Summary

A legal basis is required to process personal data, including health data which are considered sensitive. As regards the communication of health data, the likely legal bases include forwarding with the permission of the data subject, forwarding to a health care provider for the purposes of providing health care services and forwarding to protect the vital interests of the data subject.

The European Commission Article 29 Data Protection Working Party has adopted a position that the forwarding of health data to a health care provider for the purpose of provision of health care services is permissible when three conditions are simultaneously met: processing of the data must be necessary, it must be carried out for the purposes of providing health care services (“for the purposes of preventive medicine, medical diagnosis, the provision of care or treatment or the management of health-care services” according to the directive), and the data are processed by a person subject to the obligation of professional secrecy or an equivalent obligation of secrecy. The article explores these conditions and how they are met in Estonian law.

As an interoperable eHealth information system is not available in the European Union at the moment, granting access to health data in an eHealth information system and forwarding of health data by electronic means have been discussed separately in the article.