sou · GUB382 · 2007-01-01 00:00:00 — mation may be deemed to be important for the care that the patient necessarily needs. Restricted data can as such be made accessible to another care unit or care process by a different means than electronic access. If a patient has explained that they do not wish the data about them to be disclosed from one care unit to another, it should not be possible for such disclosure of data to occur, except in emergency- type situations. Information about there being restricted data may be available to other care units or care processes, as is information about what care unit or care process restricted the data. Information about restricted data existing regarding a child may give cause to particular caution and deliberation regarding whether a report in accordance with Chapter 14, Section 1 of the Act (2001:453) should be made to the social welfare committee to ensure that the child gets the necessary protection. Direct access for the patient Through the Act, a care provider may allow an indi- vidual direct access to such data about the individual personally that may be disclosed to them and which is processed for the purpose of care documentation. Direct access means that the individual can be afforded personal access to the information electronically. This rule does not constitute an obligation for a care provider to provide individuals with direct access, but only the opportunity to do so. It is expected that those requesting and those who have been granted access to their data can also be told who they may refer to in order to get help with understanding the data. Direct access does not need to involve access to all of the data about the individual. The indi- vidual may also be granted direct access to documentation regarding electronic access to data about the individual ('processing history' or 'log'). The Government, or the authority appointed by the Govern- ment, is authorised to make regulations on requirements for security measures that should apply for direct access. A precondition for direct access is that there are sufficiently secure technical solutions to verify the identification of the party requiring the data. It is intended that will issue such regulations, following consultation with . Operational follow-up is a core issue for the development of the health and care services. By 'operational follow-up', we basically mean the same thing as 'follow-up, evaluation and quality ', referred to in Section 4, Item 2 of the Health Care Register Act. Operational follow-up can be aimed at a multitude of different factors within the health and care services, for example, the measurement of the treatment results achieved and patient satisfaction or the measurement of resources applied in the form of expense for each input or other follow-up of cost efficiency, productivity, etc. Follow-up may also be conducted at different levels within the health and care services. Our proposals taken overall involve, compared with today, in- creased opportunities as regards , financial and other opera- tional follow-up within the health and care services. Opera- tional follow-up is a primary aim according to the Act and different data about patients can be used for combined runs as long as this takes place within the frameworks prescribed by the Act and secrecy legislation. Furthermore, the Act means that authorities that conduct health and care services in the same county council may have direct access to each other's personal data. As indicated below, we also propose that health and care secrecy should not impede data being dis- closed by an authority within the health and care services within a municipality or a county council to another such authority in the same municipal or county council district. The follow-up of health and care cooperation with municipal home care opera- tions may also be aided by the rules contained in the Patient compared with the current rules in the Health Care Register Act. We also propose certain provisions on operational follow-up through national and regional quality registers; see below. National and regional quality registers The purpose of the processing of personal data in a quality register One of the central tasks of the health and care services is to systematically and continuously develop and secure the quality of the operation. Different methods exist for measuring and developing operational quality within the health and care services. method is to and analyse patient-related data about diagnosis, measures taken and the results of treatment, etc. in computerised quality registers. We have been assigned to propose a statutory rule on the processing of personal data in national quality registers within the health and care services. Certain special provisions are contained in the Act that apply to quality registers into which personal data has been gathered from several care providers and which facilitates compa- risons within the health and care services at a national or regional level. The Act comprehensively governs the purposes for which personal data contained in such quality registers may be pro- cessed. Personal data may be collected and processed for the overall and primary aim of systematic and continuous development and in order to ensure the quality of the care. Personal data gathered may in addition also be processed for certain other purposes, namely, among other things, the production of statistics or research within the field of health and care. Personal data that may be processed Act clarifies that only such data as is necessary for the primary purpose of quality of care may be entered into a national or regional quality register. Furthermore, the Act prescribes that the personal identity (ID) number or name of the person registered may only be processed in a national or regional quality register if it is insufficient for quality purposes to process coded personal data or personal data that only indirectly identifies the person registered. Sensitive personal data, as referred to in Section 13 of the Act and which does not relate to health, and also personal data about legal offences, etc., as referred to in Section 21 of the same act, may only be processed if the Government, or the authority appointed by the Government, consents to this in the specific case. A provision is introduced into the Act that – in contrast to the provisions applicable today under the Act – provides the individual with the right to avoid being registered in a national or regional quality register. This right even applies after the processing of personal data has commenced. If an individual opposes the processing of personal data after it has been commenced, the data about the individual that has been registered should be erased from the register. General issues and provisions General provisions on information The party who is the personal data controller, in accordance with the Act, must ensure that the person registered receives information about the processing of personal data. The provisions of the Act on information also apply regarding the pro- cessing of personal data under the Act. Section 25 of the Act specifies which information the personal data controller can voluntarily disclose to the person registered. This in- formation obligation is defined in the Act. The information should contain details about who the personal data controller is, the purpose of the processing and what categories of data are being processed. The information should also contain an explanation about the information obligation that may ensue accor- ding to act or ordinance, the secrecy and security provisions appli- cable to data and processing, the right to request that the data is restricted in certain cases, the right to receive information about the direct access and electronic access to data that has taken place, the right to gain access to data, according to Section 26 of the Act, the right, according to Section 28 of the same act, to have incorrect or misleading data corrected, and the right, under Sec- tion 48 of the same act, to damages. Furthermore, such information should contain details about the rules applicable with regard to search terms, direct access and the disclosure of data on media for auto- matic processing and the provisions applicable regarding storage and erasure. Finally, the information should contain details of whether or not the processing is voluntary. Information in connection with the maintenance of composite records In the event that a care provider participates in a system for main- taining composite records, the person registered should also be in- formed of what the maintenance of composite records involves and that they can oppose their patient data being made available to other care providers through the maintenance of composite records. Information about the processing of personal data in the national and regional quality registers The individual should be informed about the processing of personal data in a national or regional quality register. This information obli- gation derives first from the general provisions of the Act on information that must be provided to the individual and second from the Act. It is proposed that the person registered should be specially informed about their right to at any time whatsoever have data about themselves erased from the register. Furthermore, the individual should be informed about the extent to which the processing of personal data relates to data collected from sources other than the patient record or the patient themselves, for example data gathered through combined runs with other registers. Furthermore, it is proposed that the person registered should be specially informed about the categories of recipient to whom per- sonal data can be disclosed, for example that data may sometimes be disclosed for research purposes. This information should be provided before the processing of personal data is started or, if this is not possible, as soon as it can be provided. The provisions of the Act on rectification apply to the processing of personal data that is completely or partially auto- mated or where the data forms part of, or is intended to form part of, a structured compilation of personal data that is available for searching or compilation according to special criteria and which is conducted according to the Act. The latter act refers to the Act's rules on rectification. As regards the rectification of data contained in records, the Act's provisions on rectification of record data have priority. The provisions of the Act on damages apply to the processing of personal data that is completely or partially automated or where the data forms part of, or is intended to form part of, a structured compilation of personal data that is available for searching or compilation according to special criteria and which has been con- ducted in violation of the Act's provisions on the pro- cessing of personal data. The latter act refers to the Act's rules on damages. The provisions of the Act on security when pro- cessing data and the powers of the supervisory authorities also apply when personal data is processed according to the Act. In addition, the Act states which security measures should be implemented in certain cases. The provisions of the latter kind relate, among other things, to the grant of authorisation for electronic access and the authentication of this authorisation. is the supervisory authority even when the personal data is processed under the Act. However, supervision of compliance with the rules on maintaining records will still be exercised by . Entry into force and transitional provisions Act and the proposed amendments to other legislation will enter into force on 1 January 2008. When the Act enters into force, the Act and the Health Care Register Act will cease to apply. The application of the provisions of the Act on national and regional quality registers will not start before 1 January 2009 with regard to any quality records that were started to be kept prior to the entry into force of the Act. Furthermore, the provisions on the rights of the individual to oppose the processing of personal data in such quality registers and regarding information about such processing of personal data do not apply regarding per- sonal data processed prior to 1 January 2009. Proposed act amending the Secrecy Act We propose, as stated above, the introduction of a provision for the breaking of secrecy, which in practice will remove health and care secrecy between the different authorities within the health and care services in the same county council or municipality. The aim of this exemption is that the secrecy legislation should not impede organisational changes within the health and care services. This exemption makes it possible, for instance, for a county council to freely determine the structure it wishes to have without regard to secrecy applying in principle between authorities. It will also enhance the opportunities for operational follow-up based on patient data. This exemption has been included in a new paragraph, Chapter 7, Section 1d of the Secrecy Act (1980:100). The maintenance of composite records means, as stated above, that the authorities within the health and care services and private care providers may under certain preconditions gain direct access to each other's electronic records and other personal data that is processed for purposes relating to care documentation. It is pro- posed that an exemption from health and care secrecy is introduced in the new paragraph, Chapter 7, Section 1d of the Secrecy Act to ensure that care providers who make data available to other care providers when maintaining composite records do not need to review the question of secrecy in every individual case. This exemp- tion means that secrecy does not impede the data being disclosed to an authority within the health and care services or to an individual care provider according to the provisions of the Act on the maintenance of composite records. The protection of personal privacy in the case of maintenance of composite records is satisfied by the rules of the Act on, among other things, the patient's influence in connection with the of such records. No corresponding exemption as that contained in the Secrecy Act is required for private health and care services. An exemption from health and care secrecy is also pro- posed by Chapter 7, Section 1d of the Secrecy Act, which makes it possible to disclose data to a national or regional quality register under the Act We have made the assessment that, for patient security reasons, a provision is required regarding the breaking of secrecy within the area of care and nursing services in order for an individual to be able to get the care, nursing, etc. that is necessary. the introduction of an exemption from health and care secrecy whereby secrecy will not impede data about an individual, that is required so that they will be able to get the necessary care, nursing or treatment or other support, being disclosed by an autho- rity within the health and care services to another authority within the health and care services or the social services or to a private care provider or a private operation within the area of social services. A precondition for the disclosure of such data is that the individual, owing to their health status or for other reasons, cannot consent to the disclosure of the data. The exemption may not be routinely applied. It should be applied with caution and dis- cretion in every individual case. The individual's consent should be obtained in the first instance. This exemption provision has been included in Chapter 7, Section 1d of the Secrecy Act. In order to facilitate the long-term follow-up of care quality by the party the quality register, an extension is proposed to the exemption from absolute statistical secrecy, contained in Chapter 9, Section 4 of the Secrecy Act, to also cover data about deceased persons and relating to the cause of death and the date of death. It is proposed that such data may be disclosed for the purpose of quality within the health and care services con- ducted through national or regional quality registers, provided it is clear that disclosure can be effected without the individual or a per- son closely-related to the individual suffering any harm or incon- venience. Some further amendments to the Secrecy Act of a basically edi- torial nature are proposed. Our proposal gives cause for a number of consequential amend- ments to the Act relating to the Circumcision of Boys (2001:499), the Biobanks in Care Act (2002:297) and the Forensic Certificates owing to Crime Act (2005:225). Härigenom föreskrivs följande. 1 § Denna lag tillämpas vid vårdgivares behandling av personupp- gifter inom hälso- och sjukvården. I lagen finns också bestämmelser om skyldighet att föra patientjournal. Lagen gäller i tillämpliga delar även uppgifter om avlidna per- soner. Respekt för enskildas integritet 2 § Personuppgifter skall utformas och i övrigt behandlas så att patienters och övriga registrerades integritet respekteras. Dokumenterade personuppgifter skall hanteras och förvaras så att obehöriga inte får tillgång till dem. 3 § I denna lag används följande beteckningar med nedan angiven betydelse. Verksamhet som avses i hälso- och (1982:763), (1985:125), (1991:1128) om psykiatrisk tvångs- vård, lagen (1991:1129) om rätts- enligt smittskyddslagen (2004:168). Framställning i skrift eller bild samt upptagning som kan läsas, avlyssnas eller på annat sätt uppfattas endast med tekniskt hjälpmedel, som upp- rättas eller inkommer i samband med vården av en patient och som innehåller uppgifter om patientens hälsotillstånd eller andra personliga förhållanden och om vårdåtgärder. En eller flera journalhandlingar som rör samma patient. En gemensam databas eller ett annat elektroniskt system, som gör det möjligt för en vårdgivare att ge eller få direktåtkomst till personuppgifter hos en annan vårdgivare. Vård, undersökning och behand- ling inom hälso- och sjukvården. kommun i fråga om sådan hälso- eller kommunen har an- svar för samt annan juridisk eller fysisk person som yrkesmässigt be- driver hälso- och sjukvård. 4 § Personuppgiftslagen (1998:204) gäller vid sådan behandling av personuppgifter inom hälso- och sjukvården som är helt eller delvis automatiserad eller där uppgifterna ingår i eller är avsedda att ingå i en strukturerad samling av personuppgifter som är tillgäng- liga för sökning eller sammanställning enligt särskilda kriterier, om inte annat följer av denna lag eller föreskrifter som meddelas med stöd av denna lag. Grundläggande bestämmelser om behandling av personuppgifter 1 § Bestämmelserna i detta kapitel tillämpas vid sådan behandling av personuppgifter som avses i 1 kap. 4 §. Den enskildes inställning till personuppgiftsbehandling 2 § Behandling av personuppgifter som är tillåten enligt denna lag får utföras även om den enskilde motsätter sig den. Det gäller dock inte om annat framgår av denna lag, annan lag eller förordning. I 4 kap. 4 §, 6 kap. och 7 kap. 2 § finns bestämmelser om att en personuppgiftsbehandling inte är tillåten om patienten motsätter sig den eller inte samtycker till den. 3 § En behandling av personuppgifter som inte är tillåten enligt denna lag får ändå utföras om den enskilde lämnat ett uttryckligt samtycke till behandlingen. Det gäller dock inte om annat framgår av denna lag, annan lag eller förordning. Av 6 kap. 5 § framgår att den enskilde i ett visst fall inte kan sam- tycka till en behandling av personuppgifter som inte är tillåten enligt denna lag. Regeringen får föreskriva att en behandling av personuppgifter som inte är tillåten enligt denna lag inte heller i andra fall får utföras trots att den enskilde lämnat samtycke till behandlingen. 4 § Personuppgifter får behandlas inom hälso- och sjukvården om det behövs för 1.att fullgöra de skyldigheter som anges i 3 kap. och upprätta annan dokumentation som behövs i och för vården av patienter, 2.administration som rör patienter och som syftar till att bereda vård i enskilda fall eller som annars föranleds av vård i enskilda fall, 3.att upprätta annan dokumentation som följer av lag, förord- ning eller annan författning, 4.att systematiskt och fortlöpande utveckla och säkra kvaliteten 5.administration, planering, uppföljning, utvärdering och tillsyn av verksamheten, eller 6.framställning av statistik rörande hälso- och sjukvård. I 7 kap. 4 och 5 §§ finns särskilda bestämmelser om ändamålen för behandling av personuppgifter i nationella och regionala kvali- tetsregister. 5 § Personuppgifter som behandlas för ändamål som anges i 4 § får också behandlas för att fullgöra uppgiftslämnande som sker i överensstämmelse med lag eller förordning. I övrigt gäller 9 § första stycket d och andra stycket personuppgiftslagen (1998:204). 6 § En vårdgivare är personuppgiftsansvarig för den behandling av personuppgifter som den utför. I landsting och kommun är varje myndighet som bedriver hälso- och sjukvård personuppgiftsansva- rig för den behandling av personuppgifter som myndigheten utför. I 6 och 7 kap. finns särskilda bestämmelser om personuppgifts- ansvar. Personuppgifter som får behandlas 7 § Endast sådana personuppgifter som behövs för ändamål som anges i 4 § får behandlas. Även en vårdgivare som inte är myndighet får behandla sådana uppgifter om lagöverträdelser m.m. som avses i 21 § personuppgiftslagen (1998:204). 8 § Känsliga personuppgifter som avses i 13 § personuppgiftslagen (1998:204) eller uppgifter om lagöverträdelser m.m. som avses i 21 § samma lag får inte användas som sökbegrepp. Inte heller får uppgifter om att någon fått bistånd eller andra insatser inom eller varit föremål för åtgärder enligt utlänningslagen (2005:716) an- vändas som sökbegrepp. Det är trots förbudet i första stycket tillåtet att som sökbegrepp använda uppgifter som rör hälsa samt uppgifter om att någon varit föremål för tvångsingripande enligt lagen (1991:1128) om psykiatrisk tvångsvård eller lagen (1991:1129) om rättspsykiatrisk vård. Regeringen får föreskriva att ett landsting eller en kommun, utan hinder av vad som anges i första stycket, får använda uppgifter om etnicitet samt att någon fått bistånd eller andra insatser inom social- tjänsten eller varit föremål för åtgärder enligt utlänningslagen som sökbegrepp för att göra vissa slags sammanställningar. Skyldigheten att föra patientjournal 1 § Vid vård av patienter skall föras patientjournal. Patientjour- nal skall föras för varje patient och får inte vara gemensam för flera patienter. I 6 kap. finns bestämmelser om direktåtkomst till andra vårdgi- vares uppgifter om patienter genom sammanhållen journalföring. Personer som är skyldiga att föra patientjournal 2 § Skyldig att föra patientjournal är 1.den som enligt 3 kap. lagen (1998:531) om yrkesverksamhet på hälso- och sjukvårdens område har legitimation eller särskilt för- ordnande att utöva visst yrke, 2.den som, utan att ha legitimation för yrket, utför arbetsuppgifter som annars bara skall utföras av logoped, psykolog eller psykotera- peut inom den allmänna hälso- och sjukvården eller sådana arbets- uppgifter inom den enskilda hälso- och sjukvården som biträde åt legitimerad yrkesutövare, 3. den som är verksam som kurator i den allmänna hälso- och sjukvården. Ansvar för uppgifter i patientjournal 3 § Den som för patientjournal svarar för sina uppgifter i jour- nalen. 4 § En patientjournal får endast innehålla de uppgifter som behövs för de ändamål som anges i 2 kap. 4 § första stycket 1 och 2. 5 § En patientjournal skall innehålla de uppgifter som behövs för en god och säker vård av patienten. Om uppgifterna föreligger, skall en patientjournal alltid innehålla 1.uppgift om patientens identitet, 2.väsentliga uppgifter om bakgrunden till vården,