SpainLey 41/2002, Confidentiality of Patients' Health Data and Security of Clinical Records in Spain
Ley 41/2002, arts. 7, 16 and 17
In force since .
A sensitive categories rule binding public and private bodies.
- Obligation class
- Security, Retention
- Audit expectation
- none
What it requires
- If you run a public or private health centre or service in Spain, adopt measures that keep patients' health data confidential and allow access to it only with prior authorization backed by law (Ley 41/2002, Article 7).
- If you hold clinical records, limit administrative and management staff to the data related to their own functions, bind everyone who accesses the data to secrecy, and keep clinical documentation maintained and secure for at least five years from discharge from each care process (Ley 41/2002, Articles 16(4), 16(6) and 17(1)).
These lines are LexLint's reading of the law's text.
What it makes you log
What the log must hold
Access record
Logging duty
The law directs the autonomous communities to regulate a procedure under which a record of access to the clinical record and of its use is kept; it names no log fields, and a centre's own duty arises under the regional rule.
- Kind
- Implicit
- As of
- Provision
- Ley 41/2002, Art. 16(7)
- Trigger
- personal_data_processing
What this law does
Ley 41/2002 (the Basic Law on Patient Autonomy and Clinical Information) regulates the rights and obligations of patients, users, professionals and public and private health centres over clinical information and documentation. Every person has the right to have the confidentiality of data about their health respected, and no one may access that data without prior authorization backed by law. Health centres must adopt the measures needed to guarantee the confidentiality of patients' health data.
Administrative and management staff of a health centre may access only the clinical-record data related to their own functions. Staff who access clinical-record data in the exercise of their functions are bound by a duty of secrecy.
Access to a clinical record for judicial, epidemiological, public-health, research or teaching purposes must, as a rule, keep the patient's identifying data separate from the clinical data so that anonymity is ensured, unless the patient has consented to keeping them together, subject to the exceptions the article sets out.
Health centres must keep clinical documentation in conditions that ensure its correct maintenance and security, for at least five years from the date of discharge from each care process.
When LexLint raises it
When your app profile says your app handles health records or processes personal data.
Back to the example · Lint your app
Page updated .