Data inspectorate: healthcare providers must justify why they hold patient data
Latvia's Data State Inspectorate says medical institutions must be able to justify the purpose, duration and protection of patient data processing. Photographing patients and sending data is allowed, but it must be done securely.
Medical institutions in Latvia must be able to explain why they process patient data, how long they keep it and how it is protected. This was stressed by the Data State Inspectorate (DVI), the authority supervising personal data protection. The requirement applies to any use of data, whether photographing, sending or other handling.
The DVI notes that personal data is unavoidably processed during a doctor's visit. This covers information about a patient's health, diagnosis, examinations and treatment. Without it, medical care often could not be provided. Patients have the right to see their information and medical records, while the data must be protected under personal data rules.
Photography in treatment
The inspectorate gives an example: a dermatologist wants to photograph a skin lesion in order to assess treatment results at the next visit. If an image reveals information about health, it may count as health data. If it is needed for treatment, taking it can be part of the treatment process, and separate patient consent is not required.
However, the device used and the storage location must be considered. A personal phone can create risks, for example automatic saving to a personal cloud account or access outside the institution's control. The image should therefore be kept in a system managed by the institution or another secure place, not on the doctor's personal device. The institution, as data controller, is responsible for security, and it, rather than each doctor individually, decides which devices may be used for photographing. If a photo is to be used for another purpose, such as teaching materials or a conference, a separate legal basis is needed.
Sending and deletion
The General Data Protection Regulation does not prohibit sending health data electronically and does not prescribe a specific communication channel, so email or WhatsApp are not automatically banned. The institution must assess whether contact details are correct, whether the recipient can be verified, how much information is being sent and whether a safer method exists. A visit reminder and detailed test results are not to be treated alike.
In certain cases a person may request deletion of their data, but this right is not absolute. Medical records must be kept for the periods set by law, so a patient's request does not mean the entire medical history must be erased. If a patient considers the information inaccurate, they may request that it be supplemented or corrected. Under the Patients' Rights Law, the erroneous information must be retained and clarified or supplemented.
