Access to, correction and permanent deletion of health data
Article
|Published
The Norwegian Institute of Public Health (NIPH) processes health data in connection with the maintenance of health registries, consent-based health surveys and research projects. Strict rules apply to the processing of such data.
NIPH is obliged to provide general information about the health registries for which it acts as controller. Research administrators, project managers and data managers in health surveys and research projects at the NIPH must also ensure transparency about the use of health data and research. As a private individual, you will generally be entitled to know what data has been registered about you, and you will also have a right to access the data.
Duty of confidentiality
Health data are special categories of personal data, and a strict duty of confidentiality applies to anyone who uses health data. Only those who need access to confidential information as part of their professional duties will be given access. The duty of confidentiality regarding health data entails both a duty not to disseminate information and an active obligation to prevent others from gaining access to confidential information. The Personal Health Data Filing Act also contains a provision which prohibits the unlawful acquisition of health data.
The rights of data subjects in central health registries
- You have the right to information and access
You have the right to know what type of processing of health data is used by the NIPH in health registries; see Section 24 of the Personal Health Data Filing Act and Section 16 of the Personal Data Act. Furthermore, you have the right to access data registered about you in statutory health registries, such as the Norwegian Immunisation Registry SYSVAK and the Medical Birth Registry of Norway. You are also entitled to be told who has accessed or obtained health data linked to your name or national ID number. The data must be provided free of charge and in an understandable form. NIPH's resident services at helsenorge.no provide electronic access to a number of health registries. If no provision is made for access via helsenorge.no, you can download the form to apply for access. You will then be entitled to a reply within 30 days after NIPH receives the form. Download the application for access form. - You may ask for data to be corrected
It is important that the health registries contain accurate and complete information, and NIPH allocates substantial resources to the quality assurance of information. If you believe that data that have been registered about you are incorrect or incomplete, you can ask for it to be corrected; see Section 17 of the Personal Data Act and Articles 16 and 18 of the General Data Protection Regulation. If this is the case, contact the Data Protection Officer at the NIPH. - You can ask for data that you consider to be strongly distressing to be permanently deleted or blocked
If you consider data that have been registered about you to be very distressing, you can ask for them to be blocked or permanently deleted; see Section 25 of the Personal Health Data Filing Act, Section 17 of the Personal Data Act and Articles 16 and 18 of the General Data Protection Regulation. If this is the case, contact the Data Protection Officer at the NIPH.
The rights of data subjects in health surveys and research projects
- You have the right to information and access
You are entitled to know what type of processing of personal data is used by NIPH in consent-based health surveys and research projects; see Section 16 of the Personal Data Act. You also have the right to access information that has been registered about you in health surveys and research projects; see Article 18 of the Personal Data Act and Section 40 of the Health Research Act. However, there are some exceptions to the right of access; see Section 42 of the Health Research Act. - You may ask for data to be corrected
If you believe that data registered about you in consent-based health surveys and research projects are inaccurate or incomplete, you can ask for them to be corrected; see Section 17 of the Personal Data Act and Articles 16 and 18 of the General Data Protection Regulation. If this is the case, contact the project leader for the research project concerned or the Data Protection Officer at the NIPH. If it concerns the Norwegian Mother, Father and Child Cohort Study, send an e-mail to morbarn@fhi.no - You can withdraw your consent at any time
You may withdraw your consent to participate in health surveys or research projects at any time and without giving a reason; see Section 16 of the Health Research Act. If this is the case, contact the project leader for the research project concerned or the Data Protection Officer at the NIPH. If it concerns the Norwegian Mother, Father and Child Cohort Study, send an e-mail to morfarbarn@fhi.no The controller will then ensure that your health data are erased or disclosed to you and any biological material is destroyed. - You have the right to have information permanently deleted
Your right to have your information permanently deleted from health surveys and research projects is governed by the Personal Data Act (Article 17), with the exceptions and limitations that follow from the same provision, as well as the Health Research Act (section 36) and the regulations for Population-based Health Studies (section 2-5, cf).
The rights of patients to opt out of biological research
The Regional Committees for Medical and Health Research Ethics may decide that human biological material (blood samples, tissue samples, etc.) collected by the health and care services as part of diagnosis and treatment may or must be used for research purposes without the patient's consent. This can only happen if the research is of significant interest to society and consideration for the welfare and integrity of the participants has been addressed. The Regional Committees for Medical and Health Research Ethics may impose conditions for its use. The patient must be informed in advance that human biological material may be used for research purposes and must be given the opportunity to opt out of the research.
- Opt out of research on your biological material
As a patient, you can refuse to allow your biological material collected by the health and care services in connection with your diagnosis or treatment to be used for medical and health research purposes; see Section 28 of the Health Research Act.
More about the opt-out scheme.
Opt-out form.
