Information notices by family doctors and paediatricians - 19 july 2006 
[doc. web n. 1672856]
Information notices by family doctors and paediatricians - 19 july 2006
As published in Italy´s Official Journal no. 183 dated 8 August 2006
The Garante per la protezione dei dati personali
Having convened today in the presence of Prof. Francesco Pizzetti, President, Mr. Giuseppe Chiaravalloti, Vice-President, Mr. Mauro Paissan and Mr. Giuseppe Fortunato, Members, and Mr. Giovanni Buttarelli, Secretary General;
Having regard to sections 78(3) and 13(3) of the Data Protection Code (decree no. 196/2003), whereby the information notices to be provided by general practitioners and paediatricians to data subjects in respect of the processing of personal data should include at least the items specified by the Garante;
Having regard to the considerations made, at the Garante´s request, by associations representing general practitioners and paediatricians;
Having regard to the documents on file;
Having regard to the considerations made by the Secretary General pursuant to section 15 of the Garante´s Rules of Procedure (no. 1/2000);
Acting on the report submitted by Prof. Francesco Pizzetti;
General practitioners and paediatricians are required to inform data subjects clearly and understandably on the processing of personal data relating to them insofar as it is performed to discharge administrative and/or prevention, diagnosis, treatment and rehabilitation tasks for the protection of the data subjects´ health and/or bodily integrity (sections 78 and 13 of the DP Code).
Under the DP Code, the Garante should set out the essential items of information to be provided in the said notices; such items may be supplemented if a physician carries out additional specific processing operations on patients´ personal data (section 78(3) of the DP Code).
To that end, the Garante has consulted with the relevant trade associations as selected on the basis of an analysis of the regulations implementing national collective agreements as for general practitioners and paediatricians, respectively [….this part including the names of the associations…]
Based on the considerations made by the associations in question, with particular regard to the remarks made on the initial draft model information notice that was submitted by the Garante, the model information notice attached hereto was developed. General practitioners and paediatricians are free to avail themselves of the model notice at issue.
The Garante considers it necessary to include, in the attached model information notice, some essential items of information general practitioners and paediatricians are required to provide to their patients. In particular, the following will have to be specified:
a. information on a patient´s health may be disclosed to the patient´s family members or acquaintances only if this has been consented to specifically by the patient. In this regard, it is allowed to provide the information notice and obtain the data subject´s (patient´s) consent after delivering medical assistance exclusively if the data subject (patient) is physically and/or legally incapacitated;
b. as a rule, general practitioners and paediatricians collect personal data from the data subjects and may process information related to the data subjects´ hospitalisations, medical and clinical tests (as prescribed by the physicians themselves) if the data subject has expressed his/her consent thereto to the health care body and/or the health professionals he/she has applied to.
This is without prejudice to the need for general practitioners and paediatricians to include additional items of information, pursuant to the law, if the processing operations performed on their patients´ personal data carry specific risks - in particular, if they plan to carry out:
a. controlled clinical trials on drugs (section 78(5), letter a., of the DP Code);
b. telehealth services (section 78(5), letter b., of the DP Code);
c. activities consisting in the supply of goods or services to data subjects via electronic communications networks (section 78(5), letter c., of the DP Code);
d. processing operations for scientific purposes and/or for purposes of scientific, medical, bio-medical and/or epidemiological research (section 78(5) letter a. and section 110 of the DP Code).
The attached model information notice also applies to processing operations related to those performed by general practitioners and/or paediatricians, to the extent such processing operations are carried out by a professional or any other entity as determined on the basis of the specific service that is being requested. In this regard, the processing at issue might be carried out by a locum doctor, a specialist providing health care services at the practitioner´s request, or any person lawfully processing the data in connection with the activity of a medical associates´ clinic, or else providing the prescribed drugs or communicating the data subject´s personal data to the general practitioner in pursuance of the applicable legislation (see section 78(4) of the DP Code).
The items of information contained in the attached model notice can be provided to the data subject once and for all, in pursuance of the law, via suitable arrangements that should make it easier for patients to become apprised of the information in question - also on the basis of the personal acquaintance with the individual patients and in the light of the concrete circumstances. The contents of the information notice may be communicated to a patient directly, whether verbally or in writing, or else by posting the information notice visibly in the waiting room of the medical clinic, or by using any other suitable arrangement in addition to and/or in the place of those mentioned above - e.g. by reproducing the information notice on pocket-size cards provided jointly with folding leaflets (section 78(3) of the DP Code).
The information may be provided also after delivering the medical care service, without delay, if there is a health care and/or public health emergency (section 117 of decree no. 112/1998), if the data subject is physically, legally and/or mentally incapacitated, if there is a serious, impending and irreparable risk to the data subject´s health, or if there is the risk that timeliness and/or effectiveness of medical care might be prejudiced (section 82 of the DP Code).
BASED ON THE ABOVE PREMISES, THE GARANTE
Determines hereby, in pursuance of sections 78(3) and 13(3) of the Data Protection Code, that the attached model notice, which shall be an integral part of this decision, contains the essential items of information to be provided to data subjects by general practitioners and paediatricians in respect of the processing of personal data.
Done in Rome, this 19th day of July 2006
THE SECRETARY GENERAL
I wish to inform you that your data are only used to perform the tasks required for purposes of prevention, diagnosis, treatment, care and/or rehabilitation, or for the purpose of any other type of care you may have requested, including pharmaceutical and specialist care.
The data in question are either provided by you directly, or collected elsewhere; however, this is done with your consent, for instance in case of your hospitalisation and/or the collection of the results of medical tests.
I take protection measures, also when using computerised means, to ensure that the data are kept and used appropriately also by my collaborators, in compliance with
professional secrecy rules. All the professionals (my locum, a chemist, medical specialists) and organisations that might come to know the data in question are also required to take these protection measures.
No data is disclosed to third parties, unless this is necessary or required under the law.
Information on your health may be provided to your family members or acquaintances only if you instruct me to do so.
You have the right at any time to know the data relating to you, get information on how the data were acquired, check whether they are accurate, complete, updated and kept appropriately, and exercise all the rights you are entitled to in this regard.
I will take care to inform you more precisely whenever there are more delicate steps to be taken in your interest.