Austria: Proposal For Amendment To The Health Telematics Act

Introduction

The Health Telematics Act 2012¹ provides for an Electronic Health Record (ELGA), which shall contain all health-relevant information on patients. Health care providers (physicians, dentists, pharmacists, hospitals) have access to ELGA. However, patients can object to participate in ELGA and they can limit the accessibility to their health data. ELGA is still in the implementation process.

On December 6, 2019 the Ministry of Health provided parliament with a draft of an amendment to the Health Telematics Act 2012² for consultation with the interested public.

Problem

Notwithstanding the current implementation process of ELGA, the Austrian immunization system still uses the paper-based immunization card as essential instrument for documentation purposes. This documentation of the immunization status is often incomplete and/or inconsistent, because a new immunization card is issued (if the vaccinated person does not have the card with him/her) so that vaccinations a person has received over the years is spread over several documents. Moreover, vaccinations are administered by different health care providers so that also at the health care provider no complete record of the vaccination status of a person is available. Finally, the handwritten entries are frequently hardly legible. Consequently, the evaluation of the immunization card is not only difficult for the health care provider but also does not provide public health with the necessary statistical data for steering purposes. Therefore, the ministry proposes an Electronic Immunization Card and a central register of vaccinations.

Objectives of the ministry's proposal

Objective 1: Optimization of vaccination of the public

The replacement of the paper-based documentation by a digital documentation listing all vaccinations is intended as a primary documentation so that no separate documentation by the health care providers is required. Facilitating the access to personal health data shall strengthen personal responsibility and promote prevention. Due to the availability of the digital data base public vaccination programs may be directed specifically to target groups and procurement of vaccines can be streamlined.

Objective 2: Availability of digital information for public health

Vaccination coverage rates can be identified on the basis of a complete collection of data and permits measures to prevent the spread of diseases that can be fought by vaccination. In case of diseases or suspected cases of a highly contagious diseases such as measles contact persons of the patient can be identified to make targeted post-expositional actions to contain a spread of the disease.

Objective 3: Optimization of ELGA and generic development of central ELGA infrastructure for eHealth applications

The quality of meta data is essential for the reliable accessibility and usability of documents in ELGA.

Measures

These objectives shall be implemented by providing the legal basis for the eHealth application "Electronic Immunization Card". It is a eHealth application in addition to ELGA and uses certain components of ELGA. The core of the Electronic Immunization Card is a central register of vaccinations serving for the documentation of all vaccinations generating the individual Electronic Immunization Card. The data registered in the central vaccination register shall be deleted ten years after the death, at the latest 120 years after the birth of the patient. To establish a personal vaccination schedule and for reminders to recommended vaccination the current vaccination plan shall be lodged in the register. The infrastructure built for ELGA shall be used also for the electronic immunization card.

Whereas, participation in ELGA is voluntary, participation in the Electronic Immunization Card shall be mandatory.

Privacy Considerations – General Data Protection Regulation

Article 9 (1) GDPR permits the processing of personal health data if it is provided for in Union Law or the law of a member state and justified by public interest subject to appropriate guarantees for the protection of personal data and other civil rights. Against this background the ministry considers that the use of the Electronic Immunization Card fulfils a considerable public interest according to Art 9 (2) (g)-(j) GDPR. The same is true for the use of ELGA. However, the use of ELGA is limited to registered ELGA health care providers particularly hospitals and physicians, whereas public health care is excluded from the use of ELGA. Contrary to that the purpose of the Electronic Immunization Card is to allow public health care the effective and efficient provision of legal tasks so that the Electronic Immunization Card must be available also for public healthcare. Whereas, participants of ELGA (i.e. patients) may object to the participation in ELGA the registration of vaccination data in the Central Vaccination Register as an essential part of the Electronic Immunization Card does not provide for an objection. Such an objection would make the realization of the objectives pursued by the Electronic Immunization Card impossible. Therefore, the implementation of the Electronic Immunization Card without possibility to object is necessary to achieve the objectives in the sense of recital 53 GDPR.

In Austria currently vaccinations against 22 disease agents are available of which only four are not transferrable from person to person. Since these diseases also are severe, there is no reason to distinguish between vaccinations against diseases transferrable by humans and other diseases. Since the vaccination data may be used only for limited purposes, the Electronic Immunization Card is an appropriate and specific measure to defend the rights and freedom of the data's objects.

Comments

Although the ministry's motion for an Electronic Immunization Card/ Electronic Immunization Register certainly is to be welcomed with regard to public health, the draft raises several privacy issues. To name only a few of them:

• Is personal data really necessary to achieve the public health objective?
• Under Austrian Privacy Law the elimination of the possibility to object is only legitimate if this is absolutely necessary to achieve the objective; is a complete and mandatory capture for all vaccinations really necessary or is a different approach for different groups of vaccinations (the ones for transferrable diseases and others that only minimize a risk for the patient) more appropriate?
• How shall data of persons not participating in ELGA (or having objected to the participation in ELGA) be processed for the Electronic Immunization Card?

Footnotes

1. Gesundheitstelematikgesetz 2012 (BGBl I Nr 111/2012 as amended).

2. 9/ME XXVII.GP.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.