MEDICAL FILE: THE PATIENT'S RIGHT TO CORRECTION OR DELETION OF HIS DATA
By Catherine Paley-Vincent, Partner lawyer and Camille Faour, Lawyer
The doctor's obligations
Since the entry into force of the GDPR (General Data Protection Regulation) on May 25, 2018 and transposed into French law by the law of June 20, 20181, many doctors are the recipients of requests from their patients wishing to have certain data corrected or erased from their medical records.
Whether the collection of personal data is carried out on computer software or in a paper file, in a private practice, a public or private health establishment or in an occupational health service, the doctor is required to collect and keep this data. in a fair and lawful manner. These must be adequate, relevant and not excessive in order to carry out his activity of prevention, diagnosis and care and for a period which does not exceed that necessary for the use he makes of it. In this, it acts as a " data controller »Within the meaning of the law 2 3.
Patients' rights
If the patient has a right of access to his medical file4, he must be able to ask his doctor to correct the content in the event of an error, or even in certain cases to erase the data indicated by the doctor.
Indeed, a request for rectification or erasure of health data can only be satisfied if these data are:
- inaccurate,
- incomplete,
- equivocal,
- expired,
- or if their collection, use, communication or storage is prohibited5.
Thus, the patient has a fundamental right enabling him to ensure that the personal data concerning him are accurate, complete and if necessary up to date.
In this sense, the doctor must be particularly careful to check the accuracy and relevance of the personal and health data that he writes and keeps in the patient file.
The right of rectification
The patient has the right to obtain “ data controller », As soon as possible, the rectification of personal data which are inaccurate or which should be completed, including by providing the doctor with an additional declaration6.
What personal data is affected by this right?
Make no mistake about it! Not all of the information contained in the medical file can be corrected.
Only objective, factual and manifest errors can be amended.
This is the case, for example, of a spelling error in the patient's name, in the registration of his blood group or even affecting his social security number.
In the same way, the patient can obtain the rectification of inaccurate or incomplete data relating to his age, his e-mail address, his postal address, the number of his apartment, or even request that the mention which would state of it be modified. an injury to the left knee rather than the right knee.
On the other hand, the right of rectification is not intended to allow a medical diagnosis to be contested. which results from a professional assessment of the practitioner.
Indeed, the medical opinions, the interpretations, the data necessary for the purposes of medical diagnoses noted by the doctor during his consultation cannot be the object of any modification.
How to assess the need to rectify or not personal data ?
Faced with a request for rectification of personal data by his patient, the doctor must assess whether it is inaccurate or incomplete.
If the request for rectification concerns disputes related to the diagnosis he has made, only the doctor concerned will be able to assess this request and, if necessary, leave it unanswered. If the practitioner decides to allow it, it is then recommended that he leave a written and explanatory trace in his patient's file.
In any case, the doctor must act in conscience.
The right to erasure
The patient can also ask his doctor to erase his personal data but, again, under certain conditions7.
To what extent can the patient avail himself of this right?
If such a right exists in certain strictly limited cases8, there is cependant discarded concerning the health data appearing in the medical file.
In other words, the possibility of erasing health data is restricted and limited to the legal obligations to which the doctor remains subject, access for the patient to his medical file, preservation of medical files9 or even professional secrecy.
It is easily understood that the processing and storage of health data are necessary to enable the doctor to ensure the effective care of the patient, the provision of care and the continuity thereof.
The exception: that of the legitimate reason invoked by the patient
On the other hand and by exception, it was granted the possibility for a patient to have certain health data erased because of a " legitimate reason ».
The CNIL thus accepted as legitimate the request of a patient hospitalized at the Hospices Civils de Lyon who requested the erasure of information relating to his various hospitalizations and the treatments he was undergoing, stored in the computer software. Affected by an ailment that he did not wish to reveal to those around him and having learned that a member of his family, a doctor, was required to take up a post at the hospital, he feared that consulting the computer software would allow his parent to know his pathology10.
This case remains however quite exceptional and should not be understood as a generality.
In such a case, it is recommended that the doctor keep the mention of this deletion in his file.
What remedies for the patient?
In the event of a response deemed unsatisfactory by the patient or in the event of disagreement, the latter has the possibility to refer the matter to the judge or to file a complaint with the CNIL.
If the patient's right to request a rectification or deletion of the record kept by his doctor, does exist, it is strictly framed and limited..
1 - Law n ° 2018-493 of June 20, 2018 relating to the protection of personal data
2 - Law n ° 2018-493 of June 20, 2018 relating to the protection of personal data
3 - See in this sense our previous article of February 7, 2019 “Newsflash - Decryption of the GDPR applicable to doctors”: https://www.ginestie.com/newsflash-decryptage-du-rgpd-applicable-aux-medecins/
4 - In accordance with article L. 1111-7 of the Public Health Code
5 - Article 40 of the amended law n ° 78-17 of January 6, 1978 relating to data processing, files and freedoms provides that the patient's personal data must be able to be rectified, completed, updated, locked or even erased when they are inaccurate, incomplete, equivocal, out of date or whose collection, use, communication or conservation is prohibited.
6 - Article 16 of the General Data Protection Regulation.
7 - Article 17 of the General Data Protection Regulation.
8 - Article 17 of the General Data Protection Regulation: (a) Personal data are no longer necessary for the purposes for which they were collected or otherwise processed; (b) The data subject withdraws the consent on which the processing is based, and there is no other legal basis for the processing; (c) The data subject objects to the processing and there are no compelling legitimate grounds for the processing; (d) The personal data have been the subject of unlawful processing; (e) Personal data must be erased to comply with a legal obligation; (f) Personal data has been collected in the context of providing information society services to minors.
9 - The CNOM recommends that the liberal doctor align with the deadlines set for the conservation of medical records from health establishments provided for in article R. 1112-7 of the Public Health Code, ie in substance, twenty years.
10 - Medical record: can I request to erase data after hospitalization? | Need help | CNIL
Catherine Paley-Vincent
Partner
Recognized expert in health law, she intervenes in particular for the constitution and monitoring of structures between hospital and / or liberal health professionals, for the management of possible conflicts and their transactional, judicial or disciplinary consequences. The field of medical imaging is particularly familiar to him.
She advises pharmaceutical companies on medical devices, labeling and clinical trials.
She is regularly consulted on the application of ethics, in particular with regard to the regulation of professional orders of networks, advertising and the Internet used in the medical and veterinary world.
