The European Union has revamped its data protection rules to give citizens back control of their personal data and harmonize cross-border data sharing. Finland's current legislation makes it possible for health records to be stored in state-administered databases for eternity, but the new EU directive says that data subjects have a right to object to their information being stored.
Finland has a nationwide system of health and social services. Archives in both the public and private sector have collected reams of confidential information on the population. The state-owned administrator of social benefits, Kela, has created an electronic database it calls Kanta, which contains information on visits to health centres and social service providers, for example.
Kanta also has a section for storing old patient information. A health clinic can upload older data to the patient data repository and then delete it from its own archives – or even adopt a new archiving system, knowing that the information has been stored in the Kanta database.
"This means that organisations can still access older information in a treatment situation. Even if the old archiving system has fallen out of use, the patient data can still be found," explains project manager Sinikka Rantala from the National Institute for Health and Welfare (THL).
On 2011, Finland's National Archives Service issued an order calling for the "permanent retention" of the electronic data stored in the Kanta system. It renewed the order in 2015.
But permanent retention could be problematic in light of the new EU directive. Finland's Ministry of Social Affairs and Health has also gone on record to say that the Archives Service decision "is not synchronized with the Ministry's Decree on Patient Records [298/2009]".
All for the common good
"The ministry has launched an investigation into how the EU's new data protection directive will affect Finland's social and health care legislation. This is linked in part to the Archives Service's proposal to store electronic patient information in perpetuity. The cost of storing and using the data permanently must also be taken into account," says data management specialist Maritta Korhonen from Finland's Social Affairs and Health Ministry.
The National Archives Service shortened its name to National Archives this year, but it stands by its 2011 decision, saying it is simply a matter of interpretation. The authority is of the view that data subjects do not have the right to "be forgotten" if the archiving and processing promotes the public good or furthers scientific, historic or statistical research needs.
Before the National Archives proposed making storage permanent, records were already stored for a very long time in Finland. Previous rules required that records be retained 12 years after a person's death or for 120 years after their birth.
Everyone can choose who has access
Most of the older data in the Kanta patient data repository has originated from the public sector. The private health care provider Terveystalo maintains its own database and archive. Juha Tuominen, the chief medical officer of Terveystalo says that his company has the patient data of over three million people, after several mergers and acquisitions.
In the same way with the Kanta service, patients of Terveystalo can access their information online at any time with their bank codes. The system also allows patients to choose just who can access their information.
"In a fusion situation, patient data is primarily visible only to the doctors who originally treated the individual in question. When a new patient is transferred into our system, we ask if they would like to make this data available in the joint register or if they should remain visible to only a few chosen people. The patient decides on how accessible their data is autonomously," Tuominen says.
Enabling the best treatment
Valvira, the National Supervisory Authority for Welfare and Health, confirms this practice. When using the Kanta system, the patient can decide how widely their data is shared and who can see it.
"The terms and conditions are the same, in practice. Patients always have the right to decide how their health records will be used. In principle, only the patient's GP and treatment personnel are privy to their personal data," says Reija Kauppi, a solicitor at Valvira.
Sharing personal health records freely is often in the patient's best interests, however, as earlier treatment results can be better utilised in new medical situations, avoiding unnecessary tests, trials and studies.