The IMY highlighted that this case involved large amounts of medical data, which is a special category of data with extra protections under Article 9 GDPR, including children’s data. The IMY took into account Recital 75 and 76 GDPR in order to carry out an assessment of the responsibilities of the University Hospital Board (the controller in this case), according to the risks involved in the data it was processing. In its decision, the IMY established that its investigation was limited to analysing matters related to the security of the processing, and it had not examined whether this processing complied with other GDPR provisions, such as those related to the transfer of personal data to third countries.
In 2019, after conducting an internal risk analysis and a Data Protection Impact Assessment (DPIA) the hospital introduced an encryption solution for secure email. Once sent, the emails and medical records themselves remained stored in the hospital’s Outlook account.
#IMY MEANING IN TEXT SOFTWARE#
Although at some point the hospital began using Microsoft Outlook’s Transport Layer Security (TLS) encryption, if the email software on the recipients’ side did not support TLS, the emails were sent without encryption. These medical reports have been sent by email without encryption since 2014. Although it can be sent by post, the hospital gave the recipient the option of choosing their preferred channel to receive the report, which in the majority of cases was via email.
Based on this notification, the Swedish DPA initiated an investigation into the medical data which the Uppsala University Hospital emailed to patients from abroad, as well as to the foreign hospitals which referred those patients.Īccording to its internal procedures, once the hospital had finalized treatment to a patient from abroad, a medical report was sent to the patient and the referring hospital. Uppsala regional authorities notified the Swedish DPA (Integritetsskyddsmyndigheten - IMY) that a personal data breach had occurred in their jurisdiction in 2019.
0 kommentar(er)
