Menu

Filter by
content
PONT Data&Privacy

0

Keep the medical record longer for the sake of third-party interests and for scientific research

In the first article of this triptych it was discussed that a so-called "non-medically substantive last amendment to the medical file" cannot result in the file being allowed or required to be kept longer than the standard period of 20 years. Renewal under the regulation of Article 7:454(3) of the Civil Code is only applicable when there are medical-substantive reasons for doing so that concern the patient.

September 20, 2024

Read the first part of this series here: The medical record: some retention issues

Information Publications

In various information publications from agencies such as the Personal Data Authority and the Ministry of VWS (AVG Care Help Desk, Welfare and Sports and Central government: .../ your medical records) states that medical records may 'sometimes' be kept longer for the benefit of the interests of a third party. This includes indicating that this would then include, for example, the patient's children when the patient has a hereditary disease.

Based on this information, the conclusion could be drawn that from the storage arrangement of the WGBO follows that said interests may constitute grounds for keeping the medical record longer than the standard retention period. But only the 'nullification article' 7:455 BW contains a regulation on the longer retention of the file in the interest of third parties. Indeed, the patient's request to destroy the file may be refused if it is reasonably plausible that the retention is of eligible interest to someone other than the patient.

Article 7:455(2) BW.

The legal regulation on the medical treatment agreement

Book 7, Title 7, Section 5.

, commonly referred to as WGBO

Medical Treatment Agreement Act.

, does not contain a general stipulation that the file may be kept longer for the interests of someone other than the patient. After all, the aforementioned "retention article" 7:454 (3) of the Dutch Civil Code, only mentions good care providership as a reason to keep the file longer, and this concept, given the nature and content of the medical treatment agreement, refers to the patient-provider relationship.

This follows from the coherence of article 7:446 paragraph 1 BW and article 7:454 paragraph 1 BW. See also below, paragraph 1.



But of course, said interests may arise both in the context of a destruction request and as the end of the retention period approaches.

Therefore, with a view to proper data processing and retention practice, it is appropriate to address the matter more precisely below than in the - apparently simplified - information publications and answer the following question:

Outside the situation of a request for destruction and outside the case where it is necessary for medical reasons, when and for what interests may records be kept beyond the standard 20-year period?

Law explanation; longer retention for third parties/relatives?

That the WGBO contains no general provision on the basis of which, in the interest of others than the patient, the file may be kept longer than the retention period, is apparently a deliberate choice of the legislator. Indeed, the Explanatory Memorandum does mention these interests, but only in the context of destruction. No words are devoted to a longer retention period for others than the patient.

Parliamentary Papers II 1989/1990, 21561, no. 3

According to the Health Council, which published a thorough analysis of the retention period and regulations of the WGBO in 2004, it is clear from the wording of the provisions concerning the file and retention obligation that these relate to the person from whom the data have been obtained, for the patient's own health interests, i.e. the patient himself. Good care providership under Article 7:453 of the Civil Code relates exclusively to them. 'A possible health interest of relatives has the character of a "third party interest", which in principle offers no ground for longer retention'.

Health Council. Patient data retention period. The Hague: Health Council of the Netherlands, 2004; publication no. 2004/08, p. 72

In the subsequent 2006 legislative amendment that changed the record retention period from 10 to 15 years, the legislature took this analysis as its starting point.

Parliamentary Papers II, 2004/2005, 30049, no. 3, p. 3.

And with regard to the later extension of the retention period from 15 to 20 years, the legislature noted that it was intended solely to serve the patient's own interests. In short, it follows from the statutory retention rule and legislative history that the medical record is not for the benefit of relatives

The Health Council indicates that even if such a retention requirement did apply, it should be the interests of identifiable relatives and not the potential interest of future family members. Ibidem, p. 73.

of the patient, such as in connection with hereditary diseases

Third interests could include, for example, non-disease-related heredity or parentage questions.

, may be kept longer than the standard 20-year period. The KNMG Guideline on Dealing with Medical Data (the Guideline) is consistent with this conclusion.

KNMG Guideline on Handling Medical Data, KNMG, 2024, chapter 8.



Because relatives may also have an interest in having the patient's medical record retained for a longer period of time at the end of the retention period, the recommendation should

By adding in paragraph 3 of article 7: 454 BW that medical records must be kept as long as a person other than the patient has a compelling health interest in doing so

from the 2004 Health Council to make that legal and to equalize the retention and destruction regulations on that point

Health Council, ibidem, p. 95.

, should finally be seriously considered in the next amendment of the WGBO.

Keep longer for scientific research? Anonymize?

On the basis of an interpretation of good care providership, the Health Council concludes that the retention regulations in the WGBO do not allow for longer retention of medical records for the purpose of scientific research either. The fact that scientific research is necessary to provide good care to patients does not mean that keeping medical records longer for that general purpose also constitutes good care for the patient in question.

Health Council, ibidem, p. 74.



Information Publications

In various information publications from agencies such as the Personal Data Authority and the Ministry of VWS (AVG Care Help Desk, Welfare and Sports and Central government: .../ your medical records) states that medical records may 'sometimes' be kept longer for the benefit of the interests of a third party. This includes indicating that this would then include, for example, the patient's children when the patient has a hereditary disease.

Based on this information, the conclusion could be drawn that from the storage arrangement of the WGBO follows that said interests may constitute grounds for keeping the medical record longer than the standard retention period. But only the 'nullification article' 7:455 BW contains a regulation on the longer retention of the file in the interest of third parties. Indeed, the patient's request to destroy the file may be refused if it is reasonably plausible that the retention is of eligible interest to someone other than the patient.

Article 7:455(2) BW.

The legal regulation on the medical treatment agreement

Book 7, Title 7, Section 5.

, commonly referred to as WGBO

Medical Treatment Agreement Act.

, does not contain a general stipulation that the file may be kept longer for the interests of someone other than the patient. After all, the aforementioned "retention article" 7:454 (3) of the Dutch Civil Code, only mentions good care providership as a reason to keep the file longer, and this concept, given the nature and content of the medical treatment agreement, refers to the patient-provider relationship.

This follows from the coherence of article 7:446 paragraph 1 BW and article 7:454 paragraph 1 BW. See also below, paragraph 1.



But of course, said interests may arise both in the context of a destruction request and as the end of the retention period approaches.

Therefore, with a view to proper data processing and retention practice, it is appropriate to address the matter more precisely below than in the - apparently simplified - information publications and answer the following question:

Outside the situation of a request for destruction and outside the case where it is necessary for medical reasons, when and for what interests may records be kept beyond the standard 20-year period?

Law explanation; longer retention for third parties/relatives?

That the WGBO contains no general provision on the basis of which, in the interest of others than the patient, the file may be kept longer than the retention period, is apparently a deliberate choice of the legislator. Indeed, the Explanatory Memorandum does mention these interests, but only in the context of destruction. No words are devoted to a longer retention period for others than the patient.

Parliamentary Papers II 1989/1990, 21561, no. 3

According to the Health Council, which published a thorough analysis of the retention period and regulations of the WGBO in 2004, it is clear from the wording of the provisions concerning the file and retention obligation that these relate to the person from whom the data have been obtained, for the patient's own health interests, i.e. the patient himself. Good care providership under Article 7:453 of the Civil Code relates exclusively to them. 'A possible health interest of relatives has the character of a "third party interest", which in principle offers no ground for longer retention'.

Health Council. Patient data retention period. The Hague: Health Council of the Netherlands, 2004; publication no. 2004/08, p. 72

In the subsequent 2006 legislative amendment that changed the record retention period from 10 to 15 years, the legislature took this analysis as its starting point.

Parliamentary Papers II, 2004/2005, 30049, no. 3, p. 3.

And with regard to the later extension of the retention period from 15 to 20 years, the legislature noted that it was intended solely to serve the patient's own interests. In short, it follows from the statutory retention rule and legislative history that the medical record is not for the benefit of relatives

The Health Council indicates that even if such a retention requirement did apply, it should be the interests of identifiable relatives and not the potential interest of future family members. Ibidem, p. 73.

of the patient, such as in connection with hereditary diseases

Third interests could include, for example, non-disease-related heredity or parentage questions.

, may be kept longer than the standard 20-year period. The KNMG Guideline on Dealing with Medical Data (the Guideline) is consistent with this conclusion.

KNMG Guideline on Handling Medical Data, KNMG, 2024, chapter 8.



Because relatives may also have an interest in having the patient's medical record retained for a longer period of time at the end of the retention period, the recommendation should

By adding in paragraph 3 of article 7: 454 BW that medical records must be kept as long as a person other than the patient has a compelling health interest in doing so

from the 2004 Health Council to make that legal and to equalize the retention and destruction regulations on that point

Health Council, ibidem, p. 95.

, should finally be seriously considered in the next amendment of the WGBO.

Keep longer for scientific research? Anonymize?

On the basis of an interpretation of good care providership, the Health Council concludes that the retention regulations in the WGBO do not allow for longer retention of medical records for the purpose of scientific research either. The fact that scientific research is necessary to provide good care to patients does not mean that keeping medical records longer for that general purpose also constitutes good care for the patient in question.

Health Council, ibidem, p. 74.

There may even be the opposite.

From my own practice as a hospital lawyer, I recall the destruction request of a patient who wanted the designation "mentally unstable" removed from the record. She indicated that this no longer applied to her v There may even be evidence to the contrary.

From my own practice as a hospital lawyer, I remember a patient's request to have the designation "mentally unstable" removed from the file. She indicated that this no longer applied to her, but that this designation caused the cause of her physical complaints to be wrongly sought on the psychological plane. As a result, there had been a late correct diagnosis.

It also follows from the content and nature of the medical treatment agreement. Pursuant to Article 7:446(1) of the Civil Code, the care provider has undertaken to perform "acts in the field of medicine, directly related to the patient. The medical treatment agreement is a species of assignment agreement, which means that the care provider has to comply with the specifically formulated assignment mentioned.

Asser/Tjong Tjin Tai 7-IV 2022/83

In my opinion, this is not met when the medical file is kept (longer) for a purpose other than medical treatment concerning the patient, such as scientific research. And because retention for a longer period of time carries additional privacy risks for the patient, however theoretical they may be, the caregiver would not meet the standard of good caregiver conduct for that reason either.

Article 7:453 BW.

Thus, it also does not follow from the legal retention regulationsthat medical records may be kept for the purpose of scientific research longer than the standard 20-year period. The Directive does not comment on this issue.

Of course, the patient can be asked for permission to keep the medical record for a longer period of time for the purpose of scientific research. And in the event that the scientific research is actually going to take place, permission for disclosure of the medical data to the researchers, i.e. for breach of professional secrecy, will also have to be requested. But this will (may) happen simultaneously in practice. The next question is how long these data may be kept for the purpose of any scientific research after the standard period has expired. In general, this period should be limited under the AVG to that which is necessary in view of the possible scientific research.

Article 5(1)(c) AVG.

Problem with this, however, is that sometimes it is only with the passage of time based on advancing insight that it becomes clear that data are relevant to a medical examination.

Cf. Health Council, ibidem, p. 64.

In view of this phenomenon inherent to (medical) science, should, as the Health Council advocates, long retention periods be chosen by default?

Health Council, ibidem, p. 91



Another case concerns Section 7:458 of the Dutch Civil Code, under which, under certain conditions, information about the patient or access to the medical file may be provided without the patient's consent for the purpose of scientific research in the field of public health. Now, providing information about the patient and allowing access to the file are two different matters. In the first case, medical data are copied from the medical record and stored elsewhere in a specific research file. In the second case, the data remain in the file, but an investigator is granted access to the file.

There are several advantages and disadvantages to both situations from an information security perspective.

The data stored in the examination file do not fall under the description of Article 7:454 (2) of the Civil Code regarding the medical file and are therefore not part of it. With respect to this data, a specific, for the concerning scientific research necessary retention period must be established. 'Concerning'; in particular from article 7:458 paragraph 1 sub b. and paragraph 2 sub b. BW reveal that article 7:458 BW does not constitute a licence to provide patient data for scientific research in the field of public health in general - thus also for future research. After all, the test that must be carried out on the basis of the two paragraphs, 'nature and purpose of the research' and 'the research cannot be carried out without the data in question' respectively, cannot but relate to a specific research.

Thanks to colleague Jantien Hovingh for reading along and for the critical question on this.

The Directive does seem to imply this but could provide more clarity on this.

Data with which scientific research is conducted from the medical record will, of course, remain part of the medical record. Therefore, the question is whether these data may be kept if the retention period of the medical record has expired while the scientific research has not yet been completed. To my knowledge, this question has not yet been answered in case law. Nor does the Directive make any statement on this issue. In my opinion, it follows from the legal principles of reasonableness and fairness that the data used for research may be kept beyond the retention period of the medical file. Obviously only insofar as this is necessary for the specific study and anonymization is not possible.

Neither the legislative history nor the Directive, nor, to my knowledge, case law, answer the questions in the preceding paragraphs. However, the Health Research Code of Conduct written specifically for medical scientific research does state that when determining retention periods of personal data for scientific research, legal retention periods take precedence over other periods.

Health Research Code of Conduct January 2022, Research Regulatory Commission Foundation, COREON, pp. 155 and 156.

Reference is then made to the statutory custody provision of Article 7:454 (3) of the Civil Code.

Since the Code of Conduct does not distinguish according to the type of file in which the investigation takes place and does not tailor the retention period to what is necessary for the investigation in question, the possible consequence, in my view, is that retention periods are used that are not necessary and therefore too long, or indeed too short.

Given the foregoing unanswered questions and the provisions of the Health Research Code of Conduct, I support the recommendation already made in 2004 by the Health Council to establish a separate legal regime regarding the retention of medical data for the purpose of scientific research.

Health Council, ibidem, p. 94.

In today's age of providing health data for international scientific research worldwide

See, for example, Laura Bradford, Mateo Aboy, Kathleen Liddell, International transfers of health data between the EU and USA: a sector-specific approach for the USA to ensure an 'adequate' level of protection, Journal of Law and the Biosciences, Volume 7, Issue 1, January-June 2020, lsaa055, https://doi.org/10.1093/jlb/lsaa055

, information and transparency obligations will also need to pay due attention to this.

Anonymize The Guideline notes that medical data that is anonymized is not subject to a legal retention period and that the retention of anonymized data is especially important for scientific research.

Directive, ibidem, p. 39.



In my view, it is not right to state that medical data/records in general may be anonymized for scientific research. Once there is a legal basis - patient consent, or under Article 7:458 of the Dutch Civil Code - to use medical data for scientific research, they will indeed have to be anonymized as much as possible. But whether in general, during or at the end of the retention period, medical data may be anonymized for scientific research depends on the answer to several questions. Does anonymizing satisfy the mandate to perform medical acts? Does it follow from reasonableness and fairness that it is (nevertheless) allowed or not? After all, there are patients who do not want to cooperate in any way with scientific research. From a privacy law perspective, would there be compatible further use with regard to anonymization so that a new processing basis would not be required? Or, if necessary, could the hospital's legitimate business interests be invoked as a processing basis? It would be going too far to go into this now, but these are questions that I believe should also be answered in the establishment of a separate retention regime for scientific research. For now - a different regime will apply under the EHDS - it should be clear that there is a risk for patients and caregivers when medical data is anonymized for scientific research by default, without patient consent or applicability of article 7:458 BW.

Other cases when the medical record may or should be kept longer.

In the context of the destruction article 7:455 BW, the Directive mentions the interest of the care provider against whom the patient has started legal proceedings as a ground for allowing the file to be kept longer, if the provider needs the file for his defense. This situation may also arise - sporadically - at the end of the retention period. It seems to me to be a matter of reasonableness and fairness that even in such a case the file may be kept for as much longer as is necessary to provide the care provider with the documents needed for the defense. A similar situation arises when next of kin or others request access to the deceased patient's file at the end of the retention period by invoking Article 4:458a of the Civil Code. Here, too, the legal principles of reasonableness and fairness entail that the file is kept after the expiration of the retention period for as long as necessary to deal with the request. The KNMG might consider supplementing the Guideline on these points.

Finally, it is worth mentioning two other cases mentioned in the Directive in which the medical record may be kept longer than the standard retention period. First, this concerns the situation when the law prescribes a longer retention period such as the Archives Act or the Working Conditions Act. Incidentally, a shorter legal retention period may also apply such as under the Medical Examinations Act. The second situation involves the case where the patient requests that the record be kept longer than the retention period. As recently as 2004, the Health Council questioned whether the patient has the right to request this and, if so, whether the basis is the patient's control or good medical practice. Inclusion in the Guideline has established that the patient does indeed have this right

Under Article 7:468 of the Civil Code, it is possible (within the framework of professional guidelines) to interpret the medical treatment agreement in favor of the patient.

and that the basis is in any case good counseling. After all, being a good social worker also implies that the social worker adheres to the professional standard applicable to him or her, and the Guideline is part of that.

Article 7:453 BW.



Share article

Comments

Leave a comment

You must be logged in to post a comment.

KENNISPARTNER

Martin Hemmer