Datainspektionen - DI-2019-3841
From GDPRhub
| Datainspektionen - DI-2019-3841 | |
|---|---|
 | |
| Authority: | Datainspektionen (Sweden) |
| Jurisdiction: | Sweden |
| Relevant Law: | Article 5(1)(f) GDPR Article 5(2) GDPR Article 32(1) GDPR Article 32(2) GDPR |
| Type: | Investigation |
| Outcome: | Violation Found |
| Started: | |
| Decided: | 02.12.2020 |
| Published: | |
| Fine: | 2500000 SEK |
| Parties: | Hälso- och sjukvårdsnämnden, Region Västerbotten |
| National Case Number/Name: | DI-2019-3841 |
| European Case Law Identifier: | n/a |
| Appeal: | n/a |
| Original Language(s): | Swedish |
| Original Source: | Integritetsskyddsmyndigheten (in SV) |
| Initial Contributor: | Kave Noori |
The Swedish DPA (Integritetsskyddsmyndigheten) fined the Region of Västerbotten approximately EUR 248 000. For the second time since 2015, the region failed to implement necessary organizational and technical measures to restrict access to medical records.
English Summary
Facts
The DPA opened an investigation against the Västerbotten Region Healthcare committee (Hälso- och sjukvårdsnämnden) on 22 March 2019. The DPA wanted to investigate whether a risk and needs assessment was carried out before healthcare workers were given access to patient files from their own department and files from other healthcare departments. The DPA had already found in 2015 that the Region of Västerbotten’ s needs and risk assessment did not comply with the requirements of the law and had instructed them to carry out a new assessment.
Swedish healthcare regulations require that a caregiving institution conducts a risk and necessity analysis before granting its employees access to medical records. The caregiving institution must analyze what privacy risks patients face and what information employees need access to. The caregiving institution must use the analysis as a tool to ensure that each employee has access only to what he or she needs to do his or her job.
The Healthcare committee is the executive body running the region's health care system. The committee's guideline on information security made the operational manager of each health care unit responsible to conduct a needs and risk analysis prior to giving a user account to a health care worker access to patient records.
Dispute
Holding
Risk/needs analysis and system privileges
The DPA held that the Västerbotten Region Healthcare committee did not have a needs and risk analysis that met the statutory requirements. The DPA did not accept the view of the Healthcare committee that it was the responsibility of the head of each health department to carry out the analysis. The DPA took the view that the central management of the healthcare committee was responsible for carrying out such an analysis and that it was an organizational measure carried out at a strategic level for the healthcare system it operated as a whole.
In addition, the DPA had comments on the risk and needs analysis outline that the healthcare committee gave to each health unit manager. The outline was intended as a practical tool to help the health unit determine how authorizations should be designed before creating an account for an individual health care worker. First, the DPA held that this document only addressed the needs of the health care provider to access certain data but lacked consideration of the risk of invasion of patient privacy. Second, the DPA pointed out that the needs and risk analysis is a strategic document that is needed as a tool in deciding the overall structure of granting privileges in the computer system. Third, the DPA concluded that instructions to the person creating the user account do not constitute the risk and needs analysis that the law requires.
The DPA also found that the health care committee did not limit individual health care workers' access to medical records to that which was necessary for the performance of their duties. The DPA found that the Healthcare committee violated Article 5(1)(f), Article 5(2), Article 32(1) and Article 32(2).
Access logs
The DPA investigated the logging practices of the healthcare committee and determined them to be compliant with the statutory requirements.
Order to take compliance measures
The DPA directed the Healthcare committee to conduct and document a needs and risk analysis as required by law. The analysis must include access to medical records from records held by the Healthcare committee as well as coherent medical records from other health care providers. The DPA directed the Healthcare committee to redefine health care worker access to medical records based on the analysis so that each health care worker has access only to the medical records they need to perform their job.
Sanction fee
The DPA imposed a fine of SEK 2.5 million on the Healthcare committee (Hälso- och sjukvårdsnämnden) of the Region of Västerbotten. The fine was based on several factors: patient data is inherently sensitive, approximately 650,000 patients were affected, and the DPA considered that the Healthcare committee knowingly failed to follow its instructions from 2015.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.
Decision Diary No. 1 (29)
2020-12-02 DI-2019-3841
The Health and Medical Care Board at
Västerbotten Region
Köksvägen 11
901 89 Umeå
Supervision under the Data Protection Regulation and
Patient Data Act - needs and risk analysis
and questions about access in journal systems
Table of Contents
The Data Inspectorate's decision ................................................ ..................................... 3
Report on the supervisory matter ............................................... ............................ 4
Previous review of needs and risk analyzes ........................................... 4
What has emerged in the case ............................................. .......................... 5
Personal data controller ................................................. ................................ 5
Journal system ................................................. ................................................ 5
Number of patients and staff .............................................. ...................... 6
Internal privacy ................................................ ........................................... 6
Needs and risk analysis .............................................. .................................... 6
Authorization of access to personal data about
patients ................................................. .................................................. ...... 7
Access opportunities (read access) to care documentation in NCS Cross
.................................................. .................................................. .................... 8
Restrictions on access to data in NCS Cross .................................... 9
Consolidated record keeping ................................................ ....................... 10
Needs and risk analysis .............................................. .................................. 10
Authorization of access to personal data about
patients ................................................. .................................................. .... 10
Access opportunities (read access) to care documentation in NCS Cross
.................................................. .................................................. ................... 10
Restrictions on access to data in NCS Cross .................................. 10
Postal address: Box 8114, 104 20 Stockholm E-mail: datainspektionen@datainspektionen.se
Website: www.datainspektionen.se Phone: 08-657 61 00
Page 1 of 29Datainspektionen DI-2019-3841 2 (29)
Documentation of access (logs) ............................................ .............. 10
Grounds for the decision ............................................... ........................................... 11
Applicable rules................................................ .................................................. 11
The Data Protection Regulation the primary source of law ..................................... 11
The Data Protection Regulation and the relationship with complementary national
regulations ................................................. ........................................... 13
Supplementary national provisions ............................................... .. 14
Requirement to do needs and risk analysis .......................................... ........... 15
Internal privacy ................................................ .............................................. 16
Consolidated record keeping ................................................ ....................... 16
Documentation of access (logs) ............................................ .................. 17
The Data Inspectorate's assessment ................................................ ........................... 17
Responsibility of the data controller for security ........................................... 17
Needs and risk analysis .............................................. ...................................... 18
The Health and Medical Care Board's work with needs and risk analysis ...... 20
A needs and risk analysis must be made at a strategic level ............................ 21
The Swedish Data Inspectorate's summary assessment ...................................... 21
Authorization of access to personal data about
patients ................................................. .................................................. .... 22
Documentation of access (logs) ............................................ ............. 24
Choice of intervention ............................................... .................................................. 25
Legal regulation ................................................ .............................................. 25
Order................................................. .................................................. 25
Penalty fee ................................................. ........................................... 26
How to appeal............................................... ........................................... 29
Page 2 of 29Datainspektionen DI-2019-3841 3 (29)
The Data Inspectorate's decision
The Data Inspectorate has at the inspection on 14 May 2019 and 12 December
2019 established that the Health and Medical Care Board at Region Västerbotten
processes personal data in breach of Article 5 (1) (f) and (2) and Article 32 (1)
1
0ch 32.2 of the Data Protection Regulation by
1. The Health and Medical Care Board has not implemented needs and
risk analysis before allocation of authorizations takes place in the record system
NCS Cross, in accordance with ch. § 2 and ch. 6 Section 7 of the Patient Data Act
(2008: 355) and ch. 4 Section 2 of the National Board of Health and Welfare's regulations and general
advice (HSLF-FS 2016: 40) on record keeping and treatment of
personal data in health care. This means that Health and
the health care board has not taken appropriate organizational measures
to be able to ensure and be able to show that the treatment of
the personal data has a security that is appropriate in relation to
the risks.
2. The Health and Medical Care Board has not restricted users
permissions for accessing the NCS Cross journal system to what
only needed for the user to be able to fulfill theirs
tasks in health care in accordance with
Chapter 4 § 2 and ch. 6 Section 7 of the Patient Data Act and Chapter 4 § 2 HSLF-FS
2016: 40. This means that the Health and Medical Care Board does not have
taken measures to be able to ensure and be able to show a suitable
security of personal data.
The Data Inspectorate decides on the basis of Articles 58 (2) and 83 i
the Data Protection Ordinance and Chapter 6 § 2 of the law (2018: 218) with
supplementary provisions to the EU Data Protection Regulation that the
and the Board of Health, for the infringements of Article 5 (1) (f) and (2), and
Article 32 (1) and (2) of the Data Protection Regulation, shall pay a
administrative penalty fee of 2,500,000 (two million
five hundred thousand) kronor.
1
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on protection
for natural persons with regard to the processing of personal data and on the free flow
of such information and repealing Directive 95/46 / EC (General
Data Protection Regulation).
Page 3 of 29Datainspektionen DI-2019-3841 4 (29)
The Data Inspectorate submits pursuant to Article 58 (2) (d) i
the Data Protection Ordinance, the Health and Medical Care Board to implement and
document the required needs and risk analysis for the NCS medical record system
Cross and then, with the support of the needs and risk analysis, assign each
user individual authorization for access to personal data to only
what is needed for the individual to be able to fulfill his or her duties
in the field of health, in accordance with Article 5 (1) (f) and Article 32 (1) and
32.2 of the Data Protection Ordinance, Chapter 4 § 2 and ch. 6 Section 7 of the Patient Data Act and
Chapter 4 2 § HSLF-FS 2016: 40.
Report on the supervisory matter
The Data Inspectorate initiated supervision by letter dated 22 March 2019 and
on the spot on 14 May 2019 and 12 December 2019 reviewed whether the Health
and the Health Care Board's decision on the allocation of authorizations has been preceded
of a needs and risk analysis. The review has also included how the Health
and the health care board assigned authorizations for access to
the main journal system NCS Cross, and what access possibilities they were allocated
the authorizations provide within the framework of the internal secrecy according to ch.
the Patient Data Act, as the cohesive record keeping according to ch.
patient data law. In addition to this, the Data Inspectorate has also examined which one
documentation of access (logs) contained in the record system.
The Data Inspectorate has only examined the user's access options to
the journal system, i.e. what care documentation the user can actually take
part of and read. Supervision does not include the functions included in
the competence, ie. what the user can actually do in the journal system
(eg issuing prescriptions, writing referrals, etc.).
Previous review of needs and risk analyzes
The Data Inspectorate has previously carried out an inspection regarding the then
The County Council Board, Västerbotten County Council had implemented one
documented needs and risk analysis according to ch. § 6 second paragraph second
the sentence of the National Board of Health and Welfare's regulations (SOSFS 2008: 14) on
information management and record keeping in health care. Of
The Data Inspectorate's decision with record number 1615-2013, announced on 27
March 2015, it appears that the County Council Board did not meet the requirement that
Page 4 of 29Datainspektionen DI-2019-3841 5 (29)
carry out a needs and risk analysis in accordance with the said regulations, and
was therefore instructed to implement one for the main record system.
What has emerged in the case
The Health and Medical Care Board has mainly stated the following.
Personal data manager
On January 1, 2019, a reorganization was made which meant that Region
Västerbotten was formed. There is no authority under Health and
the health care board. The Health and Medical Care Board conducts health and
healthcare within the region and is responsible for the processing of personal data
personal data that the business performs in the main record system NCS Cross.
Journal system
The main journal system used is called NCS Cross and stands for Nordic
Clinical Suite. It is possible to take part in care documentation in NCS Cross
from 1993 when the system was introduced. At that time was
the allocation of privileges was more limited and users had access to
fewer data than in the current system. The so-called Employee Assignments
was added in 2014–2015. Employee assignments regulate on which organizational
level access can be done in NCS Cross and is required to access the system.
NCS Cross is used within the framework of coherent record keeping
together with seven other care providers.
In connection with the Data Protection Ordinance began to apply
the supplier a general review of the system and informed that
no functional adjustments needed to be made.
There are 101 databases in NCS Cross based on the fact that each clinic basically has one
own database. Within Region Västerbotten, the number of units is 84 (active
databases). Within NCS Cross, there are so-called protected units.
In NCS Cross, it is possible to control the staff's access possibilities
different ways in terms of authorization management, including through
employee assignments and functions for blocking records.
Protected information, about patients with a protected identity at the Swedish Tax Agency, is
not available in NCS Cross.
Page 5 of 29Datainspektionen DI-2019-3841 6 (29)
The number of patients and employees
The number of unique registered patients in NCS Cross within the framework of the internal
the confidentiality is 652,995. The number of patients registered within the framework
for unified record keeping is 665,564.
There are approximately 10,000 employees in the Västerbotten Region. Within the region
9,139 users have a valid employee assignment and active account in NCS
Cross. The number of active user accounts in the region is 12,366. The reason
to the difference in the number of users is that the businesses have not reported
to the administration that the authorization is to be terminated. Access to NCS Cross
stopped anyway because the users who do not have an employee assignment
can not log in to the application. The process is automated so that the AD
the account and thus also the employee assignment is automatically closed when
the employment ends.
Internal secrecy
Needs and risk analysis
The Data Inspectorate's decision of 27 March 2015 states that
The County Council Board, Västerbotten County Council, was instructed to produce one
documented needs and risk analysis for the main record system.
Against this background, the Health and Medical Care Board has stated, among other things
following.
The Health and Medical Care Board has followed the Data Inspectorate's previous decisions
and produced the documents Guideline for information security and
management and operation and Template - Needs and risk analysis at
authorization. The control document and the template have been prepared to provide
the business managers tools in connection with the allocation of authority.
Documents User profiles are examples that clarify that permissions
not assigned generally but individually. The documents are also examples of
performed analyzes at actual eligibility assignments within various
devices. The needs and risk analysis is made from the business perspective and
not from an integrity perspective.
2
The documents have been received by the Data Inspectorate.
Page 6 of 29Datainspektionen DI-2019-3841 7 (29)
The board does not know to what extent the template Template - Needs and risk analysis
when allocating privileges is used in the business, when you only see
the result of the authorization order itself. The board has assumed that
the business managers make a needs and risk analysis before ordering
permissions. However, the committee has not seen any documented needs and
risk analysis neither for the internal confidentiality nor for the cohesive
record keeping.
The guidelines for information security state that authorization must be granted
after an analysis of what information different staff categories in different
businesses need. The guidelines also state that the risk analysis must take place
consideration of the risks it may entail if the staff has too little or too little
much access to various patient data. Then the needs vary between different
types of activities, the business manager is responsible for the needs and
risk analysis is performed at unit level. According to the guidelines, the business should
document the needs and risk analysis when allocating
the employee assignment.
The guidelines also state, among other things, that in addition to regular inspections
of the users' authorization needs, the authorizations shall be reviewed accordingly
organizational and system change.
Authorization of access to personal data about patients
The Health and Medical Care Board has mainly stated the following.
In order for an executive to be able to access personal data in NCS Cross
several conditions need to be met. The executive must have one
active user account in the region domain (AD). This in turn presupposes that
the executive is registered in the HR system. To be able to log in to
domain, executives need a SITHS card with one or more valid ones
certificate. To then be able to log in to NCS Cross needs
the executive partly have a valid so-called employee assignment, partly become
assigned a license in NCS Cross. The employee assignment regulates on which
organizational level access can be done in NCS Cross. It is
the heads of operations of the various units that decide on the allocation of
the employee assignment to his staff at the care unit.
Page 7 of 29Datainspektionen DI-2019-3841 8 (29)
Two-step authentication "that you really are who you are" and that access
closes to the user when he quits are examples of actual actions such as
taken to prevent unnecessary dissemination of personal data.
The qualifications assigned to the staff are based on the needs analysis that is performed
before the assignment, ie where and with what the employee works.
For example, counselors and physiotherapists may be employed in different units,
which means that they have more employee assignments and thus must be given
access to more devices. The same applies to emergency physicians who also have
access to more units than the own emergency database.
The staff's access to databases is based on the need that exists. One
employee assignments can thus mean that an employee can be authorized
to multiple databases. A nurse at Neurocentrum can, for example, get one
employee assignments with access to eight databases because the clinic has
eight databases and the nurse's work requires access to all of them.
Access opportunities (read access) to care documentation in NCS Cross
Each employee has a reading authority that is adapted based on the individual's
mission. If an employee is granted reading permission within the entire Region
Västerbotten only applies to care documentation. Protected devices are
excluded.
In the NCS Cross access control system, there are two types of access
Own competence, partly Service role.
Own competence means that an executive is given access to them
functions in the record system that are relevant to the executive
tasks, such as prescribing medicines. Own authority
also means that the executive is given permission to read and write to them
parts of the journal system (databases) that are linked to it or they
care units where the executive is active.
Eligibility according to the position role means that an executive is also given
read access to other databases in the journal system. The executive can
then the service role is given Reading permission VLL which means access
(read access) to all units' care documentation in the Region
Västerbotten, except for protected units. Executives can be assigned one
other reading permission than Reading permission VLL. Read access to
Page 8 of 29Datainspektionen DI-2019-3841 9 (29)
personal data of protected entities are provided only within the framework of the allocation of
Own authority.
The module that handles the journal in NCS Cross is heading
Care documentation. The module contains all documentation that is available
the patient in accordance with ch. 4 § 1 Patient Data Act. There are others as well
modules, such as Care Administration, which contain information in accordance
with ch. 2 4 § 2 of the Patient Data Act.
Doctors are almost always assigned a Reading Permit VLL. Regarding
the nurses are often ordered to read VLL, which means that a
majority of nurses are assigned this reading privilege. Have the staff
assigned write permission in the system, it means that the staff also has
readability in it. The number of executives who have Reading Authorization VLL in
NCS Cross has a total of 7,586. Of these, 2,290 are doctors, 3,759 are nurses,
124 are assistant nurses including pediatric nurses and 956 are paramedics.
The information is valid for December 2019.
Restrictions on access to data in NCS Cross
There are no direct obstacles to introducing restrictive features
read access and thus access in NCS Cross. The system enables
allocating permissions that give users different access options.
It can be done on an individual level. You can also restrict access to some
devices. Technically, for example, it is possible to exclude BUP from
access possibilities. Operations managers can restrict access and control
privileges so that the staff of a unit has access to data only
about care and treatment at the relevant unit and not such information at others
devices.
Within NCS Cross 84 units, there are the following six protected units. 1) The device
clinical genetics, 2) Unit for Child and Adolescent Habilitation 3) Section
child and adolescent habilitation within the unit child and adolescent clinic
Västerbotten 4) Section for orphanages, within the unit for children and
youth psychiatry Västerbotten 5) Occupational health care 6) The LSS units
in disability activities, visual and hearing rehabilitation and support and
habilitation for adults and the section on the exercise of authority in the Support unit
and habilitation for adults.
Page 9 of 29Data Inspectorate DI-2019-3841 1 0 (29)
An active choice for access is required by the user when the patient has blocked his
care documentation.
Coherent record keeping
The Health and Medical Care Board has mainly stated the following.
Needs and risk analysis
Template Template - Needs and risk analysis when granting eligibility also applies
for the unified record keeping. Needs analysis done before
authorization allocation also includes analysis for access within the framework of
coherent record keeping.
Authorization of access to personal data about patients
If an employee has been granted reading permission in the internal secrecy, it means
that he has also been granted reading permission for the unified record keeping.
Access opportunities (read access) to care documentation in NCS Cross
The reading authority within the coherent record keeping is the same as
for internal secrecy. This means that the staff can take part in everything
care documentation about all patients who are in the system for it
coherent record keeping. The basis for this lies
employee assignment.
Restrictions on access to data in NCS Cross
Employees must make active choices to access information in it
keep records in mind, ie answer the question of whether the patient has given
their consent or state that there is an emergency to be able to take part
of the data.
Documentation of access (logs)
The Health and Medical Care Board has stated, among other things, the following.
Each time a user enters NCS Cross, the activity is logged. The search on
a patient can be done on social security number or backup number. According to
guidelines, the system must once a month select ten users on one
unit. In such a log check, all patient records are displayed as respective
users opened for login during the checked log period as well
all activities done in the care portal: time, activity, social security number,
Page 10 of 29Datainspektionen DI-2019-3841 1 1 (29)
patient, journal, information, staff, title, location, client, purpose
and date.
In the log extract, it is stated under the heading Client at which unit
the measures have been taken, ie which care unit's employee assignment
the user used at login. Under the heading Journal it is stated
database from which the staff retrieved data, ie at which
care unit documentation the user reads in.
The database called Medicincentrum contains care documentation from two
care units, partly Medicincentrum, partly Hjärtcentrum. If, for example
login is done in the database Medicincentrum by a doctor who works at
the unit Medicincentrum, the log extract will state Medicincentrum
both under the heading Client and the heading Journal. About the doctor
on the other hand, working at the Heart Center, it appears in the log extract under the heading
Client to be specified Heart Center.
The log entries generated refer to both the internal confidentiality and the
coherent record keeping.
The Health and Medical Care Board has submitted to the Swedish Data Inspectorate
log extract with documentation of the accesses (logs) that were created with
due to the inspection of the inspection.
Grounds for the decision
Applicable rules
The Data Protection Regulation is the primary source of law
The Data Protection Regulation, often abbreviated GDPR, was introduced on 25 May 2018 and
is the primary legal regulation in the processing of personal data. This
also applies to health care.
The basic principles for the processing of personal data are set out in
Article 5 of the Data Protection Regulation. A basic principle is the requirement
security pursuant to Article 5 (1) (f), which states that personal data shall be processed
in a way that ensures adequate security for personal data,
including protection against unauthorized or unauthorized treatment and against loss,
Page 11 of 29Datainspektionen DI-2019-3841 1 2 (29)
destruction or damage by accident, using appropriate
technical or organizational measures.
Article 5 (2) states the so-called liability, ie. that it
personal data controllers must be responsible for and be able to show that the basic
the principles set out in paragraph 1 are complied with.
Article 24 deals with the responsibility of the controller. Of Article 24 (1)
it appears that the person responsible for personal data is responsible for implementing appropriate
technical and organizational measures to ensure and demonstrate that
the processing is performed in accordance with the Data Protection Regulation. The measures shall
carried out taking into account the nature, scope, context of the treatment
and purposes and the risks, of varying degrees of probability and severity, for
freedoms and rights of natural persons. The measures must be reviewed and updated
if necessary.
Article 32 regulates the security associated with the processing. According to paragraph 1
the personal data controller and the personal data assistant shall take into account
of the latest developments, implementation costs and treatment
nature, scope, context and purpose as well as the risks, of varying
probability and seriousness, for the rights and freedoms of natural persons
take appropriate technical and organizational measures to ensure a
level of safety appropriate to the risk (…). According to paragraph 2,
when assessing the appropriate level of safety, special consideration is given to the risks
which the treatment entails, in particular from accidental or unlawful destruction,
loss or alteration or to unauthorized disclosure of or unauthorized access to
the personal data transferred, stored or otherwise processed.
Recital 75 states that in assessing the risk to natural persons
rights and freedoms, various factors must be taken into account. Among other things mentioned
personal data covered by professional secrecy, health data or
sexual life, if the processing of personal data concerning vulnerable physical persons takes place
persons, especially children, or if the treatment involves a large number
personal data and applies to a large number of registered persons.
Furthermore, it follows from recital 76 that the probable and serious risk of it
data subjects' rights and freedoms should be determined on the basis of processing
nature, scope, context and purpose. The risk should be evaluated on
Page 12 of 29Datainspektionen DI-2019-3841 1 3 (29)
on the basis of an objective assessment, which determines whether
the data processing involves a risk or a high risk.
Recitals 39 and 83 also contain writings that provide guidance on it
the meaning of the data protection regulation's requirements for security in
Processing of personal data.
The Data Protection Regulation and the relationship with complementary national
provisions
According to Article 5 (1). a in the Data Protection Regulation, the personal data shall
treated in a lawful manner. In order for the treatment to be considered legal, it is required
legal basis by fulfilling at least one of the conditions of Article 6 (1).
The provision of health care is one such task of general
interest referred to in Article 6 (1). e.
In health care, the legal bases can also be legal
obligation under Article 6 (1). c and the exercise of authority under Article 6 (1) (e)
updated.
When it comes to the legal bases legal obligation, in general
interest or exercise of authority by the Member States, in accordance with Article
6.2, maintain or introduce more specific provisions for adaptation
the application of the provisions of the Regulation to national circumstances.
National law may specify specific requirements for the processing of data
and other measures to ensure legal and equitable treatment. But
there is not only one possibility to introduce national rules but also one
duty; Article 6 (3) states that the basis for the treatment referred to in
paragraph 1 (c) and (e) shall be determined in accordance with Union law or
national law of the Member States. The legal basis may also include
specific provisions to adapt the application of the provisions of
the Data Protection Regulation. Union law or the national law of the Member States
law must fulfill an objective of general interest and be proportionate to it
legitimate goals pursued.
Article 9 states that the treatment of specific categories of
personal data (so-called sensitive personal data) is prohibited. Sensitive
personal data includes data on health. Article 9 (2) states
except when sensitive personal data may still be processed.
Page 13 of 29Datainspektionen DI-2019-3841 1 4 (29)
Article 9 (2) (h) states that the processing of sensitive personal data may be repeated
the treatment is necessary for reasons related to, among other things
the provision of health care on the basis of Union law or
national law of the Member States or in accordance with agreements with professionals in
the field of health and provided that the conditions and protective measures provided for in
referred to in paragraph 3 are met. Article 9 (3) imposes a regulated duty of confidentiality.
This means that both the legal bases of general interest,
exercise of authority and legal obligation in the treatment of the vulnerable
personal data under the exemption in Article 9 (2). h need
supplementary rules.
Supplementary national regulations
In the case of Sweden, both the basis for the treatment and those
special conditions for the processing of personal data in the field of health and
healthcare regulated in the Patient Data Act (2008: 355), and
the Patient Data Ordinance (2008: 360). I 1 kap. Section 4 of the Patient Data Act states that
the law complements the data protection regulation.
The purpose of the Patient Data Act is to provide information in health and
healthcare must be organized so as to meet patient safety and
good quality and promotes cost efficiency. Its purpose is also to
personal data shall be designed and otherwise processed so that patients and
the privacy of other data subjects is respected. In addition, must be documented
personal data is handled and stored so that unauthorized persons do not have access to it
them (Chapter 1, Section 2 of the Patient Data Act).
The supplementary provisions in the Patient Data Act aim to:
take care of both privacy protection and patient safety. The legislator has
thus through the regulation made a balance as to how
the information must be processed to meet both the requirements for patient safety
as the right to privacy in the processing of personal data.
The National Board of Health and Welfare has, with the support of the Patient Data Ordinance, issued regulations
and general advice on record keeping and processing of personal data in
health care (HSLF-FS 2016: 40). The regulations constitute such
supplementary rules, which shall be applied in the care provider's treatment of
personal data in health care.
Page 14 of 29Datainspektionen DI-2019-3841 1 5 (29)
National provisions supplementing the requirements of the Data Protection Regulation
safety can be found in Chapters 4 and 6. the Patient Data Act and Chapters 3 and 4 HSLF-FS
2016: 40.
Requirement to do needs and risk analysis
The care provider must, according to ch. § 2 HSLF-FS 2016: 40 make a needs and
risk analysis, before the allocation of authorizations in the system takes place.
That the analysis requires both the needs and the risks is clear from the preparatory work
to the Patient Data Act, prop. 2007/08: 126 pp. 148-149, as follows.
Authorization for staff's electronic access to patient information shall
limited to what the executive needs to be able to perform his
tasks in health care. This includes that permissions should
followed up and changed or reduced over time as changes in the individual
the executive's duties give rise to it. The provision
corresponds in principle to section 8 of the Health Care Register Act. The purpose of the provision is to
imprint the obligation of the responsible caregiver to make active and
individual eligibility assignments based on analyzes of which details
information different staff categories and different types of activities need. But
not only needs analyzes are needed. Risk analyzes must also be done where you take them
taking into account various types of risks that may be associated with an excessively wide
availability of certain types of data. Protected personal data that is
classified, information on public figures, information from certain
receptions or medical specialties are examples of categories that can
require special risk assessments.
In general, it can be said that the more comprehensive an information system is, the more
there must be a greater variety of eligibility levels. Decisive for decision on
eligibility for e.g. different categories of health care professionals to
electronic access to information in patient records should be that the authorization should
limited to what the executive needs for the purpose a good and safe
patient care. A more extensive or coarse-grained allocation of competences should -
even if it would have points from an efficiency point of view - considered as one
unjustified dissemination of journal information within a business and should as such
not accepted.
Furthermore, data should be stored in different layers so that sensitive information is required to be active
choices or otherwise are not as easily accessible to staff as less sensitive
tasks. In the case of staff working with business follow-up,
statistical production, central financial administration and similar activities
which is not individual-oriented, this should be sufficient for most executives
access to data that can only be indirectly derived from individual patients.
Electronic access to code keys, social security numbers and other information such as
Page 15 of 29Datainspektionen DI-2019-3841 1 6 (29)
directly pointing out individual patients should be able to be strong in this area
limited to individuals.
Internal secrecy
The provisions in ch. 4 The Patient Data Act concerns internal confidentiality, ie.
regulates how privacy protection is to be handled within a care provider's business
and especially employees' opportunities to prepare for
personal data that is electronically available in a healthcare provider
organisation.
It appears from ch. Section 2 of the Patient Data Act, that the care provider shall decide
conditions for granting access to such data
patients who are fully or partially automated. Such authorization shall
limited to what is needed for the individual to be able to fulfill theirs
tasks in health care.
According to ch. 4 § 2 HSLF-FS 2016: 40, the care provider shall be responsible for each
users are assigned an individual privilege to access
personal data. The caregiver's decision on the allocation of eligibility shall
preceded by a needs and risk analysis.
Coherent record keeping
The provisions in ch. 6 the Patient Data Act concerns cohesive record keeping,
which means that a care provider - under the conditions specified in § 2 the same
chapter - may have direct access to personal data processed by others
caregivers for purposes related to care documentation. The access to
information is provided by a healthcare provider making the information about a patient
which the care provider registers if the patient is available to other care providers
who participate in the coherent record keeping (see Bill 2007/08: 126 p. 247).
Of ch. 6 Section 7 of the Patient Data Act follows that the provisions in Chapter 4 § 2 also
applies to authorization allocation for coherent record keeping. The requirement of
that the care provider must perform a needs and risk analysis before allocating
permissions in the system take place, thus also applies in systems for cohesion
record keeping.
Page 16 of 29Datainspektionen DI-2019-3841 1 7 (29)
Documentation of access (logs)
Of ch. 4 Section 3 of the Patient Data Act states that a care provider must ensure that
access to such data on patients who are kept in whole or in part
automatically documented and systematically checked.
According to ch. 4 Section 9 HSLF-FS 2016: 40, the care provider shall be responsible for that
1. it appears from the documentation of the access (logs) which
measures taken with information on a patient,
2. it appears from the logs at which care unit or care process
measures have been taken,
3. the logs indicate the time at which the measures were taken;
4. the identity of the user and the patient is stated in the logs.
The Data Inspectorate's assessment
Personal data controller's responsibility for security
As previously described, Article 24 (1) of the Data Protection Regulation provides a
general requirement for the personal data controller to take appropriate technical
and organizational measures. The requirement is partly to ensure that
the processing of personal data is carried out in accordance with
the Data Protection Ordinance, and that the data controller must be able to
demonstrate that the processing of personal data is carried out in accordance with
the Data Protection Regulation.
The safety associated with the treatment is regulated more specifically in the articles
5.1 (f) and Article 32 of the Data Protection Regulation.
Article 32 (1) states that the appropriate measures shall be both technical and
organizational and that they must ensure an appropriate level of security in
in relation to the risks to the rights and freedoms of natural persons which
the treatment entails. It is therefore necessary to identify the possible ones
the risks to the data subjects' rights and freedoms and assess
the probability of the risks occurring and the severity if they occur.
What is appropriate varies not only in relation to the risks but also
based on the nature, scope, context and purpose of the treatment. It has
thus the significance of what personal data is processed, how many
data, it is a question of how many people process the data, etc.
Page 17 of 29Datainspektionen DI-2019-3841 1 8 (29)
The health service has a great need for information in its operations. The
It is therefore natural that the possibilities of digitalisation are utilized as much as
possible in healthcare. Since the Patient Data Act was introduced, a lot
extensive digitization has taken place in healthcare. Both the data collections
size as the number of people sharing information with each other has increased
substantially. At the same time, this increase means that the demands on it increase
personal data controller, as the assessment of what is an appropriate
safety is affected by the extent of the treatment.
It is also a question of sensitive personal data. The information concerns
people who are in a situation of dependence when they are in need of care.
It is also often a question of a lot of personal information about each of these
people and the data may over time may be processed by very
many people in healthcare. All in all, this places great demands on it
personal data controllers.
The data processed must be protected from outside actors as well
the business as against unauthorized access from within the business. It appears
of Article 32 (2) that the data controller, in assessing the appropriate
level of safety, in particular shall take into account the risks of unintentional or illegal
destruction, loss or unauthorized disclosure or unauthorized access. In order to
be able to know what is an unauthorized access it must
personal data controllers must be clear about what is an authorized access.
Needs and risk analysis
I 4 kap. Section 2 of the National Board of Health and Welfare's regulations (HSLF-FS 2016: 40), which supplement
In the Patient Data Act, it is stated that the care provider must make a needs and
risk analysis before the allocation of authorizations in the system takes place. This means that
national law prescribes requirements for an appropriate organizational measure that shall:
taken before the allocation of authorizations to journal systems takes place.
A needs and risk analysis must include an analysis of the needs and a
analysis of the risks from an integrity perspective that may be associated
with an overly allotment of access to personal data
about patients. Both the needs and the risks must be assessed on the basis of them
tasks that need to be processed in the business, what processes it is
the question of whether and what risks to the privacy of the individual exist.
Page 18 of 29Datainspektionen DI-2019-3841 1 9 (29)
The assessments of the risks need to be made on the basis of organizational level, there
for example, a certain business part or task may be more
privacy sensitive than another, but also based on the individual level, if it is
the issue of special circumstances that need to be taken into account, such as
that it is a question of protected personal data or data of general
famous people. The size of the system also affects the risk assessment. Of
The preparatory work for the Patient Data Act states that the more comprehensive one
information system is, the greater the variety of authorization levels required
there is. (Prop. 2007/08: 126 p. 149).
It is thus a question of a strategic analysis at a strategic level, which should give one
authorization structure that is adapted to the business and this must be maintained
updated.
In summary, the regulation requires that the risk analysis identifies
different categories of data (eg data on health),
Categories of data subjects (eg vulnerable natural persons and
children), or
the scope (eg number of personal data and registered)
negative consequences for data subjects (eg injuries,
significant social or economic disadvantage, deprivation of rights
and freedoms),
and how they affect the risk to the rights and freedoms of natural persons
Processing of personal data. This applies both within internal secrecy
as in coherent record keeping.
The risk analysis must also include special risk assessments, for example
based on whether there is protected personal data that is
classified, information on public figures, information from
certain clinics or medical specialties (Bill 2007/08: 126 p. 148-
149).
The risk analysis must also include an assessment of how probable and serious
the risk to the data subjects' rights and freedoms is and in any case determined
whether it is a risk or a high risk (recital 76).
It is thus through the needs and risk analysis that it
personal data controller finds out who needs access, which
Page 19 of 29Datainspektionen DI-2019-3841 2 0 (29)
information the accessibility shall include, at what times and at what
context access is needed, while analyzing the risks to it
the freedoms and rights of the individual that the treatment may lead to. The result should
then lead to the technical and organizational measures needed to
ensure that no one other than the one who needs and
the risk analysis shows that it should be justified.
When a needs and risk analysis is missing prior to the allocation of qualifications in
system, lacks the basis for the personal data controller on a legal
be able to assign their users a correct authorization. The
the data controller is responsible for, and shall have control over, the
personal data processing that takes place within the framework of the business. To
assign users a when accessing journal system, without this being founded
on a performed needs and risk analysis, means that the person responsible for personal data
does not have sufficient control over the personal data processing that takes place in
the journal system and also can not show that he has the control that
required.
The Health and Medical Care Board's work with needs and risk analysis
When the Data Inspectorate has requested a documented needs and
risk analysis, the Health and Medical Care Board has stated that the board has done
a needs and risk analysis, but only from the business perspective, not
from the integrity perspective. The Data Inspectorate therefore wants to emphasize that
is not enough to do a needs analysis. As previously described,
appears from Article 32 of the Data Protection Ordinance and the National Board of Health and Welfare
regulations, it is required that the Health and Medical Care Board must also make one
risk analysis where the board considers various risks that may be associated with
one too in the availability of different types of personal data about patients for
to then weigh the needs of the business against the risks for the individual
integrity. In addition, the personal data controller, according to i
the requirements of the Data Protection Regulation under Article 5, be able to
show that, among other things, appropriate organizational measures have been taken.
The Health and Medical Care Board has referred to the heads of operations
is responsible for a needs and risk analysis. The Data Inspectorate therefore wants
also emphasize that the board as the person responsible for personal data can not waive
take responsibility for the analysis and, on the basis of it, take appropriate technical and
organizational measures. This means that the board should have ensured
Page 20 of 29Datainspektionen DI-2019-3841 2 1 (29)
the implementation of a needs and risk analysis according to ch. § 2 HSLF-FS
2016: 40 and documented it.
A needs and risk analysis must be performed at a strategic level
The Health and Medical Care Board has stated that the board after
The Data Inspectorate's previous injunction produced documents to provide
business managers tools for assigning permissions. The committee has
referred to the documents Guideline for information security - management and
operation and the template Template- Needs and risk analysis when allocating authorization
The Data Inspectorate states that the guidelines and the template are about
allocation of authorizations and that the documents are based on a need and
risk analysis must be done in connection with the actual allocation. (In the guidelines
states, for example, that a risk analysis must be performed to shed light on different types of risks
associated with too extensive availability and that documentation of
completed needs and risk analysis must be archived at the unit. In the template
referred to the Patient Data Act and that a decision on allocation must be preceded by a
needs and risk analysis). The Data Inspectorate therefore wants to emphasize that a
needs and risk analysis shall establish an overall competence structure
which in turn should form the basis for the allocation of qualifications to be made
for each individual executive. The strategic analysis to be taken is
thus further than the analysis made at the actual allocation of
the powers. A properly conducted needs and risk analysis is one
prerequisite for a correct allocation of authorizations.
The Health and Medical Care Board has also referred to the documents
User profiles as examples of analyzes performed at actual
authorization assignments. The Data Inspectorate also finds in this case that
it is not a question of any needs and risk analysis.
The Swedish Data Inspectorate's summary assessment
As stated above, in a needs and risk analysis, both the needs and
the risks are assessed on the basis of the data that need to be processed in
the business, what processes are involved and what are the risks for it
individual integrity that exists on both organizational and individual
level. It is thus a question of a strategic analysis at a strategic level, which should
provide a basis for an authorization structure that is adapted to the activities.
It should result in authorization assignments but it is not
the instructions to the person who assigns the permissions that are the analysis.
Page 21 of 29Datainspektionen DI-2019-3841 2 2 (29)
In summary, the Data Inspectorate states that the Health and
the health care board has not submitted any documented needs
and risk analysis. The committee has also stated that it has not seen anyone
documented such. The Health and Medical Care Board has thus not been able to
show that the board has carried out a needs and risk analysis in the sense that
referred to in ch. 4 § 2 HSLF-FS 2016: 40, neither within the framework of the internal
confidentiality or within the framework of coherent record keeping. This
means that the Health and Medical Care Board has not taken appropriate
organizational measures in accordance with Article 5 (1) (f) and Article 31 (1) and (2) for
be able to ensure and, in accordance with Article 5 (2), be able to demonstrate that:
the processing of personal data has a security that is appropriate in
in relation to the risks.
Authorization of access to personal data about patients
As reported above, a caregiver may have a legitimate interest in having
a comprehensive processing of data on the health of individuals. Notwithstanding this shall
access to personal data about patients may be limited to
what is needed for the individual to be able to fulfill his or her duties.
With regard to the allocation of authorization for electronic access according to ch.
§ 2 and ch. 6 Section 7 of the Patient Data Act states that in the preparatory work, Bill.
2007/08: 126 pp. 148-149, i.a. that there should be different eligibility categories in
the journal system and that the permissions should be limited to what the user
need to provide the patient with good and safe care. It also appears that “a
more extensive or coarse-grained eligibility should be considered as one
unauthorized dissemination of journal information within a business and should as
such is not accepted ”.
In health care, it is the person who needs the information in their work
who may be authorized to access them. This applies both within a
caregivers as between caregivers. It is, as already mentioned, through
the needs and risk analysis that the person responsible for personal data finds out who
who need access, what information the access should include, at which
times and in which contexts access is needed, and at the same time
analyzes the risks to the individual's freedoms and rights
the treatment can lead to. The result should then lead to the technical and
organizational measures needed to ensure no allocation
of eligibility provides further access opportunities than the one that needs and
Page 22 of 29Datainspektionen DI-2019-3841 2 3 (29)
the risk analysis shows is justified. An important organizational measure is to provide
instruction to those who have the authority to assign authorizations on how this
should go to and what should be considered so that it, with the needs and risk analysis
as a basis, becomes a correct authorization allocation in each individual case.
That the Health and Medical Care Board's allocation of qualifications does not have
preceded by a needs and risk analysis means that the board has not
analyzed users' need for access to the data, the risks that
this access may entail and thus also not identified which
access that is justified to users based on such an analysis. The committee
has therefore not taken appropriate action in accordance with Article 32 of
the Data Protection Regulation, to restrict users' access to
patients' personal data in the medical record system.
This in turn has meant that there has been a risk of unauthorized access and
unjustified dissemination of personal data partly within the framework of the internal
secrecy, partly within the framework of the coherent record keeping.
In the case, it has emerged that the number of registered patients in NCS Cross
within the internal secrecy is just over 650,000 and within the framework of
cohesive record keeping just over 665,000. The case has also emerged
that there are about 10,000 employees in the region and that just over 7,500
executives have been awarded Reading VLL in NCS Cross. This
authorization gives access (read access) to all devices
care documentation in the Västerbotten Region, except the one prepared on
protected devices. Of a total of 84 units, six are protected
devices. In summary, the Data Inspectorate states that this means
that the majority of the employees have had actual access to
the care documentation of the majority of patients in NCS Cross.
Care documentation means that it is a question of health information, so-called
sensitive personal data within the meaning of Article 9 (1) of the Data Protection Regulation. By
that the personal data controller only restricted access to permissions
in NCS Cross to data available on protected devices thus has
there has been a risk of unauthorized access and unauthorized distribution of
personal data partly within the framework of internal secrecy, partly within the framework
for the unified record keeping.
Page 23 of 29Datainspektionen DI-2019-3841 2 4 (29)
The Health and Medical Care Board has stated that an active choice for access is required
by the user when the patient has blocked their care documentation.
The Data Inspectorate wants to emphasize that an active choice is an enhancement of integrity
measure but does not constitute such an access restriction as referred to in ch. § 2
patient data law. This provision requires that the jurisdiction be restricted
to what is needed for the individual to be able to fulfill his
tasks in health care, ie. only those in need
the data must have access to them. Of the preparatory work for
Patient Data Act, prop. 2007/08: 126, p. 149, it appears that information in addition
need to be stored in different layers so that more sensitive data require active choices
or otherwise are not as easily accessible to staff as less sensitive
tasks.
Against this background, the Data Inspectorate can state that the Health and
the Health Care Board has processed personal data in violation of Article 5 (1) (f)
and Article 32 (1) and (2) of the Data Protection Regulation by the Board not
has restricted users' permissions to access the journal system
NCS Cross to what is only needed for the user to be able to fulfill
their duties in health and medical care according to ch. § 2 and ch. 6 7
§ the Patient Data Act and ch. 4 2 § HSLF-FS 2016: 40. This means that the Health
and the health care board has not taken measures to be able to ensure
and, in accordance with Article 5 (2) of the Data Protection Regulation, be able to display a
appropriate security for personal data.
Documentation of access (logs)
Based on the logs created as a result of the inspection
reviews together with the information provided by the board
the heading in the log extracts, the Data Inspectorate states that of
the log extracts show the following:
under the heading Activity, what measures have been taken
information about a patient, for example to "read".
under the headings Journal at which care unit or care process
measures have been taken
under the heading Time at which time the measures were taken
under the headings Patient and Personal of the user and the patient
identity.
The Data Inspectorate finds that the documentation of the access (the logs)
in NCS Cross is in accordance with the requirements set out in ch. § 9 HSLF-
Page 24 of 29Datainspektionen DI-2019-3841 2 5 (29)
FS 2016: 40 and that the Health and Medical Care Board thus in this part has
have taken appropriate technical measures in accordance with Article 32 i
the Data Protection Regulation.
Choice of intervention
Legal regulation
If there has been a violation of the provisions of the Data Protection Regulation
the Data Inspectorate has a number of corrective powers available according to
Article 58 (2) (a) to (j) of the Data Protection Regulation. The supervisory authority may include
otherwise instruct the person responsible for personal data to ensure that the processing takes place
in accordance with the Regulation and if required in a specific way and within
a specific period.
It follows from Article 58 (2) of the Data Protection Regulation that the Data Inspectorate in
in accordance with Article 83 shall impose penalty charges in addition to or in lieu of
other corrective measures referred to in Article 58 (2),
the circumstances of each individual case.
For the purposes of Article 83 (7) of the Data Protection Regulation, national authorities may:
rules state that administrative sanctions may be imposed on authorities.
According to ch. 6 Section 2 of the Data Protection Act allows for penalty fees to be decided
authorities, but to a maximum of SEK 5,000,000 or SEK 10,000,000
depending on whether the infringement concerns articles covered by Article 83 (4)
or 83.5 of the Data Protection Regulation.
Article 83 (2) of the Data Protection Regulation sets out the factors to be taken into account for
to decide whether to impose an administrative penalty fee, but also
what is to affect the size of the penalty fee. Of central importance to
the assessment of the gravity of the infringement is its nature, severity and
duration. In the case of a minor infringement may
the regulatory authority, in accordance with recital 148 of the Data Protection Regulation, issue a
reprimand instead of imposing a penalty fee.
Order
The health service has a great need for information in its operations. The
It is therefore natural that the possibilities of digitalisation are utilized as much as
Page 25 of 29Datainspektionen DI-2019-3841 2 6 (29)
possible in healthcare. Since the Patient Data Act was written, one has a lot
extensive digitization has taken place in healthcare. Both the data collections
size as the number of people sharing information with each other has increased
substantially. At the same time, this increase means that the demands on it increase
personal data controller, as the assessment of what is an appropriate
safety is affected by the extent of the treatment.
In health care, this means a great responsibility for it
personal data controller to protect the data from unauthorized access,
among other things by having an authorization allocation that is even more
comminuted. It is therefore essential that there is a real analysis of the needs
based on different activities and different executives. Equally important is that
there is an actual analysis of the risks from an integrity perspective
may occur in the event of an override of access rights. From
this analysis must then be restricted to the individual executive.
This authority must then be followed up and changed or restricted accordingly
hand that changes in the tasks of the individual executive provide
reason for it.
The Data Inspectorate's inspection has shown that the Health and Medical Care Board has
failed to take appropriate security measures to provide protection to
the personal data in the journal system NCS Cross by not complying with the requirements
which is set in the Patient Data Act and the National Board of Health and Welfare's regulations and thereby
does not meet the requirements of Article 5 (1) (f) and Article 32 (1) and (2) (i)
the Data Protection Regulation. Failure includes both the interior
the secrecy according to ch. 4 the Patient Data Act as the cohesive one
record keeping according to ch. 6 patient data law.
The Data Inspectorate therefore submits, with the support of 58.2 d i
the Data Protection Ordinance, the Health and Medical Care Board to implement and
document the required needs and risk analysis for the NCS medical record system
Cross within the framework of both internal secrecy and within the framework of it
coherent record keeping. The Health and Medical Care Board shall further,
with the support of the needs and risk analysis, assign each user individually
authorization for access to personal data limited to what only
necessary for the individual to be able to fulfill his duties within
Healthcare.
Page 26 of 29Datainspektionen DI-2019-3841 2 7 (29)
Penalty fee
The Data Inspectorate can state that the violations basically concern the Health
and the healthcare board's obligation to take appropriate safety measures for
to provide protection for personal data in accordance with the Data Protection Regulation.
In this case, it is a matter of large collections of data with sensitive
personal data and extensive powers. The caregiver needs to be involved
necessity to have a comprehensive processing of data on the health of individuals.
However, it must not be unrestricted but should be based on what individual
employees need to be able to perform their tasks. The Data Inspectorate
notes that this is information that includes direct identification of
the individual through name, contact information and social security number,
health information, but it may also be other private information about
for example, family relationships, sexual life and lifestyle. The patient is addicted
of receiving care and is thus in a vulnerable situation. The nature of the data,
scope and the patients' position of dependence give caregivers a special
responsibility to ensure patients' right to adequate protection for their
personal data.
Additional aggravating circumstances are the treatment of
personal data about patients in the main medical record system belongs to the core of a
the activities of caregivers, that the treatment covers many patients and
the possibility of access refers to a large proportion of the employees. In this case, stir
it is about 650,000 number of patients within the framework of the internal
confidentiality and about 665,000 patients under it
coherent record keeping. Of a total of 84 care units are available
restrictions on access to only six units, the so-called
protected devices.
The Data Inspectorate can also state that the Health and
The Health Care Board did not follow the Data Inspectorate's decision of 27 March 2015.
The decision was presented to the then County Council Board in Västerbotten County
county council to carry out a documented needs and risk analysis accordingly
then requirement in ch. 2 Section 6, second paragraph, second sentence SOSFS 2008: 14,
which corresponds to the current provision in Chapter 4. 2 § HSLF-FS 2016: 40. This
is an aggravating circumstance, in accordance with Article 83 (2) (e) (i)
the Data Protection Regulation.
Page 27 of 29Datainspektionen DI-2019-3841 2 8 (29)
The shortcomings that have now been established have thus been known to Hälso- och
the health care board for several years, which means that the action took place
intentionally and thus is considered more serious. The Data Inspectorate
also notes that the Health and Medical Care Board's information that they
analyzes that have subsequently been made are solely based on the business perspective,
which is particularly serious.
In determining the seriousness of the infringements, it can also be stated that
the infringements also cover the basic principles set out in Article 5 (i)
the Data Protection Regulation, which is one of the more serious infringements that can
provide a higher penalty fee under Article 83 (5) of the Data Protection Regulation.
Taken together, these factors mean that they are not to be judged as minor
infringements without infringements that should lead to an administrative
penalty fee.
The Data Inspectorate considers that these violations are closely related to
each other. That assessment is based on the need and risk analysis
form the basis for the allocation of the authorizations. The Data Inspectorate
therefore considers that these infringements are so closely linked
that they constitute interconnected data processing within the meaning of Article 83 (3) (i)
the Data Protection Regulation. The Data Inspectorate therefore decides on a joint
penalty fee for these infringements.
The administrative penalty fee shall be effective, proportionate and
deterrent. This means that the amount must be determined so that it
the administrative penalty fee leads to correction, that it provides a preventive
effect and that it is also proportional in relation to both current
violations as to the ability of the supervised entity to pay.
The maximum amount for the penalty fee in this case is SEK 10 million
according to ch. 6 Section 2 of the Act (2018: 218) with supplementary provisions to the EU
data protection regulation.
Given the seriousness of the infringements and that the administrative
the penalty fee must be effective, proportionate and dissuasive
the Data Inspectorate determines the administrative sanction fee for
Health and Medical Care Board to 2,500,000 (two million five hundred thousand)
kronor.
Page 28 of 29Datainspektionen DI-2019-3841 2 9 (29)
This decision was made by Director General Lena Lindgren Schelin after
presentation by the IT security specialist Magnus Bergström. At the final
The case is also handled by the General Counsel Hans-Olof Lindblom, the unit managers
Katarina Tullstedt and Malin Blixt and the lawyer Caroline Cruz Julander
participated.
Lena Lindgren Schelin, 2020-12-02 (This is an electronic signature)
Appendix: How to pay a penalty fee
Copy for information to the Data Protection Officer
How to appeal
If you want to appeal the decision, you must write to the Data Inspectorate. Enter i
the letter which decision you are appealing and the change you are requesting.
The appeal must have been received by the Data Inspectorate no later than three weeks from
on the day the decision was announced. If the appeal has been received in due time
the Data Inspectorate forwards it to the Administrative Court in Stockholm
examination.
You can e-mail the appeal to the Data Inspectorate if it does not contain
any privacy-sensitive personal data or data that may be covered by
secrecy. The authority's contact information can be found on the first page of the decision.
Page 29 of 29
