The protection of the personal data of beneficiaries managed in the context of the operation of the GHS is a key part of the Health Insurance Organisation's operations
The transition to the digital era is undoubtedly a positive development with multiple benefits: Simplification of procedures, reduction of waiting time, avoidance of unnecessary bureaucracy, easy and immediate access to useful data. One issue that arises, however, from this necessary transition is the safeguarding of individuals' Personal Data (PII). In addition to the cybersecurity measures taken to protect the GHS IT System, the Health Insurance Agency has established a specific framework that indicates and controls who and under what conditions is entitled to access and process the data of each beneficiary.
WHAT PERSONAL DATA IS COLLECTED
When a beneficiary requests to register or enroll a third party in the GHS Beneficiary Portal, they will be asked to provide some personal information. These details include first and last name, date of birth, nationality and identity card number or, as appropriate, foreigner registration number
In addition, information regarding marital status, postal address, telephone numbers of the beneficiary and next of kin, email address, preferred method of communication and preferred language of communication (Greek or English) are required.
The Agency has the right, in order to verify whether an applicant meets the criteria to be a beneficiary of the JSIS, to check personal information using other government databases.
In addition, each time a beneficiary receives health care services under the JSIS, the respective provider enters personal data about those services. This data may include indications of the beneficiary's health status.
Medical data is entered into the System either within the "Medical Profile" option or under the "History" category as part of the claims adjudication process.
The OAS has the right to process personal data concerning general information on the health care services received by a beneficiary as part of the implementation, monitoring and management of the General Health System.
WHO HAS THE RIGHT OF ACCESS
The beneficiaries themselves or their guardians have, of course, the right of access to their personal data. In addition, health care providers contracted with the GHS, health care professionals of the GHS, as well as staff owned or working on behalf of the providers, have a right of access under specific conditions that justify such access.
On a need-to-know basis at all times, authorized officials of the HHA, as well as organizations or persons acting as subcontractors or affiliates of the HHA, where in the course of the services they provide, e.g., reviewing claims or pre-authorization requests, they handle personal data of beneficiaries, have a right of access. Furthermore, public authorities may have access to certain personal data in the context of their work, such as the Auditor General of the Republic or the Supervisor of the GSA in the context of complaint investigations, etc.
Finally, persons designated by beneficiaries to register them in the Beneficiary Portal also have access to personal data of a beneficiary. This access is fully terminated upon completion of the beneficiary's enrollment and before the provision of health care services begins.
HOW ACCESS TO PERSONAL DATA IS CONTROLLED
Appropriate technical cybersecurity measures are implemented in the Beneficiary Portal as well as measures that implement the required conditions for lawful access to personal data. With regard to Provider access to the Beneficiary File, there is full transparency as to who, when and under what conditions access was obtained. In particular, any such access is recorded in the Access Log which forms part of each beneficiary's file. At the same time, a separate email is sent to the beneficiary each time a provider has had access.
Finally, through the Portal, each beneficiary is given the opportunity to restrict access by providers either to specific medical data or to his/her entire medical history. In this case, the beneficiary is asked to accept the risk of receiving health care services from providers when they do not have access to their medical history.
FOR HOW LONG THE IDS ARE KEPT IN THE GIS SYSTEM
If the beneficiary wishes, he/she has the right to stop using the GIS services at any time by submitting a request through the Portal. In such a case, access to the Beneficiary's Record is removed, but the Record is not deleted from the GIS System.
The Beneficiary's health data is maintained in accordance with the guidelines issued by the Data Protection Commissioner of the Republic of Cyprus on 3 July 2018. Based on this, the retention period of personal data concerning the health of a beneficiary should not exceed 15 years after his/her death or 15 years after the last data entry in the Portal.
This period applies as long as there are no financial/legal or other outstanding issues or disputes between the beneficiary and the data controller, in this case the OAI.
Also, the personal health data of a beneficiary may be stored for a longer period in a separate filing system if:
a) they are processed exclusively for filing purposes in the public interest, for scientific or historical research or for statistical purposes,
b) appropriate technical and organisational measures are implemented to ensure that only the data of the individual needed for the purpose in question are filed. If, for example, the marital status of the beneficiary does not serve the purpose, the relevant data will be deleted;
c) appropriate technical and organisational measures will be implemented which will no longer allow the identification of the beneficiary (e.g. replacing the name of the beneficiary with a number).
WHAT ARE THE RIGHTS AND OBLIGATIONS OF THE RIGHTSHOLDERS IN RELATION TO THE PII
Right of access: every data subject has the right to request access to all personal data processed by the data controller and relating to him/her. However, OAY also has the right to make reasonable administrative charges if the data subject makes repeated access requests.
To avoid this, each request must be clear and specify what kind of processing the data subject wishes to undergo.
Right to rectification: Through the Portal, the data subject has controlled access to his/her file so that he/she can make specific modifications: Changes to contact preferences, contact details or hiding parts of his/her medical history
If a beneficiary wishes to correct any errors in his/her personal data, e.g. medical data entered by a provider, then he/she can submit a request with the relevant evidence. In this case, no fee is charged by the Agency. The above amendments are, of course, subject to the Agency, which has the responsibility to decide whether to approve them to become part of the Beneficiary Record. Once this is done, the information contained in the File is accessible to the Agency and to those persons/agencies that have the right of access.
Right of restriction: In addition, beneficiaries have the right to request a restriction on the processing of their data by the Agency under certain conditions. If a data subject wishes to request the exercise of one or more of the above, he or she may contact the Data Protection Officer at dpo@hio.org.cy.
An e-mail requesting the exercise of a right shall not be considered as a simultaneous consent to the processing of the data subject's personal data.
What the request must meet:
- A clear statement of the right the beneficiary wishes to exercise
- The reason for requesting it
- The date and signature of the requestor
- A digital scanned copy of a valid ID card proving the identity of the requestor
If the request meets the above requirements and proves to be valid, the Agency will process it as soon as possible and no later than thirty (30) days after receipt of the request.
The OIA is constantly vigilant so as to ensure a high level of protection of the personal data of GIS beneficiaries. Moreover, the Agency regularly consults with the Office of the Commissioner for Personal Data Protection on a regular basis, taking relevant instructions and decisions in order to ensure the lawful processing in all phases of the operation of the GIS of personal data.
In conclusion, the Agency, as a public entity that collects and manages a large amount of personal data, is obliged to comply with the provisions of the European General Data Protection Regulation. However, in addition to the legal obligation, the protection of beneficiaries' personal data is part of the ethical values on the basis of which the Agency operates and, as such, respect for privacy and protection of personal data have been established as part of its overall organisational culture.
(MB/EXP)
Contents of this article including associated images are owned by PIO
Views & opinions expressed are those of the author and/or PIO
Source
