“New people” will submit to the State Duma a bill to ban access to patient data

Deputies of the New People faction in the State Duma propose to prohibit access without the written or electronic consent of a citizen to information constituting a medical secret, to everyone except his attending physician, including the police, military commissars, employers and even artificial intelligence. On Tuesday, the corresponding bill is submitted to the State Duma. According to the authors of the document, such a measure will eliminate abuses that lead to the leakage of sensitive data to the darknet, as well as protect the rights of citizens to privacy, personal and family secrets. Experts interviewed by Kommersant indicate that there are only a few databases with medical data in the network and all of them are in the public domain “due to complete lack of demand”, and the proposed amendments could complicate the already confusing relationship between the patient, the clinic, the insured and regulatory authorities.

New People party leader Alexei Nechaev and his first deputy deputy speaker of parliament Vladislav Davankov are submitting a bill to the State Duma on Tuesday that proposes giving citizens the right not to disclose health information to anyone other than their attending physicians. The deputies want the health worker, who may need information hidden by the patient, to request the right to use it, receiving written or electronic consent. The explanatory note clarifies that this will eliminate the legal grounds for possible abuse of the right of medical organizations to receive information containing the patient’s medical confidentiality, and will also contribute to “increasing the protection of citizens’ rights to privacy, personal and family secrets.”

The law “On the Fundamentals of Protecting the Health of Citizens” specifies 11 situations where it is allowed to provide information of a medical nature without the consent of a citizen or his legal representative. For example, when it comes to treating a person whose condition does not allow him to express his will; the threat of the spread of infectious diseases, mass poisoning and lesions; requests from the bodies of inquiry and investigation, the court, the prosecutor’s office and the Federal Penitentiary Service; exchange of information by medical organizations, including those placed in information systems; accounting and control in the system of compulsory social insurance. It was the last two points that attracted the attention of the deputies, since “an unlimited circle of people working in medical organizations related to the provision of medical services within the framework of compulsory medical insurance have the right to receive the entire amount of information about the patient without his consent and notification.” This, according to the authors, “creates the prerequisites for an increase in cases of misuse of information constituting the medical secret of citizens.” According to them, on illegal trading platforms on the dark web, “the services of sellers for the sale of information containing medical confidentiality are widely represented.” Attackers working in medical organizations use the opportunity to request such data in the medical information system without notifying a citizen and use it for illegal purposes, deputies warn. In addition, they note that in a number of cities, for example, in Moscow, it is practiced to provide information about patients to artificial intelligence for diagnosing and predicting diseases.

By the end of last year, according to InfoWatch, the volume of stolen data from healthcare companies increased 775 times compared to 2021 and amounted to 31 million records. Among the companies that leaked last year was the Gemotest laboratory, this year the Vita online pharmacy (see Kommersant dated November 28, 2022). However, according to Ashot Hovhannisyan, the founder of the DLBI data leak intelligence and darknet monitoring service, even though there are sometimes fairly large-scale “leaks” from medical organizations (such as the leak of 14 million users of Gemotest), bases with medical data in the darknet are few , and all of them are in the public domain “due to complete lack of demand.” According to the expert, there were cases when lists of clients of commercial clinics were put up for sale, but there was not much demand for them, since it is too difficult for fraudulent schemes to use medical data. “In addition, 152-FZ separately protects medical data, and almost all leaks from medical organizations occur as a result of hacking, but not the actions of insiders. It is safe to name only a few cases in recent years when it was insiders who stole and divulged the lists of infected people, and all of them related to the COVID-19 epidemic,” adds Mr. Hovhannisyan.

The amendments proposed by the New People, we note, run counter to recent government initiatives. So, at the end of 2022, the Cabinet of Ministers submitted a bill to the State Duma that allows the Ministry of Internal Affairs to quickly receive data from the Ministry of Health in electronic form on the results of medical examinations of drivers. In mid-April, President Vladimir Putin signed amendments to a number of legislative acts regulating the creation of a digital registration system for military servicemen. The military registry database will have 25 fields containing information about a citizen, including health data. In this regard, the government suggested that the military registration and enlistment offices use data directly from the Unified State Health Information System. “According to our bill, without the consent of the citizen, the data should not be available to anyone except the attending physician. If a person does not want to automatically provide his data for the register of persons liable for military service, he should be able to hide this information, ”the press service of Novye Lyudi specified.

Medical lawyer Irina Gritsenko believes that there is no need to introduce the amendments proposed by the deputies now. She notes that Art. 13 of the Law “On the Fundamentals of Protecting the Health of Citizens” describes in detail the obligations of a medical organization in this regard: “Introducing another amendment to the proposed version will only complicate the already complicated relationship between the patient, the clinic, the insured and the regulatory authorities.”

The proposed changes raise a number of questions for Comply lawyer (advising on law in the field of technology, working with data) Artem Safyannikov: “For example, it is not entirely clear what is meant by electronic consent – consent to the processing of personal data in the form of an electronic document signed with an electronic signature , in accordance with Part 4 of Art. 9 of the law on personal data or other entity. In general, according to Mr. Safyannikov, the idea of ​​creating systems for managing consents and permissions for access and other data processing by third parties “should at least be supported, since the early testing of such a system based on state systems may give impetus to the development and consolidation in the regulatory field of commercial permission management systems by trusted intermediaries.

Natalya Kostarnova, Tatiana Isakova