceability of their clinical history.

By virtue of this agreement, from now on, the APDCAT will be the body in charge of responding to these requests, applying the data protection regulations when interpreting and resolving them, in accordance with article 15 of the General Data Protection Regulation, which precisely regulates people's right of access to their data, and the weighting of the legitimate interest of the affected people (patients and healthcare professionals) in each specific case.

In accordance with these criteria, the GAIP will forward to you the claims it receives from people who want to access this information.

The aim is to increase legal security and the guarantee of people's right of access to information, given that both data protection and transparency regulations include this right.

These criteria confirm the will of coordination between both institutions to guarantee a homogeneous application of the principles and rules on the protection of personal data and access to information, with regard to clinical documentation.

In the analysis of the right of access to the medical history, it is necessary to determine whether the patient must be able to know the identity of the professionals who have accessed their history, whether they had authorization to do so, and whether there is there have been improper or unjustified accesses by other people, among other things. In this sense, it is considered that the patient may have a legitimate interest in knowing the traceability of the accesses made to his clinical history, according to the circumstances of the specific case. This and without prejudice to the fact that the affected professionals are previously heard, to assess whether there is any circumstance that makes their right not to communicate this information prevail.

Data protection preferentially

Strictly speaking, the traceability of the clinical history does not constitute personal data of the patient, as it refers to personal data of professionals in the healthcare field. However, it is directly related to the medical history, as it gives information about who has accessed it and, therefore, about who has processed the patient's personal data.

For its part, the patient autonomy legislation establishes the patient's right to information in broad terms, so that the patient must be able to know not only the content of the clinical history, which already contains professional data that assist him, but everything that affects his treatment and the rest of his rights, among others, the right to privacy. Likewise, the person responsible for the treatment of the clinical history must guarantee the confidentiality of the patient's information.

In short, it is a question of guaranteeing the right of the holder of the data to an effective power of disposal and control of his data, of the recognition of the special relevance of the health data, and of the right of the patient to exercise his claim and defense rights.

With the approval of these common criteria, both authorities assume that there is a special legal regime, which regulates data protection, and a specific regime for the patient's right to autonomy and access to medical history information , which apply preferentially, in accordance with the Transparency Law. Therefore, the guarantee of this right of access corresponds in the first instance to the APDCAT.