Patient, client and prescription data stored in the Kanta Services must have an active data controller who is responsible for the maintenance, storage and management of the data in their register. If there are changes to the organisation, for example, due to a company acquisition or a change in the company’s legal framework, the data controller information must also be updated. The service providers affected by the change will plan the change of controller together and agree who will be responsible for the required actions.
A change of controller occurs when the new controller continues to operate and use the data for client and patient work. The extent to which the data will be transferred to the new register is agreed between the new and the previous controller.
In the change, the management of the data and access to the data it contains will be transferred to another service provider. The new controller can retrieve data from the register in question from Kanta, just as it can with any other piece of its data.
Key concepts in the change of controller
A service provider is an operator who organises or provides social welfare services, healthcare services or joint social welfare and healthcare services. In public social welfare and healthcare services, service providers include, for example, wellbeing services counties. In private social welfare and healthcare services, the service provider can be a company, an independent healthcare professional or an association.
If the service provider is responsible for providing a social welfare or healthcare service, it is also the controller of data generated in its activities.
The controller is the social welfare and healthcare service provider who is responsible for processing the personal data in the register.
The controller is responsible for ensuring that
- data are stored securely
- data are correct
- data are processed in accordance with the law
- clients can check their data.
In public social welfare and healthcare services, the controller is the public authority that organises the services. For example, it could be a wellbeing services county.
In private social welfare and healthcare services, the service provider with whom the client has concluded a contract for the provision of the service is the controller of client data.
If the social welfare or healthcare service is provided on behalf of another service provider (for example, as an outsourced service), the data is stored in the data file of the service provider who is responsible for organising the service.
In occupational healthcare services, the controller is either the service provider with whom the employer has made a contract to provide occupational healthcare services or the employer who organises occupational healthcare services for its personnel itself.
A register is a data set containing structured personal data from which information is available on a specific basis. In this context, a register refers to registers of social welfare and healthcare client data.
A social welfare and healthcare service provider records the client data generated in its activities in the following registers:
- to the patient data register, in the case of patient data
- to the social welfare service client data register, in the case of social welfare service client data
- in the occupational healthcare data register if the service provider organises the occupational healthcare services of its staff itself.