Federation of B&H adopted new legislation on personal health records
The pharmaceutical industry finally can collect personal medical data/records obtaining just written patient’s consent. The Law on Medical Records (Official Gazette FBH, no. 37/2012, further referred as „the LMR“) finally stipulated the conditions for collecting, processing, usage, protection and other issues related to the personal medical data/records. Namely, the general rule stipulated in the Law on Personal Data Protection (Official Gazette BH, no. 49/06 and 76/11, further referred as „the LPDP“) states that processing of health-related personal data is prohibited.
In practice, we faced with strict interpretation of this general rule by health professionals, although we fulfilled all legal requirement prescribed by the LPDP any eventual transfer or usage of medical data/records could not be performed.
In just one clause the LMR stipulated that the health-related personal data shall only be processed under the responsibility of a health professional, except for the written consent of the data subject or if the processing is necessary for the purposes of a specific criminal offence. Due to fact that the LMR prescribed the written consent further collecting, processing and all other related activities should be conducted in accordance with the LPDP.
Therefore, in order to collect, process, use or transfer the personal medical data/records controller must obtain the consent. The consent of the data subject have to be granted in writing, signed by the data subject, clearly stating data for which the consent has been granted, and must contain the name of the controller, the purpose and period of time for which the consent has been granted.