27.11.2018
1.1 What is eHealth Digital Service Infrastructure?
The eHealth Digital Service Infrastructure (eHDSI) provides to health care professionals safe and easy access to medical data of the residents of the EU by electronic means - anytime and anywhere within the EU, respecting the will and rights of the person.
This is done through a secure gateway provided by a National Contact Point for eHealth (NCPeH) designated by each country. Estonian NCPeH is Health and Welfare Information Systems Centre.
Each organization designated as NCPeH assumes the responsibility as a data processor for collection, storage, transfer and other processing activities of the data.
This also means that your personal data is recorded, transferred and stored in accordance with the Estonian law - Medicinal Products Act (§ 33) and Health Services Organisation Act (chapter 32).
This document describes your personal health data and processing activities when you want to buy out in Estonian pharmacy an electronic prescription issued to you in your home country.
1.2 The categories of your personal health data concerned
Electronic prescription and dispensation - you can get prescription of medicine from a healthcare professionals in your country of affiliation and receive medication through a pharmacy in Estonia. The electronic prescription contains essentially the same information as a regular paper prescription, i.e. identification of the doctor, the patient and the medicine prescribed. The electronic dispensation includes the information about medicine dispensed.
This information is available in so far as your personal data is already recorded in electronic form in your country of affiliation.
1.3 What is the purpose of processing?
Your electronic prescription data will only be used to provide you medicines and may also be used for statistics and research in order to improve the quality of public health in Estonia according to Personal Data Protection Act (§ 16).
Data can also be used in case it is necessary to perform other tasks e.g problem solving or supervision.
For secondary purposes, the participating EU Member States have committed to put in place appropriate technical and organisational safeguards such as de-identification of personal data where necessary.
1.4 Who processes and has access to this data? (recipients of personal data)
Your personal data will be accessible only by authorized and identifiable pharmacists involved in your provision of medicine under professional secrecy in Estonia. Health proffesionals duty to maintain confidentiality is provided in the Law of Obligations Act (§ 768) and Health Services Organisation Act (§ 41).
When the data is transferred to another EU country through eHDSI, each of the recipients of the data assumes responsibility for the processing of such data within their scope of data processing activities. The recipients of the data who assume such responsibilities are:
- The pharmacy where you receive your prescribed medicine
- The NCPeH in the country to which the data is transferred
The data will be transferred through a secure gateway provided by the NCPeH designated by each country.
https://www.tehik.ee/ehealth/crossborder
1.5 What kind of personal data is processed?
In Estonia following data is processed when you want to buy out medicine prescribed in your country of affiliation:
Prescription data (prescription number, issue date)
- Patient identification ( given name. family name/surname, gender, birth date, regional/national health Id)
- Prescriber health professional (HP) identification (given name, family name/surname, HP Id number, specialists profession, prescriber facility address, prescriber organization)
- Prescribed medicine data (brand name, anatomical therapeutic chemical (ATC) classification system code and name, active ingredient(s), strength of the medicinal product, medicinal product package type and size, number of packages, pharmaceutical dose form, route of administration, posology, begin date of treatment, end date of treatment, instructions to patient, advice to dispenser, substitution allowance)
Dispensation data
- Patient Identification (given name, family name/surname, regional/national health Id)
- Dispenser identification (given name, family name/surname, pharmacist Id number, dispenser facility (pharmacy) id number, pharmacy organization)
- Dispensed medicine (Estonian medicinal product code, medicine name, ATC code and name, active ingredient(s), strength of the medicinal product, pharmaceutical dose form, route of administration, medicinal product package size, number of packages, dispensation date, prescription number, substitution)
1.6 Where and how long is the personal data stored?
Your personal data may be stored in pharmacy and data processing logs will be stored in eHDSI Contact Point. According to Ministry of Social Affairs regulation “The composition of the data processed through the cross-border data exchange platform, the organization of the exchange of data and the deadline for maintaining the logs” (§ 92) the storage period of your data at Estonian eHDSI Contact point is 7 years.
1.7 Your access rights
In case you do not allow your personal data to be processed by eHDSI, it means your data will not be available for your dispensation of medicine through this system when you are in another EU country.
In case you do allow your personal data to be processed by this system, you can have access to data stored about you in Estonia by sending a request to Estonian Ministry of Social Affairs.
Finally, you have the right to lodge a complaint with a supervisory authority in either in your country of residence or the country of medicine dispensation, depending on the factual situation. The supervisory authority in Estonia is Estonian Data Protection Inspectorate. Contact details to the supervisory authorities in the EU Member States.
Contact details
- data processor : Health and Welfare Information Systems Centre
- data controller : Ministry of Social Affairs
- data protection officer at data controller
- supervisory authority : Estonian Data Protection Inspectorate