Take-Aways (AI)
  • The data pro­tec­tion offi­cer of the Can­ton of Zurich draws atten­ti­on to unlawful access to pati­ent data by case managers.
  • Health insu­r­ers requi­re valid, infor­med con­sent; infor­ma­ti­on obli­ga­ti­ons towards insu­red per­sons are insuf­fi­ci­ent­ly fulfilled.
  • BAG/EDÖB recom­mend data pro­tec­tion con­cepts, data coll­ec­tion direc­to­ries, data con­trol­lers and exter­nal audits of insurers.
  • Fede­ral law (DSG, KVG, ATSG) applies; super­vi­so­ry aut­ho­ri­ties exami­ne insu­r­ers indi­vi­du­al­ly, amend­ment of law not curr­ent­ly con­side­red necessary.

Inter­pel­la­ti­on Pre­licz-Huber (09.3515): Case manage­ment. Unlawful inter­fe­rence with pati­ent con­fi­den­tia­li­ty and vio­la­ti­on of data protection.
Done (25.09.2009)

Sub­mit­ted text

In his 14th acti­vi­ty report of March 3, 2009, the data pro­tec­tion com­mis­sio­ner of the Can­ton of Zurich unequi­vo­cal­ly poin­ted out that so-cal­led case mana­gers of health insu­r­ers can com­pre­hen­si­ve­ly access health data in hos­pi­tals and ther­eby in some cases mas­si­ve­ly vio­la­te data pro­tec­tion and pati­ent con­fi­den­tia­li­ty. The exi­sting agree­ments bet­ween the insu­r­ers and the hos­pi­tals only regu­la­te the coor­di­na­ti­on acti­vi­ties of the case mana­gers and con­tain insuf­fi­ci­ent pro­vi­si­ons regar­ding the pre­ser­va­ti­on of phy­si­ci­an and pati­ent con­fi­den­tia­li­ty or refe­ren­ces to a duty to inform on the part of the insu­r­ers. A legal regu­la­ti­on in the Health Insu­rance Act is missing.

Health insu­r­ers obtain sen­si­ti­ve health data even wit­hout pati­ents’ con­sent and, for exam­p­le, alre­a­dy have infor­ma­ti­on such as dia­gno­sis, tre­at­ment mea­su­res or expec­ted length of hos­pi­tal stay befo­re they do. Even if a decla­ra­ti­on of con­sent is obtai­ned, the­re is appar­ent­ly a lack of the neces­sa­ry pati­ent edu­ca­ti­on. This untenable sta­te of affairs goes so far that hos­pi­tals are even asked by insu­rance com­pa­nies to report peo­p­le who do not sign the decla­ra­ti­on to the insurer. This sta­te of affairs can­not be tole­ra­ted any longer.

Various que­sti­ons ari­se for the Fede­ral Coun­cil in this regard:

1 Alt­hough the fede­ral super­vi­so­ry aut­ho­ri­ty was infor­med by seve­ral par­ties as ear­ly as 2007 about the ille­gal actions of the insu­r­ers, no action has been taken in this regard. Why not?

2. how does he assess the hand­ling of phy­si­ci­an and pati­ent con­fi­den­tia­li­ty when case mana­gers often learn much more than what is neces­sa­ry, through their invol­vement in rap­ports or tre­at­ment planning?

3. how does he see the fur­ther pro­ce­du­re in this action of the health insu­ran­ces vio­la­ting the data pro­tec­tion law?

4. what mea­su­res are taken to gua­ran­tee pati­ent pro­tec­tion and ensu­re data pro­tec­tion com­pli­ance in the long term?

5. does it intend to take data pro­tec­tion serious­ly in the case of exi­sting con­tracts and to review them for their lega­li­ty, respect for the duty to inform and data protection?

6 Is it con­side­ring amen­ding the law? If so, with what thrust?

<

h1>Statement of the Fede­ral Council

<

h1>

1 The Fede­ral Coun­cil has alre­a­dy sta­ted on the occa­si­on of two ear­lier par­lia­men­ta­ry initia­ti­ves (Postu­la­te Heim 08.3493, Que­sti­on Schen­ker Sil­via 09.5060) that the­re is a need for action with regard to the data pro­tec­tion situa­ti­on in the area of man­da­to­ry health insu­rance (OKP). A stu­dy just published by the Fede­ral Data Pro­tec­tion and Infor­ma­ti­on Com­mis­sio­ner (Edöb) and the Fede­ral Office of Public Health (FOPH) now sta­tes in a more dif­fe­ren­tia­ted man­ner that data pro­tec­tion is lar­ge­ly gua­ran­teed at the health insu­r­ers that pro­vi­de man­da­to­ry health care insu­rance and vol­un­t­a­ry dai­ly allo­wan­ce insu­rance in accordance with the Fede­ral Health Insu­rance Act (KVG; SR 832.10), but that the­re is a need for action in some are­as. With the publi­ca­ti­on of the report, the fol­lo­wing recom­men­da­ti­ons have been issued to the health insu­r­ers, the imple­men­ta­ti­on of which will be review­ed in the coming months as part of the super­vi­si­on of the health insurers:

Each health insurer should deve­lop a data pro­tec­tion con­cept (stra­tegy). A direc­to­ry of data coll­ec­tions must be main­tai­ned at each health insurer. For each data coll­ec­tion with per­so­nal data requi­ring spe­cial pro­tec­tion, pro­ce­s­sing regu­la­ti­ons must be main­tai­ned (descrip­ti­on of pro­ce­s­ses inclu­ding respon­si­bi­li­ties, aut­ho­rizati­ons, data flow and tech­ni­cal mea­su­res for data secu­ri­ty). A data pro­tec­tion offi­cer should be desi­gna­ted at each health insurer and a data con­trol­ler for each data coll­ec­tion. The tasks of the­se roles are descri­bed in a spe­ci­fi­ca­ti­on. Data pro­tec­tion owners must have the neces­sa­ry exper­ti­se. Data pro­tec­tion audits out­side the admi­ni­stra­ti­on should be car­ri­ed out regu­lar­ly and the results sub­mit­ted to the super­vi­so­ry authorities.

2 Alt­hough case manage­ment is not expli­ci­t­ly regu­la­ted in the KVG, the data pro­tec­tion pro­vi­si­ons are equal­ly appli­ca­ble. Insu­red per­sons who­se exami­na­ti­ons and tre­at­ments are accom­pa­nied by a case mana­ger must give their vol­un­t­a­ry and express con­sent to this accom­p­anime­nt and to the asso­cia­ted insight into their health data on the basis of the KVG prin­ci­ples (e.g. choice of ser­vice pro­vi­der or tre­at­ment method) and the rele­vant data pro­tec­tion pro­vi­si­ons. Their valid con­sent requi­res that they are ade­qua­te­ly infor­med by their health insurer before­hand and that they are able to reco­gnize the scope of their con­sent. In addi­ti­on, they must be infor­med by the ser­vice pro­vi­der or the health insurer that in justi­fi­ed cases the ser­vice pro­vi­der is entit­led and, at the request of the insu­red per­son, in any case obli­ged to dis­c­lo­se medi­cal infor­ma­ti­on only to the medi­cal exami­ner of the health insurer.

Health insu­r­ers are aut­ho­ri­zed to pro­cess the per­so­nal data, inclu­ding data requi­ring spe­cial pro­tec­tion and per­so­na­li­ty pro­files, that they need to ful­fill the tasks assi­gned to them under the Act, name­ly to assess claims for bene­fits and to cal­cu­la­te bene­fits. In doing so, they must strict­ly com­ply with the prin­ci­ple of pro­por­tio­na­li­ty and may not enter into agree­ments with ser­vice pro­vi­ders that give them access to health data of insu­red per­sons that they do not need to ful­fill the tasks assi­gned to them under the law.

The data pro­tec­tion situa­ti­on in the area of case manage­ment varies among the health insu­r­ers. The super­vi­so­ry aut­ho­ri­ties will the­r­e­fo­re approach the health insu­r­ers con­cer­ned indi­vi­du­al­ly in order to impro­ve the data pro­tec­tion situation.

5 The issue rai­sed by the Data Pro­tec­tion Com­mis­sio­ner of the Can­ton of Zurich con­cerns con­tracts bet­ween hos­pi­tals and health insu­r­ers at the can­to­nal level. The review and appr­oval of such (tariff) con­tracts is the respon­si­bi­li­ty of can­to­nal aut­ho­ri­ties. This also applies to com­pli­ance with data pro­tec­tion. With regard to regu­la­ti­ons in the tariff agree­ments, it should be noted that the Fede­ral Admi­ni­stra­ti­ve Court recent­ly sta­ted in its decis­i­on of May 29, 2009, “that the trans­fer of the dia­gno­sis and the inter­ven­ti­on code with the admis­si­on noti­fi­ca­ti­on or with the invoi­cing – within the frame­work in par­ti­cu­lar of the prin­ci­ple of pro­por­tio­na­li­ty and the other pro­vi­si­ons rele­vant to data pro­tec­tion – is only per­mis­si­ble if their pre­cise form is regu­la­ted in accordance with the prin­ci­ple of the least pos­si­ble intrusion …”.

6 The Fede­ral Act on Data Pro­tec­tion (FADP; SR 235.1) and the Ordi­nan­ce to the Fede­ral Act on Data Pro­tec­tion (FADP; SR 235.11) app­ly in full to health insu­r­ers as fede­ral bodies. Artic­le 33 of the Fede­ral Act on the Gene­ral Part of Social Insu­rance Law (ATSG; SR 830.1) pro­vi­des for a gene­ral duty of con­fi­den­tia­li­ty for the imple­men­ting bodies of social insu­rance sche­mes. Artic­les 84 and 84a of the KVG and Artic­les 59 and 120 of the Ordi­nan­ce on Health Insu­rance (KVV; SR 832.102) con­tain addi­tio­nal spe­cial pro­vi­si­ons on the pro­ce­s­sing of per­so­nal data, the dis­clo­sure of data, the gua­ran­tee of data pro­tec­tion and the pro­vi­si­on of infor­ma­ti­on to insu­red per­sons by health insu­r­ers. Due to the­se data pro­tec­tion stan­dards in the health insu­rance sec­tor, the­re is con­se­quent­ly no need for a fur­ther data pro­tec­tion pro­vi­si­on for case management.