How is patient data processed legally?

The Dual Legal Situation

For health data, two regulations apply concurrently:

GDPR. Article 9 generally prohibits the processing of special categories and only allows it in exceptional cases – for treatment, for example, according to Article 9 (2) (h).

§ 203 of the Criminal Code. Breaching confidentiality is a criminal offense. Since 2017, professionals bound by confidentiality may involve service providers but must explicitly require them to maintain confidentiality. A data protection agreement alone is not sufficient for this.

What is Technically Required

• Encryption during transmission and storage
• Roles and Rights – the medical assistant at the reception does not need the same access as the treating physician
• Logging of every access to patient data, audit-proof
• Deletion Concept considering retention periods
• Backups that are as protected as the main system

What is Most Often Missing in Practice

Access Logging. Without it, it cannot be clarified in case of suspicion who opened a file – and that is exactly when it is needed.

The Obligation of Service Providers under § 203 of the Criminal Code. Many practices have a data processing agreement but lack a separate confidentiality obligation.

Retention

For patient records, according to § 630f of the Civil Code, a retention period of ten years generally applies after the treatment is completed. Other regulations may provide for longer periods. This is an obligation to retain – not a right to further use.

This text does not replace legal advice.