Data entered in the Patient Data Repository can be viewed in My Kanta Pages even after operations have ceased, and it can still be shared with other service providers from the Patient Data Repository. However, only the controller can amend or correct the patient data in the register.
Patient documents entered in the archive of old patient data that are not shown in My Kanta Pages or shared with other service provider can no longer be processed at all after the closure of operations.
The retention times of patient records are provided for in the decree on patient records. There is currently no national legal basis for the transfer of terminated archives or for the controller’s responsibilities after operations have ceased. Controllership is also provided for in the EU’s General Data Protection Regulation.
The Ministry of Social Affairs and Health will further specify the guidelines concerning the archiving of patient data after the closure of operations along with the reform of information management legislation. The reform process will start during 2021, but a more detailed schedule is not known yet.
The controller is responsible for reporting on the closure of controllership and its impacts on the processing of data held in the register. In practice, this may mean, for example, contacting the registered persons or notifying of the matter on the controller’s website.
Data in the register must be retained safely after closure of operations
The estate of a deceased person or a controller who has otherwise closed their operations are instructed to retain the data safely until the reform of the information management legislation.
- In the case of a paper archive, the data can be delivered to Kela.
- If the data is in electronic format, the retention of the data must be agreed on with the system supplier.
The costs of retaining the data are the responsibility of the party who is in possession of the data, for example, the estate of a deceased person or the operator who has ceased operations.
After the closure of operations, the controller has the option of delivering the patient records directly to its clients. This may be a credible option especially in the case of small operators. However, clients are not obligated to receive their own patient records. In such a case, the controller must take care of the safe retention of patient data in other ways.
Archiving of patient data in paper format at Kela
After the closure of operations, it is possible to deliver the data of a paper archive to Kela. Kela started archiving patient records in paper format from healthcare service providers and self-employed professionals at the beginning of 2019. The archiving of the materials is free of charge until further notice.
The archiving service applies to small independent healthcare operators who have ceased operations and who have not transferred the archiving obligation elsewhere. It is not possible to deliver patient records to the archive for temporary storage purposes.
Kela does not accept materials from occupational health care and social welfare service providers for the time being.
Data in the archive of old patient data available only to the controller
When a controller ceases operations, entering of the register data in the archive of old patient data is not a solution for retaining the data. The deployment of the archive of old patient data requires that the Patient Data Repository has been deployed at first.
Patient data can be entered in the Kanta Services to take care of its permanent retention, but the data entered in the archive of old patient data can only be used by the controller. No one else but the controller will have access to the data in the register.
The client will not see their data entered in the archive of old patient data in My Kanta Pages but, if necessary, they need to request the data directly from the controller. If there is no controller, the data cannot be submitted to the patient or other operators.
Moreover, the Kanta Services do not have the right to rectify incorrect data. Only the controller has the right to amend or correct the data in its register.