Garante per la protezione dei dati personali (Italy) - 9296257

Garante per la protezione dei dati personali - 9296257
Authority:	Garante per la protezione dei dati personali (Italy)
Jurisdiction:	Italy
Relevant Law:	Article 36(4) GDPR
Type:	Advisory Opinion
Outcome:	n/a
Started:
Decided:	19.03.2020
Published:
Fine:	None
Parties:	n/a
National Case Number/Name:	9296257
European Case Law Identifier:	n/a
Appeal:	Unknown
Original Language(s):	Italian
Original Source:	Garante (IT) (in IT)
Initial Contributor:	n/a

The Garante issued a favorable opinion on the definition by Government decree of the channels (e.g. SMS, e-mail) through which electronic medical prescriptions shall be transmitted to patients.

English Summary

Facts

The Italian economics and finance Ministry (“Mef”) consulted the Garante on the adoption of a decree defining the channels (e.g. SMS, e-mail) through which electronic medical prescriptions shall be transmitted to patients. Such decree does not specify the methods for releasing the e-prescriptions, which shall be referred to in a following decree to be adopted together with the Ministry of health prior consultation with the Garante.

Dispute

n/a

Holding

The Garante confirmed the possibility of providing for digital channels through which deliver e-prescriptions in compliance with rules on health data protection. To this end, the Garante also reminded that technical and security measures shall be considered when specifying the releasing methods of the e-prescriptions (e.g. the prescription shall be attached to the e-mail and protected with encryption).

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Italian original. Please refer to the Italian original for more details.

[doc. web n. 9296257]

Opinion on the Methods of Delivery of the Electronic Medical Prescription - March 19, 2020

Registry of Measures
n. 58 of March 19, 2020

GUARANTOR FOR THE PROTECTION OF PERSONAL DATA

HAVING REGARD TO Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, concerning the protection of individuals with regard to the processing of personal data, and the free movement of such data, and repealing Directive 95/46/EC, “General Data Protection Regulation” (hereinafter referred to as the Regulation);

HAVING REGARD TO the Code on the protection of personal data, containing provisions for adapting the national legal system to Regulation (EU) 2016/679 of the European Parliament and of the Council, of April 27, 2016, concerning the protection of individuals with regard to the processing of personal data, and the free movement of such data, and repealing Directive 95/46/EC (Legislative Decree No. 196 of June 30, 2003, hereinafter referred to as the “Code”);

CONSIDERING the deadlines for issuing opinions as per Article 36, paragraph 4 of the Regulation (Article 156, paragraph 5 of the Code and Regulation of the Guarantor No. 2/2019);

CONSIDERING the COVID-19 epidemiological emergency, for which the draft decree submitted for the Authority's opinion provides that, until the end of the COVID-19 epidemiological emergency, the provisions defined by the Civil Protection Ordinances remain in force concerning the dematerialized prescription as per the decree of November 2, 2011;

CONSIDERING that the aforementioned urgent reasons do not currently allow for the timely convening of the Guarantor's Board;

CONSIDERING therefore that the conditions for the application of Article 5, paragraph 8, of Regulation No. 1/2000 on the organization and functioning of the Guarantor's office are met, which states that “In cases of particular urgency and non-deferrable matters that do not allow the timely convening of the Guarantor, the President may adopt the measures within the competence of the body, which cease to be effective from the moment of their adoption if they are not ratified by the Guarantor at the first useful meeting, to be convened no later than the thirtieth day”;

HAVING REGARD TO the documentation on file;

PRELIMINARY REMARKS

By a note dated February 26, 2020 (protocol No. 31705), the Ministry of Economy and Finance (MEF) transmitted, pursuant to Article 36, paragraph 4 of the Regulation, a draft decree that modifies the decree of November 2, 2011, extending the rules concerning the dematerialization of medical prescriptions to additional categories of prescriptions.

Subsequently, by a note dated March 17, 2020 (protocol No. 39766), the Ministry of Economy and Finance transmitted a new version of the draft decree, introducing further amendments to the aforementioned ministerial decree of November 2, 2011, identifying alternative channels to the printing of the paper reminder of the electronic prescription, the implementation methods of which will be established in a subsequent decree of the same Ministry, to be adopted in agreement with the Ministry of Health, after consulting the Guarantor.

With regard to the provisions on dematerialized prescriptions, in the latest version of the draft decree sent to the Guarantor, the MEF, due to the COVID-19 epidemiological emergency, stipulated that the specific provisions defined by the Civil Protection Ordinances remain in force until the end of the aforementioned state of emergency, concerning the dematerialized prescription as per the decree of November 2, 2011.

OBSERVED

The first version of the draft decree sent to the Guarantor provides for the modification of the decree of November 2, 2011, concerning the dematerialization of medical prescriptions, extending the dematerialized prescription to three new categories of prescriptions.

The version of the draft decree under examination sent on March 17, 2020, also identified alternative channels to the printing of the paper reminder of the electronic prescription (so-called "dematerialized reminder"), the implementation methods of which will be established in a subsequent decree of the same Ministry, to be adopted in agreement with the Ministry of Health, after consulting the Guarantor. This latest version also stipulated that, until the end of the COVID-19 epidemiological emergency, the specific provisions defined by the Civil Protection Ordinances concerning the dematerialized prescription as per the decree of November 2, 2011, remain in force.

The two versions of the draft decree transmitted to the Authority were formulated based on the remarks and indications provided by the Office during some meetings and urgent interlocutions and take into account the technical activities conducted with the regions, the Ministry of Health, the Italian Medicines Agency (AIFA), and the Agency for Digital Italy (AGID).

The latest version of the draft decree transmitted consists of 3 articles, relating to the definitional framework (Article 1), amendments to the referenced decree of November 2, 2011 (Article 2), and emergency measures for the dematerialized prescription (Article 3).

In particular, Article 2 of the draft decree under examination amends the decree of November 2, 2011, extending the dematerialization of the prescription to:

drugs with an AIFA therapeutic plan, to allow the Regions to perform checks aimed at verifying compliance with the conditions indicated in the therapeutic plan (Article 2 introducing Article 1-bis to the decree of November 2, 2011);

drugs distributed through methods other than the conventional regime (Article 2 introducing Article 1-ter to the decree of November 2, 2011);

drugs with a restrictive medical prescription (Article 2 introducing Article 1-quater to the decree of November 2, 2011).

The draft decree also intervenes in the methods of delivery to the patient of the "dematerialized reminder" by the prescribing physician. Article 2 of the draft decree, introducing Article 3-bis to the decree of November 2, 2011, allows the prescribing physician, at the time of generating the electronic prescription, to issue, at the patient's request, the "dematerialized reminder" through the following channels:

on the Central Reception System (SAC) portal (www.sistemats.it, also via regional reception systems);

in the Electronic Health Record, as per Article 12 of decree-law 179/2012;

via email;

via short message service (SMS).

The implementation methods of the aforementioned channels will be determined by a decree of the Ministry of Economy and Finance, in agreement with the Ministry of Health, after consulting the Guarantor.

In light of the COVID-19 epidemiological emergency, the Ministry expressed the need to immediately identify alternative methods to the printing of the paper reminder of the dematerialized prescription (so-called "dematerialized reminder") valid until the end of the state of emergency declared by the Council of Ministers on January 31, 2020. In this context, in the version of the draft decree sent on March 17, 2020, it was provided, also following urgent interlocutions with the Guarantor's Office, that until the end of the COVID-19 epidemiological emergency, the specific provisions defined by the Civil Protection Ordinances concerning the dematerialized prescription as per the decree of November 2, 2011, remain in force.

OBSERVATIONS

The dematerialization of the medical prescription for prescriptions under the National Health Service was introduced by a decree of the Ministry of Economy and Finance on November 2, 2011. Under current regulations, the physician issues the patient a paper reminder of the dematerialized prescription with the Electronic Prescription Number (NRE) and the authentication code of the completed transaction. The aforementioned decree also provides that "At the patient's request, this reminder can be transmitted through the alternative channels specified in Annex 1" (Article 1, paragraph 4). The said annex specifies that the "additional channels" "for the use of the reminder by patients" will be made available "through the website of the Ministry of Economy and Finance (www.sistemats.it)" (Article 4.1. Other channels for the use of services, annex 1 to the decree of November 2, 2011).

Although the regulations date back to 2011, the aforementioned alternative methods to the printing of the paper reminder had not yet been identified.

In this regard, the Authority, since 2015, has pointed out to the Ministry of Health that the failure to identify the aforementioned alternative methods to the printing of the paper reminder has led to the spread of autonomous initiatives by physicians, very different across the national territory, which presented critical issues regarding the security of the processing of health data of patients of the National Health Service (note of October 2, 2015, cf. annual report for 2015, p. 72). In this context, the Guarantor's Office has always expressed its willingness to initiate a discussion with the administrations responsible for intervening in this matter, to ensure that the processing of personal data of the individuals concerned is carried out in compliance with their dignity and privacy and in a uniform manner throughout the national territory.

With the draft decree under examination, the channels through which to deliver the "dematerialized reminder" of the electronic prescription to the patient have been defined, deferring to a subsequent decree of the same Ministry, to be adopted in agreement with the Ministry of Health and after consulting the Guarantor, the methods of issuing the aforementioned "dematerialized reminder" through the aforementioned channels.

In this regard, the Ministry's choice to identify, in a regulatory act agreed upon with the Ministry of Health, the methods of transmitting the "dematerialized reminder" of the electronic prescription to the patient, which, with adequate measures to protect the personal data of the patients, are valid throughout the national territory and to which the regions and autonomous provinces will therefore have to adapt, is shared.

In this regard, the Office, during discussions with the Ministry, reiterated that there are no impediments related to the protection of personal data in identifying the aforementioned alternative methods to the delivery of the paper reminder of the electronic prescription, highlighting the possibility of providing digital channels, alternative to paper printing, respectful of the regulations on health data processing, as already provided for by law in other health areas (cf. decree of the President of the Council of Ministers of August 8, 2013, concerning the methods of delivery, by healthcare companies, of medical reports via the web, certified email, and other digital methods, as well as the online payment of provided services, on which the Authority provided its opinion on December 6, 2012, doc. web n. 2223206; cf. also the regulations on the Electronic Health Record, as per Article 12, decree-law n. 179/2012).

During the aforementioned discussions with the Ministry of Economy and Finance, the Guarantor's Office expressed some reservations regarding the limitation, provided in an earlier version of the draft decree under examination, of the alternative methods to the paper reminder to the sole consultation of the Electronic Health Record (FSE), given the incomplete implementation of the Record throughout the national territory and the current voluntary nature of its activation by the individual concerned. These observations were taken into account by the said Ministry, which, in the version of the draft decree under examination, has indeed provided the possibility of identifying additional channels, besides the FSE, for the delivery to the patient of the "dematerialized reminder" of the electronic prescription.

With specific reference to the COVID-19 epidemiological emergency, the Guarantor's Office, considering the government provisions regarding the need to avoid any form of gathering that could also occur in the waiting rooms of prescribing physicians, has expressed its willingness to identify, immediately and until the end of the emergency, alternative methods to the printing of the paper reminder of the prescription that are promptly and easily applicable.

In this sense, as part of a fruitful and immediate institutional collaboration with the Ministry of Economy and Finance, it was suggested to consider, as a method of delivery to the patient of the "dematerialized reminder" of the electronic prescription, in addition to the FSE, the technical solutions already identified in the regulations on the digital delivery of medical reports. In particular, regarding the identification of these alternative channels to the printing of the paper reminder, it was stated that, in the case of sending the "dematerialized reminder" of the electronic prescription to the email address indicated by the patient for this service, similar to what is provided for the delivery of medical reports, the reminder must be sent as an attachment to the message and not as text included in the body of the message, must be protected with encryption techniques, and must be accessible through a credential separately delivered to the individual.

Regarding the use of short message service (SMS) on the device indicated by the individual, it was stated that, through this method, only the electronic prescription number (NRE) should be sent, and not the other detailed information contained in the reminder.

Given this, the Authority expresses its consent in advance should the executive decide, during the emergency phase related to the COVID-19 epidemic, to provide, immediately and also through emergency provisions, alternative channels to the printing of the paper reminder of the electronic prescription as mentioned above.

Finally, it is noted that, during discussions with the Ministry of Economy and Finance, specific observations were made concerning access by AIFA, the Ministry of Health, and regions to personal data indicated in therapeutic plans (forms of pseudonymization of personal data to be established after consulting the Guarantor - Article 2 of the draft decree introducing Article 1-bis, paragraph 7 to the decree of November 2, 2011).

Given all of this, there are no further observations to make on the draft decree under examination, which takes into account the indications provided by the Office, from the perspective of personal data protection.

THEREFORE, THE GUARANTOR:

pursuant to Articles 36, paragraph 4, and 58, paragraph 3, letter b) of the Regulation, expresses a favorable opinion on the draft decree of the Ministry of Economy and Finance to be adopted in agreement with the Ministry of Health.

Rome, March 19, 2020

THE PRESIDENT
Antonello Soro