Handles health records, in Germany

Gendiagnostikgesetz (GenDG) vom 31. Juli 2009 (BGBl. I S. 2529, 3672), as amended · Read the law's page

• If you are a physician, or a laboratory a physician commissions, and you carry out a genetic examination or analysis, obtain the person's express written consent before the examination or the taking of the sample, after you have explained its nature, significance and scope and allowed reasonable time to decide (GenDG Sections 8 and 9).
• Keep the results of a genetic examination or analysis in the examination records for ten years, destroy them without delay once that period ends or where the person decided they are to be destroyed, and destroy a genetic sample without delay once it is no longer needed for its purpose or consent is withdrawn (Sections 12 and 13).
• If you are an insurer, do not demand a genetic examination or analysis, and do not demand, accept or use the results of earlier ones, before or after the contract, except for the results-based bar in life, occupational disability, earning-capacity and care annuity insurance above EUR 300,000 of benefit or EUR 30,000 of annual pension (Section 18).
• If you are an employer, do not demand a genetic examination or analysis of an employee, or demand, accept or use the results of earlier ones, before or after the employment begins, and do not disadvantage anyone because of their own or a relative's genetic characteristics (Sections 19 and 4).

Fünftes Buch Sozialgesetzbuch (SGB V), §§ 303e Abs. 3 bis 5, 363 Abs. 2 bis 4 und 399 Abs. 1 Nr. 1 und 2 · Read the law's page

• If you are the Research Data Centre, supply the data an entitled user requests anonymized and aggregated, and supply pseudonymized individual records only without visible pseudonyms, with a temporary working number, for processing under your control (SGB V Section 303e, paragraphs 3 and 4).
• If you use data made accessible by the Research Data Centre, use it only for the purposes for which it was made accessible and do not pass it to third parties unless the Research Data Centre approves (Section 303e, paragraph 5, sentence 1).
• Take care not to establish a reference to persons, care providers or payers when you process the data, and report a reference established by accident to the Research Data Centre without delay (Section 303e, paragraph 5, sentences 2 and 3).
• Do not process the data to establish a personal reference, to identify care providers or payers, or to gain knowledge of third parties' trade secrets (Section 303e, paragraph 5, sentence 4).
• If you are responsible for processing in the electronic patient record, pseudonymize and encrypt the data to be transmitted to the Research Data Centre, send only data that was reliably and automatically pseudonymized, and give it a working number (Section 363, paragraphs 2 and 3).

Gesundheitsdatennutzungsgesetz (GDNG), §§ 1, 6-9 · Read the law's page

• If you operate a health care facility that further processes health data it stores lawfully under GDPR Article 9(2)(h) or (i) for quality assurance, patient safety, research or statistics, pseudonymize the data, anonymize it as soon as the purpose allows, and delete it no later than 30 years after the further processing began (GDNG Section 6, paragraph 1).
• If several people work in the facility, create a rights and roles concept so that only authorized persons can further process the data and each further processing is logged (Section 6, paragraph 1).
• Do not pass the personal data to third parties unless the data subject has consented or a federal, state or EU law provides for it (Section 6, paragraph 3).
• Inform the public in clear and simple language of the purposes for which you further process data, and tell a data subject on request the nature, extent and purpose of the processing for research or statistics (Section 6, paragraph 4).
• If you use health data made available for scientific research, use it only for the purposes for which it was made accessible, do not pass it to third parties, and do not process it to establish a link to a person or to identify care providers or payers (Section 7, paragraphs 1 and 2).
• If a research project processes health data under this Act without the data subjects' consent, register the project in a primary register for clinical trials recognized by the World Health Organization before the processing starts where such a register allows it, and publish the results in anonymized form within 24 months of the project's end (Section 8).

Fünftes Buch Sozialgesetzbuch (SGB V), § 64e Abs. 11a und 11b · Read the law's page

• If you are the platform operator, provide pseudonymized individual records only for processing under your control, only to persons bound to secrecy or committed to it beforehand, and only with measures that prevent the data from being copied (SGB V Section 64e, paragraph 11a).
• If you use data made accessible under the genome sequencing model project, use it only for the purposes for which it was made accessible and do not pass it to third parties unless the platform operator approves (Section 64e, paragraph 11b, sentence 1).
• Take care not to establish a reference to persons or care providers when you process the data, and report a reference established by accident to the platform operator without delay (Section 64e, paragraph 11b, sentences 4 and 5).
• Do not intentionally process the data to establish a personal reference, to identify care providers or to gain knowledge of third parties' trade secrets, except for the case identification by the trust centre that paragraph 9c names (Section 64e, paragraph 11b, sentences 6 and 7).