Assessing Health Data Processing
Overview
Health data is classified as a special category under GDPR Art. 9(1), requiring both a lawful basis under Art. 6(1) and an Art. 9(2) exemption for processing. Processing of health data on a large scale triggers a mandatory DPIA under Art. 35(3)(b). This skill provides a DPIA methodology for health data processing scenarios: electronic health records, clinical trials, health research, telemedicine, health applications, medical devices, and genetic data analysis.
Legal Framework
Art. 9(1) — Definition of Health Data
GDPR Art. 4(15) defines data concerning health as "personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status."
This includes:
- Medical records and diagnoses
- Prescription and medication data
- Laboratory results and imaging
- Mental health assessments
- Disability information
- Genetic data (Art. 4(13))
- Biometric data processed for health purposes
- Health insurance claims
- Fitness and wellness data that reveals health status
- Data inferred from non-health data that reveals health conditions
Art. 9(2) Exemptions for Health Data
| Exemption |
Reference |
Application |
| Explicit consent |
Art. 9(2)(a) |
Patient consent for specific health processing. Must be separate from treatment consent. |
| Employment obligations |
Art. 9(2)(b) |
Occupational health assessments required by employment law. |
| Vital interests |
Art. 9(2)(c) |
Emergency medical treatment where patient cannot consent. |
| Healthcare provision |
Art. 9(2)(h) |
Processing necessary for preventive or occupational medicine, medical diagnosis, provision of health or social care, or management of health systems. Must be processed by or under the responsibility of a professional subject to medical secrecy. |
| Public health |
Art. 9(2)(i) |
Processing necessary for public health purposes including protecting against serious cross-border threats, ensuring high standards of quality and safety of health care, medicinal products, or medical devices. |
| Scientific research |
Art. 9(2)(j) |
Processing necessary for scientific research purposes (including clinical trials) subject to Art. 89(1) safeguards: data minimisation, pseudonymisation where possible. |
EU Clinical Trials Regulation 536/2014
- Art. 28: Protection of subjects and informed consent.
- Art. 28(2): Informed consent must be separate from consent for data processing under GDPR.
- Art. 56: Transparency through the EU Clinical Trials Information System.
- Art. 61: Facility requirements including controlled access to clinical trial materials.
Health Data DPIA Methodology
Phase 1: Health Data Classification (Week 1)
- Inventory all health data elements processed.
- Classify each element:
- Direct health data (diagnoses, test results, prescriptions)
- Indirect health data (insurance claims, appointment records)
- Inferred health data (wellness app data, genetic risk scores)
- Genetic data (DNA sequences, genotype data, pharmacogenomic data)
- Identify the Art. 9(2) exemption for each processing activity.
- Verify that processing is under the responsibility of a health professional subject to professional secrecy (Art. 9(2)(h) and Art. 9(3)).
Phase 2: Lawful Basis and Exemption Analysis (Week 2)
For each health data processing activity, document:
| Requirement |
Documentation |
| Art. 6(1) lawful basis |
Which Art. 6(1)(a)-(f) basis applies |
| Art. 9(2) exemption |
Which Art. 9(2)(a)-(j) exemption applies |
| Member State derogation |
Whether national law provides additional conditions (Art. 9(4)) |
| Professional secrecy |
Whether processing is under a professional subject to secrecy obligation (Art. 9(3)) |
| Data subject consent |
If relying on Art. 9(2)(a), evidence of explicit consent separate from treatment consent |
Phase 3: Clinical Trial Specific Assessment (if applicable)
| Assessment Area |
Requirements |
| Informed consent |
CTR Art. 28 consent separate from GDPR consent; plain language; withdrawal right without impact on treatment |
| Pseudonymisation |
Clinical trial data should be pseudonymised with key held by principal investigator; sponsor should not hold re-identification key |
| Data minimisation |
Collect only data specified in the clinical trial protocol; no speculative data collection |
| International transfers |
Multi-centre trials involve transfers; each transfer requires Chapter V mechanism |
| Retention |
CTR Art. 58: sponsor retains trial master file for 25 years; reconcile with GDPR storage limitation |
| Secondary use |
Re-use of clinical trial data for future research requires additional ethical approval and GDPR lawful basis |
Phase 4: HIPAA Crosswalk (for transatlantic operations)
| HIPAA Provision |
GDPR Equivalent |
Gap Assessment |
| HIPAA Privacy Rule (45 CFR 164.500-534) |
GDPR Art. 5 principles + Art. 9 special categories |
GDPR is more restrictive: broader definition of health data; explicit consent standard higher; no Treatment-Payment-Operations (TPO) exception |
| HIPAA Security Rule (45 CFR 164.302-318) |
GDPR Art. 32 security of processing |
Largely aligned: both require risk assessment, encryption, access controls, audit logging |
| HIPAA Breach Notification (45 CFR 164.400-414) |
GDPR Art. 33-34 |
GDPR stricter: 72-hour notification to SA; HIPAA allows 60 days |
| HIPAA Minimum Necessary |
GDPR Art. 5(1)(c) data minimisation |
Aligned in principle; GDPR applies more broadly |
| HIPAA Business Associate Agreement |
GDPR Art. 28 DPA |
Both require written agreements with processors; GDPR DPA is more prescriptive |
| HIPAA Patient Rights |
GDPR Art. 15-22 |
GDPR provides broader rights (portability, erasure, restriction, objection) |
| HIPAA De-identification (Safe Harbor / Expert) |
GDPR Recital 26 anonymisation |
Different standards: HIPAA Safe Harbor has 18 specific identifiers; GDPR requires irreversibility assessment |
Phase 5: Risk Assessment (Week 3-4)
| Risk |
Description |
Typical Level |
| HD-R1 |
Health data breach exposing sensitive diagnoses, conditions, or genetic information |
Very High |
| HD-R2 |
Re-identification of pseudonymised health data through linkage with other datasets |
High |
| HD-R3 |
Discriminatory use of genetic data (insurance denial, employment discrimination) |
High |
| HD-R4 |
Unauthorised access by healthcare staff beyond clinical need-to-know |
High |
| HD-R5 |
Secondary use of clinical trial data without participant awareness |
Medium |
| HD-R6 |
Cross-border transfer of health data to jurisdictions with weaker protections |
High |
| HD-R7 |
Patient re-identification through aggregation of fitness/wellness app data |
Medium |
Phase 6: Genetic Data Specifics
Genetic data has unique privacy characteristics:
- Perpetual sensitivity: Genetic information does not change over a lifetime and reveals information about biological relatives.
- Familial implications: An individual's genetic data reveals information about parents, siblings, and children who have not consented to processing.
- Predictive power: Genetic data can predict future health conditions, creating insurance and employment discrimination risks.
- Irreversibility: Once genetic data is disclosed, it cannot be "unlearned" or reset.
Additional requirements for genetic data:
- Art. 9(4) permits Member States to impose further conditions on genetic data processing.
- Germany: Gendiagnostikgesetz (GenDG) imposes strict limitations on genetic testing in employment and insurance contexts.
- France: Code de la sante publique Art. L1131-1 restricts genetic testing to medical and scientific purposes.
Enforcement Precedents
- Finnish DPA vs Pihlajalinna (2021): EUR 608,000 fine for health services company where employees accessed patient records without clinical justification — inadequate access controls and logging.
- Portuguese DPA vs Hospital do Barreiro (2018): EUR 400,000 fine for hospital where non-clinical staff had access to patient records through failure to implement role-based access controls.
- Dutch DPA vs OLVG Hospital (2021): EUR 440,000 fine for inadequate access controls on electronic patient records — insufficient two-factor authentication and logging of access.
- Swedish DPA vs Capio St. Goran (2020): SEK 30 million fine for hospital failing to conduct DPIA for patient records system and failing to implement adequate access controls.
- ICO vs Pharmacy2U (2015): GBP 130,000 fine for selling patient data to marketing companies without consent.
1---2name: health-data-dpia3description: Guides DPIA for health and medical data processing covering Art. 9(2)(h)-(j) exemptions, HIPAA crosswalk for transatlantic operations, clinical trial data protection under EU CTR 536/2014, and genetic data specifics under Art. 9(1). Activate for healthcare systems, clinical research, health apps, or medical device data. Keywords: health data, DPIA, Art. 9, clinical trial, genetic data, HIPAA, medical records, special category.4license: Apache-2.05---67# Assessing Health Data Processing89## Overview1011Health data is classified as a special category under GDPR Art. 9(1), requiring both a lawful basis under Art. 6(1) and an Art. 9(2) exemption for processing. Processing of health data on a large scale triggers a mandatory DPIA under Art. 35(3)(b). This skill provides a DPIA methodology for health data processing scenarios: electronic health records, clinical trials, health research, telemedicine, health applications, medical devices, and genetic data analysis.1213## Legal Framework1415### Art. 9(1) — Definition of Health Data1617GDPR Art. 4(15) defines data concerning health as "personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status."1819This includes:20- Medical records and diagnoses21- Prescription and medication data22- Laboratory results and imaging23- Mental health assessments24- Disability information25- Genetic data (Art. 4(13))26- Biometric data processed for health purposes27- Health insurance claims28- Fitness and wellness data that reveals health status29- Data inferred from non-health data that reveals health conditions3031### Art. 9(2) Exemptions for Health Data3233| Exemption | Reference | Application |34|-----------|-----------|-------------|35| Explicit consent | Art. 9(2)(a) | Patient consent for specific health processing. Must be separate from treatment consent. |36| Employment obligations | Art. 9(2)(b) | Occupational health assessments required by employment law. |37| Vital interests | Art. 9(2)(c) | Emergency medical treatment where patient cannot consent. |38| Healthcare provision | Art. 9(2)(h) | Processing necessary for preventive or occupational medicine, medical diagnosis, provision of health or social care, or management of health systems. Must be processed by or under the responsibility of a professional subject to medical secrecy. |39| Public health | Art. 9(2)(i) | Processing necessary for public health purposes including protecting against serious cross-border threats, ensuring high standards of quality and safety of health care, medicinal products, or medical devices. |40| Scientific research | Art. 9(2)(j) | Processing necessary for scientific research purposes (including clinical trials) subject to Art. 89(1) safeguards: data minimisation, pseudonymisation where possible. |4142### EU Clinical Trials Regulation 536/20144344- Art. 28: Protection of subjects and informed consent.45- Art. 28(2): Informed consent must be separate from consent for data processing under GDPR.46- Art. 56: Transparency through the EU Clinical Trials Information System.47- Art. 61: Facility requirements including controlled access to clinical trial materials.4849## Health Data DPIA Methodology5051### Phase 1: Health Data Classification (Week 1)52531. Inventory all health data elements processed.542. Classify each element:55 - Direct health data (diagnoses, test results, prescriptions)56 - Indirect health data (insurance claims, appointment records)57 - Inferred health data (wellness app data, genetic risk scores)58 - Genetic data (DNA sequences, genotype data, pharmacogenomic data)593. Identify the Art. 9(2) exemption for each processing activity.604. Verify that processing is under the responsibility of a health professional subject to professional secrecy (Art. 9(2)(h) and Art. 9(3)).6162### Phase 2: Lawful Basis and Exemption Analysis (Week 2)6364For each health data processing activity, document:6566| Requirement | Documentation |67|-------------|---------------|68| Art. 6(1) lawful basis | Which Art. 6(1)(a)-(f) basis applies |69| Art. 9(2) exemption | Which Art. 9(2)(a)-(j) exemption applies |70| Member State derogation | Whether national law provides additional conditions (Art. 9(4)) |71| Professional secrecy | Whether processing is under a professional subject to secrecy obligation (Art. 9(3)) |72| Data subject consent | If relying on Art. 9(2)(a), evidence of explicit consent separate from treatment consent |7374### Phase 3: Clinical Trial Specific Assessment (if applicable)7576| Assessment Area | Requirements |77|-----------------|-------------|78| Informed consent | CTR Art. 28 consent separate from GDPR consent; plain language; withdrawal right without impact on treatment |79| Pseudonymisation | Clinical trial data should be pseudonymised with key held by principal investigator; sponsor should not hold re-identification key |80| Data minimisation | Collect only data specified in the clinical trial protocol; no speculative data collection |81| International transfers | Multi-centre trials involve transfers; each transfer requires Chapter V mechanism |82| Retention | CTR Art. 58: sponsor retains trial master file for 25 years; reconcile with GDPR storage limitation |83| Secondary use | Re-use of clinical trial data for future research requires additional ethical approval and GDPR lawful basis |8485### Phase 4: HIPAA Crosswalk (for transatlantic operations)8687| HIPAA Provision | GDPR Equivalent | Gap Assessment |88|-----------------|-----------------|---------------|89| HIPAA Privacy Rule (45 CFR 164.500-534) | GDPR Art. 5 principles + Art. 9 special categories | GDPR is more restrictive: broader definition of health data; explicit consent standard higher; no Treatment-Payment-Operations (TPO) exception |90| HIPAA Security Rule (45 CFR 164.302-318) | GDPR Art. 32 security of processing | Largely aligned: both require risk assessment, encryption, access controls, audit logging |91| HIPAA Breach Notification (45 CFR 164.400-414) | GDPR Art. 33-34 | GDPR stricter: 72-hour notification to SA; HIPAA allows 60 days |92| HIPAA Minimum Necessary | GDPR Art. 5(1)(c) data minimisation | Aligned in principle; GDPR applies more broadly |93| HIPAA Business Associate Agreement | GDPR Art. 28 DPA | Both require written agreements with processors; GDPR DPA is more prescriptive |94| HIPAA Patient Rights | GDPR Art. 15-22 | GDPR provides broader rights (portability, erasure, restriction, objection) |95| HIPAA De-identification (Safe Harbor / Expert) | GDPR Recital 26 anonymisation | Different standards: HIPAA Safe Harbor has 18 specific identifiers; GDPR requires irreversibility assessment |9697### Phase 5: Risk Assessment (Week 3-4)9899| Risk | Description | Typical Level |100|------|-------------|--------------|101| HD-R1 | Health data breach exposing sensitive diagnoses, conditions, or genetic information | Very High |102| HD-R2 | Re-identification of pseudonymised health data through linkage with other datasets | High |103| HD-R3 | Discriminatory use of genetic data (insurance denial, employment discrimination) | High |104| HD-R4 | Unauthorised access by healthcare staff beyond clinical need-to-know | High |105| HD-R5 | Secondary use of clinical trial data without participant awareness | Medium |106| HD-R6 | Cross-border transfer of health data to jurisdictions with weaker protections | High |107| HD-R7 | Patient re-identification through aggregation of fitness/wellness app data | Medium |108109### Phase 6: Genetic Data Specifics110111Genetic data has unique privacy characteristics:112- **Perpetual sensitivity**: Genetic information does not change over a lifetime and reveals information about biological relatives.113- **Familial implications**: An individual's genetic data reveals information about parents, siblings, and children who have not consented to processing.114- **Predictive power**: Genetic data can predict future health conditions, creating insurance and employment discrimination risks.115- **Irreversibility**: Once genetic data is disclosed, it cannot be "unlearned" or reset.116117Additional requirements for genetic data:118- Art. 9(4) permits Member States to impose further conditions on genetic data processing.119- Germany: Gendiagnostikgesetz (GenDG) imposes strict limitations on genetic testing in employment and insurance contexts.120- France: Code de la sante publique Art. L1131-1 restricts genetic testing to medical and scientific purposes.121122## Enforcement Precedents123124- **Finnish DPA vs Pihlajalinna (2021)**: EUR 608,000 fine for health services company where employees accessed patient records without clinical justification — inadequate access controls and logging.125- **Portuguese DPA vs Hospital do Barreiro (2018)**: EUR 400,000 fine for hospital where non-clinical staff had access to patient records through failure to implement role-based access controls.126- **Dutch DPA vs OLVG Hospital (2021)**: EUR 440,000 fine for inadequate access controls on electronic patient records — insufficient two-factor authentication and logging of access.127- **Swedish DPA vs Capio St. Goran (2020)**: SEK 30 million fine for hospital failing to conduct DPIA for patient records system and failing to implement adequate access controls.128- **ICO vs Pharmacy2U (2015)**: GBP 130,000 fine for selling patient data to marketing companies without consent.
mukul975