[Health care professionals' handling of patient data]

Health care professionals' handling of patient data is to a large extent subject to legislation. The legal obligations are linked to individual professional authorization, and obligations imposed on health care institutions. The latter type of obligation is particularly relevant to the use of IT systems.

An anonymous questionnaire survey was undertaken the autumn 2007. 300 physicians, 200 medical secretaries and 200 radiographs were asked about their personal experience with situations requiring handling of patient data subject to legislation.

The overall response rate was 54.7 (395/688). Health care professionals relatively often come into situations in which they can, ought to or have to make exceptions from the general secrecy obligation. A discretionary decision is often needed when patient data are disclosed to a third party or even when patients are granted access to their own personal records. In most such situations, health care professionals comply with their patients' wishes. Regulations on handling of patient data are usually adhered to. The largest category of breaches is by far "snooping" into IT systems, because of curiosity or for other reasons, which are neither professionally nor ethically reputable.

"Traditional" obligations, linked to individual professional authorizations, and well-defined patient rights are largely respected and met. Internal routines and guidelines, in an enterprise subject to system control requirements, are violated more frequently.