My name is David Koeppe, I am a data protection officer in a large hospital, at Vivantes in Berlin,
and of course I often encounter situations that are difficult to evaluate from a purely legal or purely technical point of view, because the factor “human” is added.
This is the context of my work; that's how I got in contact with the project, and that's where exciting questions arise.
Patients have always had the right to get a copy of their file. If they want to have their treatment file, not just see it, but also have it, then they can get it.
It is also stipulated by law that they may also receive them in electronic form.
We are then obliged to issue an electronic copy.
At first this sounds simple, the question is: how to do that? Normally, that's a PDF collection.
Of course, many patients prefer this because they canʼt always come to the doctor's office and accept a data medium, so it is sent to them electronically.
The most common means in this area, also in the consumer area, is the e-mail.
That means patients would like to have their medical records, whether they are files or excerpts thereof, sent by e-mail.
E-mail, as we know, is an insecure transmission tool,
i.e. you cannot just send sensitive data via the internet in an open e-mail, the data has to be protected.
There are two things which create a conflict: on the one hand, the patient's desire and right to obtain that file,
and on the other hand, the physicians' obligation, also by law,
to take precautions in processing. Even when submitting the data,
for example if we want to send a patient an e-mail with confidential data, we need to encrypt that e-mail.
This is something that is practically imposed on us by legislature,
and there is nothing that the patient could do to relieve us from this duty, not even by consent or by begging.
If the patient comes and says
“I do not want an encrypted e-mail, I do everything on my smartphone, I canʼt decode anything on there.
I donʼt want anything to do with that kind of nonsense, just send it to me unencrypted”,
then the employees ask themselves “how do we do that?”. And that's the big conflict that comes with it:
We would have to comply with the patient's right and comply with our obligation to encrypt an e-mail — if we chose e-mail.
What would we choose to violate then? The patient's right of information or our duty to secure data transmission?
Not in this situation, no. That's exactly the problem. The question is:
are we going to be able to convince the patient to deal with an encrypted message
- with whatever technology you are using, there are different options -
or tell the patient "come here to get the storage medium"?
That might work, if they live around the corner, but if they live somewhere else, that will not work any more.
There is no classic way out of this, at least not in this scenario, unless you go beyond the limits of the scenario and look for other solutions.
One obvious solution would be – but of course you would have to have this installed as a hospital, otherwise it would not work in a timely manner –
a data exchange platform, which allows encrypted, secure data exchange,
by giving the patient e.g. a link through which they can then access their data and then separately,
perhaps by SMS or similar, send a password, so that they can then download their data.
Weʼll have to see what kind of communication channels will arise within the upcoming years;
Whether there will be a nationwide, secure e-mail, whether there will be a general,
nationwide infrastructure for e-mail encryption, which you can call safe then.
Or if there will be secure messengers acceptable in all respects,
providing not only end-to-end encryption,
but also with a business model that does not cause any conflicts.
Otherwise, we could also send storage mediums, but if you send a burned CDROM to someone,
they might not have a PC at home, where they can insert the disk, so even that is difficult.
I do not dare to think ahead of time what sort of solutions there will be, be it a telematics infrastructure
to which everyone is attached and which is also suitable for transmitting such data.
One cannot just hope and tell the patients “wait half a year, then we can send it to you”
Of course this is not a solution for the problems of today, which employees and secretariats have to endure
In the case of a dispute, they might eventually send an unencrypted e-mail just to have their peace and quiet.
This is of course a difficult field. When the employees cannot understand or empathize with this conflict,
how can one demand that of patient?
If they say, “This is my data, Itʼs my right to get it, I want it right now, why won't you send it to me? It's just a mouse click“.
And for us to awaken theunderstanding for that legal construct in the background,a more or less abstract law,
which of course has its justification, that is very difficult.
Very often it is not possible to communicate all of this. Then it remains in the dispute.
What matters more? The right of information on your own data
or the legislator’s right of secure communication?
Itʼs about quality assurance. Many medical societies have registers – primarily for qualityassurance purposes,
sometimes other purposes are also involved, e.g. research.
The physicians who belong to that specialty, which also represent the relevant clinics in the hospitals
– whatever that is, whether cardiology, radiology – more or less force their members to participate in these registries
because without this participation in quality assurance measures and the resulting certificates
they might not be authorized to provide certain services.
So taking part in registries, including the transmission of anonymized patient data, is the precondition
for certain services being rendered and billed.
In recent months, I've come across several registries that workwithout any privacy concerns,
some of them have been doing so for many years.
That's a field of conflict. The chief physician must consider:
“Do I take part inthis registry as I am obliged to do
and unlawfully submit data of a large part of my patients?
only to have the pretty certificate and continue to work and to not ruin my reputation
or do I abide by the law and either not participate, which is not a goodidea,
or do I go there and actually say:
"Dear patients, it may be unusual for you to be asked such a thing, but we do ask you
if you would allow us to report the data to this registry?"
with appropriate explanations, information, article 13 GDPR, with the risk that not all patients say "yes".
The problem is that these quality assurance measures often have certain minimum quantities attached to them,
and if the clinic only just reaches those, because of the situation of a consent solution
that would have to be made under data protection law, these case numbers will no longer be possible because perhaps only80 or 60 percent
of patients agree, and then certificates are also not acknowledged, it has a similar effect.
That means the chief physician abides by the law, also reports data,
but nonetheless doesnʼt get his certificate and hispermission to perform this service.
This is the overall conflict which can only be resolved by the professional societies,
the registry-operating institutions, by working law-abindingly themselves.
The consciousness in medicine, especially in physicians' minds, is often not quite there, yet.
They always think in the dimensions of their professional secrecy, so if they pseudonymize data,
then the identity of the patient is not revealed.
But of course, data protection law goes much further regarding the assessment of potential consequences.
In this respect, these two are not compatible with each other, the simple medical approach and data protection law.
When it comes to quality assurance, there is the issue that it is not directly relevant for the patients.
It is not about the patient’s health, but a more or less administrative process,
which at first does not have any benefits for the individual patient.
It may eventually improve the processes, but the patient who is already through
and whose data is reported, won't care any more.
At that point the argument of the priority of treatment does no longer apply.