IP (Slovenia) - 07106-8-2023
From GDPRhub
| IP - 07106-8-2023 | |
|---|---|
 | |
| Authority: | IP (Slovenia) |
| Jurisdiction: | Slovenia |
| Relevant Law: | 42. člen ZPacP |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 24.10.2023 |
| Decided: | 24.01.2024 |
| Published: | 15.03.2024 |
| Fine: | n/a |
| Parties: | n/a |
| National Case Number/Name: | 07106-8-2023 |
| European Case Law Identifier: | n/a |
| Appeal: | Unknown |
| Original Language(s): | Slovenian |
| Original Source: | IP website (in SL) |
| Initial Contributor: | im |
The DPA found that national law grants the data subject access to medical records of her deceased father if the information might have a significant impact on her health.
English Summary
Facts
The data subject requested access to her father's medical records after his death on 24 October 2023. The healthcare provider denied this request based on a document purportedly signed by the deceased father, which prohibited the disclosure of his medical information to his daughter and argued that he therefore respected the deceased persons’ clearly expressed wishes.
However, according to the data subject the document did not explicitly prohibit access to medical records after the father's death. The data subject also argued it could be assumed that her father lacked the capacity to understand the implications of the document due to his dementia. On this account, she provided evidence of her father’s medical condition and claimed that it was produced during a period when he was not of sound mind.
The data subject filed a complaint with the DPA against a healthcare provider regarding the denial of access to the medical records of her deceased father.
Holding
The DPA found that the evidence presented by the healthcare provider, the document signed by the deceased person, did not clearly and unambiguously prohibit the daughter’s access to her father’s medical records after his death.
The DPA referred to the right to be informed of the patient's medical records after the patient's death which is regulated in Article 42 of the Slovenian Act on Patient Rights (‘ZPacP’). After the patient's death, the right to be informed of the patient's medical records includes, among others, the patient's spouse, common-law partner, same-sex partner, children and adopted children, and, in the absence of these persons, the patient's parents. These persons shall only be granted access to the information necessary to achieve the legitimate purpose of the consultation.
The DPA further clarified that pursuant to Article 42(4) ZPacP, the data subject is indeed entitled to be informed of her deceased father's medical records in so far as they related to reasons which might have a significant impact on her health.
As the DPA is obliged to adhere to the principle of procedural economy as stipulated in Article 14 of the Slovenian Administrative Procedure Act, the DPA assessed that the health care provider at the first instance will be better suitable to issue the lawful and correct decision. As a result, the DPA concluded that the healthcare provider will have to assess whether a valid prohibition of access to medical documentation after the patient's death exists considering the findings of the DPA.
Comment
This ruling relates to the wording of Recital 27 GDPR which states that “This Regulation [GDPR] does not apply to the personal data of deceased persons. Member States may provide for rules regarding the processing of personal data of deceased persons.”
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Slovenian original. Please refer to the Slovenian original for more details.
Information Commissioner according to Information Commissioner Mojca Prelesnik (hereinafter IP) on the basis of the fifth paragraph of Article 42 in relation to the tenth paragraph of Article 41 of the Act on Patient Rights (Official Gazette of the Republic of Slovenia, No. 15/08, 55/17, 177/20 and 100/22 – ZNUZSZS; hereafter ZPacP) and on the basis of the third paragraph of Article 251 of the General Administrative Procedure Act (Official Gazette of the Republic of Slovenia, No. 24/06 – official consolidated text, 105/06 – ZUS-1, 126/07, 65/08, 8/10, 82/13, 175/20 – ZIUOPDVE and 3/22 – ZDeb; hereinafter ZUP), on the applicant's appeal: .... of 12 November 2023, against the decision of the healthcare provider: ...., no. …. of 3 November 2023, in the matter of familiarization with medical documentation after the patient's death, issues the following O D L O C B O 1. Complaints of the applicant... of 12/11/2023 against the decision of the health care provider.... no. …. dated November 3, 2023, is accepted, the challenged decision is canceled and the case is returned to the healthcare provider as a first-level authority for a new procedure. The healthcare provider must make a decision on the applicant's request for familiarization with the medical documentation after the patient's death on October 24, 2023 at the latest within 30 days of receiving this decision. 2. No special costs were incurred in this procedure. The applicant covers her own costs of the procedure. Place the page in: On October 24, 2023, the applicant submitted a request to the provider of health care to get acquainted with the medical documentation of her deceased father.... . With decision no. …. of 3 November 2023 rejected this request. He based his decision on the existence of a certified power of attorney of the deceased..., with which he prohibits giving his personal data, sending him to various specialist examinations, ordering, etc. daughters - applicants in this procedure. He explained that this authorization was given to the personal physician of the deceased, and he himself received it from the lawyer of the deceased. The applicant filed an appeal against this decision on 12 November 2023. In essence, she stated that the healthcare provider did not attach a copy of the written authorization to the decision, which he referred to and which allegedly contained a prohibition on the transmission of personal data. She pointed out that the power of attorney was given to his doctor, not to the provider of medical activities in this procedure, and that it does not contain any indication that after his death, the father forbids her to see the psychiatric medical record that he keeps. She added that the same authorization was given from 27/07/2022 to 13/08/2022 to the patient.... . She further emphasized that already in 2016, her father was receiving strong medication for the treatment of dementia, that he did not have a guardian appointed, and that the lifetime maintenance contract is void, which will be resolved in the probate process. At the same time, the applicant also pointed out that Parkinson's dementia, vascular dementia, cortical and subcortical dementia are hereditary. If the father had a chromosomal mutation for Parkinson's dementia and as his heir has inherited it, this is important for her health. Therefore, he wants to get acquainted with all the results, records, findings regarding the treatment of his father, what health problems he had, etc. On 11/13/2023, the IP called on the provider of medical activities, based on 34.a, 139. and the second paragraph of Article 245 of the ZUP, to forward a copy of the express prohibition regarding familiarization with the medical documentation provided by the deceased, a definition of the complaint statements and to provide other relevant explanations and evidence. The health care provider is in answer no. …. dated 20 November 2023 explained again that the reason for rejecting the applicant's request for access to the medical records of the deceased father was a copy of the power of attorney provided to the hospital by the lawyer, which clearly states that the deceased applicant is prohibited from providing her personal information. He pointed out that this authorization was given to his personal physician and was authenticated. He explained that until receiving the letter from the deceased's lawyer, he did not have the information about the prohibition to pass on the deceased's data to the applicant, as the deceased was treated by a psychiatrist who also performs home visits as part of community psychiatric treatment. The visit was carried out on 6 October 2021, both daughters were informed about the visit, but the deceased did not in any way announce that he forbids the sharing of information. The health care provider concluded that he has a document that unequivocally prohibits the transmission of data.... the applicant, therefore he respected his clearly expressed wish even after his death, since even while he was alive, he clearly expressed his interest in enjoying certain protection of fundamental rights as a person even after his death. Furthermore, the healthcare provider pointed out that the applicant did not provide any information regarding possible harmful diseases of the applicant's late father in the request for information, so he could not assess or consider them. Based on this, he decided as follows from decision no. …. dated 3 November 2023, in which he took into account the purpose of the law governing the protection of personal data and the will of the deceased, which he expressed clearly and unambiguously. He also attached all relevant documentation to the answer. The applicant responded to the IP's request for clarification dated 12/12/2023 on 17/12/2023. As the response is quite extensive, the IP summarizes only the essential statements that are relevant to the decision in this appeal procedure. These are: - the power of attorney was written by her own hand for her purposes. …. (the applicant's sister) and gave it to her sick, demented father to sign because she was afraid of the life support contract they concluded during the father's illness; - after the death of his father, he is from …. has received a copy of the "mandate" with all other medical documents; - only the father's signature is certified on the power of attorney; - the power of attorney does not say that the father "expressly" forbids access to medical documentation; - the authorization is addressed to dr. honey …. and nurse ..., who are employed in the health center .... ; - the legal purpose of familiarization with the medical record and all specialist findings is demonstrated by the attached invitation to the probate hearing on 11/19/2023; - the ban can also be recorded in the central record of medical documentation, which was not implemented in this case, but the provider of medical activity had to physically inspect the medical record; - the applicant IP asks to immediately allow her to photocopy and familiarize herself with all the contents of the medical record for the purpose of the inheritance procedure, otherwise she will not be able to deliver the documents to the court in time. In the telephone interview with the IP on 19/01/2024 and in the applications from that day and from 20/01/2024, the applicant described in more detail the circumstances of signing the disputed document (power of attorney), especially that the father signed it during dementia, when he was sick and unsound, and therefore cannot constitute a valid prohibition of acquaintance. She pointed out that, despite the existence of this document, she received the medical documentation of her deceased father from other managers (e.g.... and...). As proof that the father was really ill, she attached a psychiatric report and a professional opinion.... dated 16 January 2023, which summarized the content of the available medical documents. She pointed out that the father had been on medication since 2016 and had been diagnosed with dementia, which made him unable to understand his will statements and the legal consequences. She also attached the minutes on the inheritance case and the decision on the suspension of the inheritance proceedings dated 12/19/2023, as well as the decision of the Ministry.... from 2 June 2022. The appeal is justified. Procedural explanations At the outset, the IP explains that, as a second-level authority, in accordance with Article 247 of the ZUP, which, based on the tenth paragraph of Article 41 in connection with the fifth paragraph of Article 42 of the ZPacP, is applicable mutatis mutandis in this appeal procedure, it is obliged to examine the decision in part, in which the applicant disputes. He examines the decision within the limits of the appeal's statements, and ex officio examines whether there were no significant violations of the procedure in the first instance procedure and whether the substantive law was not violated. The IP was convinced of the actual situation on the basis of the available material, taking into account Article 10 of the ZUP. On the basis of Article 139 of the ZUP, he assessed that additional procedural actions to determine the actual situation are not necessary. General information on the right to access medical documentation after the patient's death The right to access medical documentation after the patient's death is regulated in Article 42 of the ZPacP. After the patient's death, the patient's spouse, common-law partner, partner from the same-sex community, children and adopted children, and when these persons are not available, the patient's parents have the right to get acquainted with the patient's medical documentation. These persons are only given access to the data that is necessary to achieve the legitimate purpose of the information. However, if these persons want to get acquainted with the medical documentation that was created at a time when the deceased patient was not capable of making decisions about himself and this situation continued without interruption until his death, they must demonstrate a legal interest in getting acquainted (paragraph two). The request for familiarization of persons is partially or fully rejected if the law stipulates so or if the patient has expressly forbidden the familiarization in writing or orally in the presence of two witnesses before death (third paragraph). Regarding the prohibition, the law also provided for an exception: despite the patient's prohibition, the patient's parents, descendants, spouse, common-law partner, partner from the same-sex community, brothers and sisters or other persons close to the patient may, through the doctor, become familiar with those personal data that are or could be important for their health (fourth paragraph). The healthcare provider decides on the request for information within 15 days of receiving the reasoned request. If the request is partially or fully rejected, the entitled persons have the right to file a complaint with the IP (fifth paragraph). The applicant can therefore become familiar with the medical documentation of the deceased patient under the following conditions: - the request for familiarization is explained in such a way that it is clear what the purpose of the familiarization is, - the claimed purpose of familiarization is not illegal, - the kinship relationship with the deceased patient is demonstrated in an appropriate manner and - the deceased patient did not prohibit access to his medical documentation during his lifetime. At the same time, it must be taken into account that the right to access the medical documentation after the patient's death is the right of persons from Article 42 of the ZPacP, which is opposed by the patient's right to prohibit such access, and both rights can be granted under the conditions set by law and in a certain measures limited. On the ability to judge A free and serious declaration of will cannot conceptually be given by a person who is not able to understand the meaning of the will he declares. The ability to judge is not specifically regulated in our legislation. It is the actual ability to understand the meaning of one's actions, or the ability to understand the meaning of a declaration of will and the legal consequences it causes. A necessary condition for the ability to judge is the actual psychophysical properties of the subject. For example, the ability to judge is a prerequisite for the validity of the declaration of business will. As a general rule, the capacity to judge is assumed in persons who have business capacity. However, this assumption is not irrefutable. There may be a discrepancy between business capacity and the ability to judge, especially when a full business person loses the actual capacity to judge (for example, due to dementia), and business capacity has not yet been formally taken away. ZPacP defines the capacity to make decisions about oneself in point 19 of Article 2, which is the ability of the patient to independently exercise the rights from this law. The patient is capable of making decisions about himself if, based on his age, maturity, state of health or other personal circumstances, he is able to understand the meaning and consequences of exercising the rights from this law, especially the consent, refusal or revocation of the refusal of medical intervention or medical treatment. The patient's right to prohibit access to his medical documentation during his lifetime to a person who, based on Article 42 of the ZPacP, is otherwise entitled to familiarize himself with this documentation after the patient's death, could also be understood as exercising the right from this law. The ZPacP does not specify more precisely what the prohibition of familiarization from the third paragraph of the ZPacP must be (except that it must be given explicitly and in writing or orally in the presence of two witnesses). Both from the general requirement for the ability to make judgments and from the definition of the ability to make decisions about oneself, it undoubtedly follows that at the time of giving such a prohibition, the patient must be able to understand the meaning of this statement and the consequences it causes, and it is not only the legal capacity that is relevant, but the actual the ability to form a valid will, taking into account age, maturity, state of health and other personal circumstances. Assessment of the merits of the appeal The healthcare provider justified the rejection of the applicant's request for access to her deceased father's medical documentation by the existence of a prohibition under the third paragraph of Article 42 of the ZPacP. This stipulates that the request for the familiarization of the persons from the previous paragraph shall be partially or completely rejected, if the law stipulates so or if the patient expressly prohibited the familiarization in writing or orally in the presence of two witnesses before death. Since the other conditions for familiarization were not disputed, the IP did not elaborate on them in this decision. In a specific case, it is essential whether the ban on familiarization according to the third paragraph of Article 42 of the ZPacP, which is referred to by the healthcare provider, meets all the conditions for validity. It is a document entitled "Authorization" and dated 3 June 2022. The addressees are identified as .... (according to the explanations of the deceased's medical provider, this was a personal physician) and a nurse.... . The document states that …. "I forbid giving my health information, sending it to various specialist examinations, ordering it for my daughter..." and that the information "can only be obtained by my daughter.... (...), because we have a contract of employment. on life support." On the other side of the document, there is a confirmation from the Administrative Unit... that... signed this document with his own hand. Based on the content of the document, the IP does not agree with the assessment given by the medical provider in the contested decision, that the deceased father clearly and unequivocally forbade the applicant to get acquainted with all the medical documentation relating to him. The will of the patient expressed during his lifetime must be interpreted taking into account all the circumstances that may be relevant in assessing the validity and scope of the ban on familiarization with his medical documentation relating to the period after death. The IP believes that the provider of health care in this specific case did not assess these circumstances, which are highlighted below, to a sufficient extent. First of all, the applicant's complaint that the late father did not "expressly" prohibit access to his medical documentation is important. For the prohibition to be valid according to the third paragraph of Article 42 of the ZPacP, it is not necessary that this term be directly stated in the document (or that the patient use it literally in the case of a verbal prohibition). According to the SSKJ, this word means that something is expressed clearly and definitely. The express prohibition must therefore be expressed unequivocally, whereby it must be clear that it is a prohibition of familiarization that takes effect after death, as well as to which medical documentation or to which provider of medical activity it refers and against whom it is effective. Therefore, in order to assess to whom a specific ban on familiarization applies, or how widely it has an effect, it is important who is the addressee of the ban. Given that the document containing the prohibition of "disclosing health information" is named "power of attorney" and is specifically addressed to the deceased's personal physician and nurse, it cannot automatically be considered that the prohibition applies to all health care providers who have with the deceased's documentation. The term power of attorney is usually understood to mean the right to represent, which is given by the authorizer through a legal transaction to the agent (first paragraph of Article 74 of the Code of Obligations; Official Gazette of the Republic of Slovenia, No. 97/07 – official consolidated text, 64/16 – Sec. US and 20/18 – OROZ631). From the title of the document, it could therefore be concluded that the deceased limited the prohibition of familiarization only to the medical documentation with which his personal doctor is at his disposal. The applicant's claims that the prohibition is not recorded in the central register of patient data (which is otherwise only a possibility, but not a condition for the validity of the prohibition), that the document was forwarded to the healthcare provider by a lawyer who also represents the applicant's sister (otherwise I wouldn't have known about him at all), that the document was written by the applicant's sister, who is in dispute with the applicant, and that, despite the existence of this document, the applicant obtained the medical documentation of her deceased father from other healthcare providers. The prerequisite for issuing a valid ban is, as already explained, the ability to judge. The medical condition of the deceased, which should have been known to the health care provider at least for the period of his treatment, shows doubt about the reality of the assumption of this type of ability when the disputed prohibition was issued (i.e. 3 June 2022). This essential question was not clarified in the proceedings at first instance. With her assertions in the request and even more explicitly in this appeal procedure, among other things with an expert opinion..., the applicant sufficiently demonstrated a well-founded suspicion that the late father was unable to understand the meaning of the content of the "power of attorney" at the time of the injunction due to dementia. who signed it and its consequences. The listed questions, which are important in assessing the validity of the rejection of the applicant's request, were not discussed in the first-level procedure, as a result of which the remaining factual situation was incompletely established. Based on the dementia of the deceased patient, the healthcare provider should determine his ability to issue a valid prohibition and, in the event of its existence, in addition to the narrow legal provisions, more critically assess the content of the document, which is said to contain the prohibition according to the third paragraph of Article 42 of the ZPacP. According to the applicant's statements, the IP also explains the following. On the basis of the fourth paragraph of Article 42 of the ZPacP, she could indeed be entitled to get acquainted with the health documentation of her deceased father in the part that relates to reasons that may significantly affect her health, but this was not mentioned in her request of 24 October 2023 claimed, but requested this documentation for the purposes of probate proceedings. The IP points out that the applicant can submit a new request and justify this exception more concretely in order to obtain the required documentation. In relation to the alleged errors in the appointment of the guardian and violations of Article 275 of the Family Code, the IP adds that its powers are defined in Article 2 of the ZInfP and only cover the areas of personal data protection and access to public information. Therefore, it cannot decide whether there has been a violation of the legislation for which it is not competent to supervise, and whether liability for damages may be given. The subject of this appeal procedure is limited to the assessment of whether the health care provider justifiably refused the applicant's request for access to her deceased father's medical records pursuant to Article 42 of the ZPacP. The IP also points out that it does not have the role of the proposer of the law in relation to the complaint statements regarding the need to amend the legislation, but must, in accordance with the principle of legality from Article 6 of the ZUP, make decisions according to the law, by-laws, regulations of local communities and general acts issued for the exercise of public powers. Regarding the claims that the applicant must bring the deceased father's medical documentation as evidence to the probate hearing, the IP merely remarks that the court can generally only obtain the information necessary for the decision and the documents, if the client cannot get them handed over to her. Return to re-procedure and instructions to the healthcare provider The first paragraph of Article 251 of the ZUP stipulates that when the authority of the second instance determines that the facts were incompletely or erroneously established in the procedure at the first instance, that there were significant violations of the procedural rules in the procedure, or that the wording of the challenged decision is unclear, or in contrary to the reasoning, complete the procedure and eliminate the mentioned deficiencies either by himself or through the authority of the first instance or through the requested authority. The third paragraph of the same article also stipulates that if the second-instance authority realizes that the shortcomings of the first-instance procedure will be eliminated faster and more economically by the first-instance authority, it cancels the first-instance decision with its own decision and returns the matter to the first-instance authority for a new procedure. In such a case, the authority of the second instance is obliged with its decision to warn the authority of the first instance regarding what the procedure needs to be supplemented, and the authority of the first instance must always act in accordance with this decision and issue a new decision without delay, but no later than within 30 days of receiving the case. The customer has the right to appeal against the new decision. The IP is obliged to respect the fundamental principles of the administrative procedure, therefore it must also take into account the principle of economy of the procedure from Article 14 of the ZUP and conduct the procedure quickly, which means with as little delay as possible for the clients and other participants in the procedure, but in such a way that everything that is necessary to determine the actual situation, protect the client's rights and legal interests, and issue a legal and correct decision. This will be most easily achieved by the healthcare provider at the first level, because the request for familiarization refers to the documentation that he has at his disposal and knows best. The set deadline for re-decision is in accordance with ZUP. It follows from the above findings that, in a repeated procedure based on the third paragraph of Article 42 of the ZPacP, the health care provider will have to assess whether there is a valid ban on familiarization with the medical documentation after the patient's death, explain this and make a new decision on the applicant's request. In doing so, he will have to primarily determine the patient's ability to judge at the time of the injunction and, on the condition that this assumption will not be challenged, also assess other relevant circumstances that the IP described in the previous section. Conclusive On the basis of the third paragraph of Article 251 of the ZUP, the IP upheld the appeal, eliminated the contested response of the healthcare provider and sent the matter back to him for retrial, because it was established that the facts were incompletely established in the first instance procedure, and the shortcomings will be more easily eliminated by the provider . He must make a decision on the applicant's request for information under Article 42 of the ZPacP no later than 30 days after receiving this decision (point 1 of the sentence of this decision). This decision is in accordance with the provisions of the Act on Administrative Fees (Official Gazette of the RS, No. 106/10 - official consolidated text, 14/15 - ZUUJFO, 84/15 - ZZelP-J, 32/16, 30/18 - ZKZaš and 189/20 – ZFRO) exempted from paying the administrative fee. No special costs were incurred in this appeal procedure (point 2 of the sentence of this decision). Lessons on the legal remedy: Neither an appeal nor an administrative dispute is allowed against this decision. Manager's procedure: ………………………….. Mojca Prelesnik, Univ. B.Sc. right., Information Commissioner
