Weichert Thilo
Netzwerk Datenschutzexpertise, Waisenhofstr. 41, 24103, Kiel, Deutschland.
Bundesgesundheitsblatt Gesundheitsforschung Gesundheitsschutz. 2018 Mar;61(3):285-290. doi: 10.1007/s00103-017-2686-7.
Digitization in the health sector embodies opportunities and risks. These consist of patient and data confidentiality. Vulnerability of data concerning integrity and availability can lead to financial losses and to damage of the health of data subjects. Those risks must be tackled by privacy or data protection law. For this purpose we have the European Data Protection Regulation as a comprehensive legal framework and a harmonizing bracket.This framework contains regulations on consent, purpose binding and data transfer, on rights of the data subject, technical and organizational measures and procedural arrangements. Recently, codes of conduct and certification schemes have been added as instruments. The frame of privacy law is completed by the law on medical products and information security regulations.Unfortunately, German legislation did not grip the opportunity of the European regulation to modernize, tighten and harmonize national privacy law in the health sector. This led to a lack of clarity, particularly because of the parallel applicability of privacy law and professional law. Central issues - for instance concerning transparency for data subjects, official supervision, analytics and processing for research purposes - remain dysfunctional. The German legislation should adjust those deficits. Corporations and the chambers for health professionals could and should also be active for this concern.
卫生部门的数字化既带来机遇，也存在风险。这些风险包括患者和数据的保密性。数据在完整性和可用性方面的脆弱性可能导致经济损失以及对数据主体健康的损害。这些风险必须通过隐私或数据保护法来应对。为此，我们有《欧洲数据保护条例》作为一个全面的法律框架和协调框架。该框架包含有关同意、目的约束和数据传输、数据主体权利、技术和组织措施以及程序安排的规定。最近，行为准则和认证计划已作为工具被补充进来。隐私法框架由医疗产品法和信息安全法规完善。不幸的是，德国立法没有抓住欧洲法规带来的机遇，以实现卫生部门国家隐私法的现代化、严格化和协调统一。这导致了不明确性，尤其是由于隐私法和专业法的并行适用。一些核心问题——例如数据主体的透明度、官方监督、研究目的的分析和处理——仍然存在功能失调的情况。德国立法应弥补这些不足。企业和卫生专业人员协会在这方面也能够并且应该发挥积极作用。
