What is eHealth Digital Service Infrastructure?
The eHealth Digital Service Infrastructure (eHDSI or eHealth DSI) enables safe and easy access to medical data for health care professionals involved in treatment or provision of medicines.
This infrastructure provides the health care professionals access to medical data for the residents of the EU, by electronic means - anytime and anywhere within the EU.
This is done through a secure gateway provided by a National Contact Point for eHealth (NCPeH) designated by each country.
Each organization designated as NCPeH assumes the responsibility as a data controller for collection, storage, transfer and other processing activities of the data in its medical registry.
This also means that your personal data is recorded, transferred and stored in accordance with the law of the country of treatment.
What are the categories of your personal health data concerned?
- Patient summary – your basic medical data set is collected from your country of affiliation in order to enable you to receive treatment in another EU country. The patient summary includes information on important patient data such as allergies, current medication, previous illnesses and surgeries that are necessary to treat you properly abroad.
- Electronic prescription and dispensation - you can get prescription of medicine from a healthcare provider in your country of affiliation and receive medication through a pharmacy in another EU country. The electronic prescription contains essentially the same information as a regular paper prescription, i.e. identification of the doctor, the patient and the medicine prescribed. The electronic dispensation includes the medicine dispensed.
The information is available in so far as your personal data is already recorded in electronic form in your country of affiliation.
What is the legal basis for the use of your personal data?
When you receive treatment or medicine abroad, your data will be recorded in the country of treatment according to the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), the laws of that country and the practices of the particular healthcare provider.
What is the purpose of processing?
Your medical data will only be used for your medical treatment or for the provision of medicines.
However, in some EU countries this personal data may also under certain conditions be used for other purposes prescribed by law, such as statistics, monitoring and research in order to improve the quality of public health.
For these secondary purposes, the participating EU Member States have committed to put in place appropriate technical and organisational safeguards such as de-identification of personal data where necessary.
Other than your treatment, in Portugal your personal data may only be used for the secondary purposes provided for in articles 5.º/1/b) and 89.º of the General Data Protection Regulation.
Who processes and has access to this data?
Your personal data will be accessible only by authorized and identifiable health professionals involved in your treatment or in the provision of medicine under professional secrecy in the country of treatment.
Each of these has undertaken to ensure that the participating health professionals (including physicians, nurses, pharmacists and other health professionals relevant for cross-border medical data exchange) and healthcare providers on their territory have adequate information and training about their duties.
When the data is transferred to another EU country through eHDSI, each of the recipients of the data assumes responsibility for the processing of such data within their scope of data processing activities. The recipients of the data who assume such responsibilities are:
- The healthcare organisation where you receive your treatment;
- The pharmacy where you receive your prescribed medicine;
- The NCPeH in the country to which the data is transferred;
Please refer to the eHDSI website (ec.europa.eu, the site is being updated) for the participating EU Member States. The data will be transferred through a secure gateway provided by the NCPeH designated by each country.
What kind of personal data is processed?
More detailed information about the different kinds of data that are processed when you receive treatment or medication in the country of treatment can be found here:
Patient Summary:
- Identification of the foreign patient
- Allergies
- Medication
- Diagnosis and diseases
- Surgeries and procedures
- Other health data provided by the country of affiliation in its patient summary
ePrescription (eP) / eDispensation (eP):
- Identification of the foreign patient
- List of active prescriptions for the foreign patient
- Prescription to be dispensed by the Portuguese pharmacy
- Communication of dispense to the country of treatment
Where and how long is the personal data stored?
The collected personal data may be stored in information systems of the health institutions both in your country of affiliation and the country of treatment. The data shall be stored for no longer than is necessary for the purpose for which it is processed. The storage periods applicable in Portugal are those defined by national legislation and by any authorizations previously issued by the national data protection authority under Law nr. 67/98, April 26th.
The actual storing period in other Member States may vary. More specific information about the storing periods in Member States is available on the eHDSI website. (ec.europa.eu, the site is being updated)
Longer periods may only be used for archiving and scientific or historical research where particular privacy safeguards are in place (such as anonymization).
Your access rights
In case you do not allow your personal data to be processed by eHDSI, it means your data will not be available for your treatment or for the dispensation of medicine through this system when you are in another EU country.
In case you do allow your personal data to be processed by this system, you can have access to it in the context of your treatment or dispensation of medicine, or otherwise by sending a request to Centro de Contacto do Serviço Nacional de Saúde (SNS), through the e-mail address atendimento@sns24.gov.pt or by phone 808242424.
Such access to your personal data may also be requested to the relevant healthcare organisation in your country of affiliation and, as the case may be, to the healthcare professional (including physicians, nurses, pharmacists and any other health professionals involved in the cross-border data exchange) in the country of treatment.
You also have the right to object or request the restriction of processing and the right to rectify and get your personal data erased without undue delay as well as a right to data portability, if applicable.
Finally, you have the right to lodge a complaint with a supervisory authority in either your country of residence or the country of treatment, depending on the factual situation.
The Portuguese national data protection authority is Comissão Nacional de Protecção de Dados, which can be reached through the following contacts:
Comissão Nacional de Protecção de Dados
Av. D. Carlos I, 134 - 1.º, 1200-651 Lisboa, Portugal
Telephone: (+ 351) 21 392 84 00
Fax: (+ 351) 21 397 68 32
e-mail: geral@cnpd.pt
Contact Details
Data Controller:
SPMS – Serviços Partilhados do Ministério da Saúde, E.P.E.
Avenida da República, 61, 1050-189 Lisboa
e-mail: secretariado@spms.min-saude.pt
Telephone: 211 545 600
Data Protection Officer:
e-mail: dpo@spms.min-saude.pt
Telephone: 211 545 600
