Estonia plans to require court approval for access to people's health data without their consent, but two bills proposing changes to the rules appear to contradict each other.
Current law allows health data to be disclosed without consent to establish the facts in criminal or other offense proceedings, however the chancellor of justice has said the provision is too broad and needs to be clarified.
Now the Ministry of Justice and Digital Affairs and the Ministry of Social Affairs have drafted separate bills, dubbed the Pakosta and Joller bills after the ministers involved.
Social Affairs Minister Karmen Joller (Reform) said her bill would merge three major health databases: the prescription and treatment-billing databases under the Estonian Health Insurance Fund (EHIF) and the centralized national health information system managed by the Health and Welfare Information Systems Center (TEHIK).
"It does not directly address how data is disclosed or when consent is needed or not," she noted.
The Pakosta bill, by contrast, sets conditions for officials to access health data, Joller added.
Attorney Carri Ginter warned that the Joller bill would essentially expand health data access while the Pakosta would sharply restrict it.
"I can't imagine the Riigikogu simply approving and rubber-stamping both government bills, because that would leave us with both very broad access to health data and an extremely narrow version of access at the same time," he said.
Joller explained regardless that under the planned changes, investigative authorities would need court approval to obtain health data without a person's consent.
"Until now, authorities have requested data not only from health databases but also directly from healthcare providers, such as hospitals and family doctors' offices," the minister said. "Going forward, healthcare providers will only be able to release such data under court order or with court approval."
Other agencies welcome greater clarity
Roger Kumm, head of the Prevention and Criminal Proceedings Bureau at the Police and Border Guard Board (PPA), said police support clearer rules.
What law enforcement needs, he said, is clarity on what police can request and in what cases — including "whether in criminal proceedings specifically or in offense proceedings more broadly, since some drug offenses are misdemeanors."
Health data can also serve as evidence in traffic collision investigations, Kumm continued.
"If someone is injured in a traffic collision, that is evidence in the proceedings and police process that kind of data too," he explained.
TEHIK director Margus Arm also welcomes clearer rules, saying the center would follow any new legal safeguards.
"Once additional safeguards are in place, we will act in accordance [with the law]," Arm said.
He said TEHIK has recently received numerous inquiries about the use of health data, but noted that people can most easily review their own data through the national Health Portal (Terviseportaal).
--