CNPD - Deliberação n.º 984/2018
|CNPD - Deliberação n.º 984/2018|
|Relevant Law:||Article 5(1)(f) GDPR|
Article 5(1)(c) GDPR
Article 32(1)(b) GDPR
Article 32(1)(d) GDPR
|Parties:||Centro Hospitalar Barreiro Montijo, EPE|
|National Case Number/Name:||Deliberação n.º 984/2018|
|European Case Law Identifier:||Processo n.º 9932/2018|
|Original Source:||CNPD (in PT)|
Portuguese DPA determines generalized access to patient records within a hospital breaches the minimization, integrity and confidentiality principles.
English Summary[edit | edit source]
Facts[edit | edit source]
CNPD's investigation revealed that the hospital’s staff, psychologists, dietitians and other professionals had access to patient data, notably data which was part of the Electronic Patient Records (EPR) - which should only be accessed by doctors - through their information system accounts. The profile management system revealed other flaws, as the hospital had 985 registered doctor profiles, while only having 296 doctors. Moreover, doctors had unrestricted access to all patient files, regardless of the doctors' specialty.
Dispute[edit | edit source]
Does granting hospital’s staff, psychologists, dietitians and other professionals access to Electronic Patient Records (EPR) breach articles 5(1)(c), (f), and 32(1)(b), (d) of the GDPR?
Holding[edit | edit source]
While the controller argued that (i) professionals other than doctors needed access to health data to fulfill their roles and that (ii) system access permissions were not configured by the controller, but by the Health Ministry's shared services (SPMS), the Portuguese DPA found that it was the controller who voluntarily determined said professionals should have indiscriminate access to EPRs and that the controller never asked SPMS to adjust the hospital's professionals' access profiles. When determining the amount of the fine, the Portuguese DPA took into account the number of affected data subjects (dozens of thousands), the nature of the personal data at stake (health-related data) and the intentional character of the breach by the data controller (who did not implement a reliable audit system after a prior instruction by the DPA).
Comment[edit | edit source]
Further Resources[edit | edit source]
Share blogs or news articles here!
English Machine Translation of the Decision[edit | edit source]
The decision below is a machine translation of the Portuguese original. Please refer to the Portuguese original for more details.