Protection or violation of privacy? RPO's doubts about monitoring in medical facilities

The Law on Medical Activity, amended in 2023, allows managers of medical entities to use video surveillance also in the premises where health services are provided. Although the goal was supposed to be to increase patient safety, the new regulations have triggered a wave of criticism. The Ombudsman's Office has received complaints from citizens who are concerned about their privacy and the security of their personal information.

Spokesman Marcin Wiącek once again addressed questions and concerns to Health Minister Izabela Leszczyny. As early as July 2024, the ministry responded that monitoring in medical facilities is primarily aimed at protecting patients. However, as the ROP points out, these explanations do not dispel doubts, especially in light of the irregularities uncovered by the Supreme Chamber of Control and the Office for Personal Data Protection.

In its September 2024 report, the NIK revealed that as many as 18% of establishments were using monitoring in violation of regulations - cameras were placed in places where they shouldn't be, and monitoring records were incomplete or unreliable.

Meanwhile, the President of the Office of Data Protection points out that the subject of monitoring in clinics and hospitals is the subject of many complaints and interventions. In his opinion, it is necessary to amend the regulations to clearly define the rules for the use of cameras and ensure the protection of the privacy of patients and staff.

Interpretation doubts have also been raised by the Patient Ombudsman, who has attempted to clarify unclear regulations in a special guide for medical facility managers. The very fact that such a document was issued indicates that the current regulations are not clear enough.

According to the current wording of Article 23a (1) (3) of the Law on Medical Activity, the head of the facility may - without additional legal basis - decide to place cameras in medical premises if he deems it "necessary for the treatment process or patient safety." However, he is to do so "with respect for the intimacy and dignity of the patient." - The wording, according to the ROP, is vague and insufficiently protects patients' rights.

The Ombudsman stresses that all restrictions on the constitutional right to privacy (Article 47 of the Polish Constitution) and the processing of personal data (Article 51) must have a clear and precise statutory basis. The current regulation delegates the decision on monitoring to the internal rules and regulations of establishments - which does not meet constitutional standards.

Marcin Wiącek warns that improperly used monitoring can violate patients' collective rights and expose facilities to financial penalties. Patients can also assert their rights individually, claiming violations of intimacy or dignity.

This issue also affects employees, the ROP reminds us. According to the Labor Code, monitoring can only be used for clearly defined purposes, such as employee safety or property protection. Meanwhile, medical facilities often lack clear rules in this regard.

Therefore, the ROP appeals to the health ministry for urgent legislative action. He calls for clarifying the regulations, defining clear and precise prerequisites for allowing the use of monitoring, and introducing guarantees to protect the privacy and dignity of patients and medical staff. He also asks whether the Health Ministry plans to inspect the rules and regulations in effect at the facilities and compliance with the current, albeit vague, regulations.

Marcin Wiącek expresses the hope that the MZ's actions, responding to the demands of the RPO and PUODO, will contribute to providing patients with due protection of privacy and personal data.

Source: RPO