Closure of hospitals: Calls for better protection of patient data
The Data Protection Conference complains about major regulatory gaps when clinics go bankrupt. Unauthorized persons could gain access to sensitive medical data.
At its 107th meeting in Bremerhaven, the Conference of Independent Federal and State Data Protection Supervisory Authorities (Datenschutzkonferenz, DSK) appealed to hospital managers, owners and interest groups as well as politicians and administrators to "address the data protection implications of the further hospital closures to be feared in the future at an early stage". Recently, for example, the number of relevant hospital insolvencies has risen sharply across Germany. The DSK notes this with concern, particularly with regard to the "particularly sensitive treatment documentation" of patients held in the facilities.
Storage of highly sensitive data, increasingly not secure
According to their resolution, the inspectors are increasingly confronted with cases "in which secure storage and access to patient data by those affected was not guaranteed". In some cases, there was even a risk of "unauthorized persons gaining access to medical records". Experience had shown that "from a certain point, the costs of securing the documents could no longer be borne by the insolvency administrator". If the search for other legally responsible parties is unsuccessful, there are no nationwide regulations in the area of hospital treatment "by whom and in what form the further storage, including the deletion of patient data, must be carried out" and how patients can gain access to the treatment documentation concerning them.
The DSK is therefore urging decision-makers to close existing regulatory gaps, ensure legal certainty and set up financing solutions such as funds. The state hospital laws of North Rhine-Westphalia and Hesse could serve as a model for this. Hospitals there are obliged to draw up concepts for the continued storage of patient files in the event of insolvency or unplanned closure. Until then, the relevant stakeholders should work together to develop solutions that comply with data protection regulations. The Conference of Health Ministers should address the problem as soon as possible.
(anw)