| name | health-data-dpia |
| title | Assessing Health Data Processing |
| description | Guides DPIA for health and medical data processing covering Art. 9(2)(h)-(j) exemptions, HIPAA crosswalk for transatlantic operations, clinical trial data protection under EU CTR 536/2014, and genetic data specifics under Art. 9(1). Activate for healthcare systems, clinical research, health apps, or medical device data. Keywords: health data, DPIA, Art. 9, clinical trial, genetic data, HIPAA, medical records, special category. |
| author | mukul975 |
| author_url | https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/health-data-dpia |
| license | Apache-2.0 |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | cross-jurisdiction |
| practice | data-protection |
| language | en |
Assessing Health Data Processing
Overview
Health data is classified as a special category under GDPR Art. 9(1), requiring both a lawful basis under Art. 6(1) and an Art. 9(2) exemption for processing. Processing of health data on a large scale triggers a mandatory DPIA under Art. 35(3)(b). This skill provides a DPIA methodology for health data processing scenarios: electronic health records, clinical trials, health research, telemedicine, health applications, medical devices, and genetic data analysis.
Legal Framework
Art. 9(1) — Definition of Health Data
GDPR Art. 4(15) defines data concerning health as "personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status."
This includes:
- Medical records and diagnoses
- Prescription and medication data
- Laboratory results and imaging
- Mental health assessments
- Disability information
- Genetic data (Art. 4(13))
- Biometric data processed for health purposes
- Health insurance claims
- Fitness and wellness data that reveals health status
- Data inferred from non-health data that reveals health conditions
Art. 9(2) Exemptions for Health Data
| Exemption | Reference | Application |
|---|
| Explicit consent | Art. 9(2)(a) | Patient consent for specific health processing. Must be separate from treatment consent. |
| Employment obligations | Art. 9(2)(b) | Occupational health assessments required by employment law. |
| Vital interests | Art. 9(2)(c) | Emergency medical treatment where patient cannot consent. |
| Healthcare provision | Art. 9(2)(h) | Processing necessary for preventive or occupational medicine, medical diagnosis, provision of health or social care, or management of health systems. Must be processed by or under the responsibility of a professional subject to medical secrecy. |
| Public health | Art. 9(2)(i) | Processing necessary for public health purposes including protecting against serious cross-border threats, ensuring high standards of quality and safety of health care, medicinal products, or medical devices. |
| Scientific research | Art. 9(2)(j) | Processing necessary for scientific research purposes (including clinical trials) subject to Art. 89(1) safeguards: data minimisation, pseudonymisation where possible. |
