Privacy Policy - Clinical Data
7.1 Access to the health record for healthcare purposes.
7.1.1 Article 15.2 of the LBAP establishes that the purpose of the health record is "to facilitate healthcare by recording all data that, under medical criteria, allow for accurate and up-to-date knowledge of the state of health."
According to the same law in Article 16.1, healthcare professionals involved in the diagnosis or treatment of a patient have access to the patient's health record as an essential tool for proper care, without the need for the patient's consent.
Therefore, residents in training of any year, as healthcare personnel and employees of the Center, have the right to access the health records of patients involved in their healthcare activities at any given time. Failure to consult or complete healthcare actions in the health record may have implications for patient safety and legal consequences due to clinical malpractice.
7.1.2 The responsible party of the healthcare center, through the administrative service in charge of managing the medical records archive, will provide residents with access to the health records by means of an authentication mechanism (usually through an identification card and recognized electronic signature) that will be progressively implemented within six months from the notification of this agreement to the Health Departments of the autonomous communities and the National Institute of Health Management.
In accordance with Article 16.7 of the LBAP, the procedure used shall ensure that the access to the health record and its use is recorded.
In exceptional cases, healthcare center authorities may establish limitations on healthcare professionals' access to the health records based on the care context and the healthcare center's access policy (for example, regarding cases of gender-based violence, press policy, etc.), as long as these limitations, in accordance with the provisions of Article 76 of the LOPD in relation to Article 16 of the LBAP, do not hinder care, prevention, and diagnosis, nor prevent the safeguarding of the vital interests of the affected individuals.
In any case, access authorizations shall be temporary and shall expire when the training period ends, at which point the healthcare center will deactivate the resident's access instrument to the health records.
7.1.3 In order to guarantee respect for the privacy and confidentiality of health data, students may only access the health records in accordance with the provisions of Article 16.3 of the LBAP, which requires the prior dissociation of clinical data from personal data to ensure anonymity.
The above provision does not apply in cases where the patient themselves have given explicit consent not to alter or dissociate any data, in which case the consent will be attached to the health record.
7.2 Access to the health record for epidemiological, public health, research, or educational purposes.
7.2.1 The LBAP, in Article 16.3, establishes that access to the health record for judicial, epidemiological, public health, research, or educational purposes requires the preservation of the patient's personal identification data, separated from the clinical data, so that, as a general rule, anonymity is ensured unless the patient themselves have given their consent not to separate them.
The dissociation of data requires separating the clinically relevant data (in this case, clinical and healthcare data) from those that allow for the identification of the individual (such as medical record number, social security number, ID card, etc.). The dissociation of data must be carried out by a healthcare professional subject to professional secrecy or another person subject to an equivalent obligation of secrecy.
In the field of education, students may access the health record with disassociated personal data or simulated medical records provided by the responsible teacher in order to ensure that the learning derived from them respects the privacy and confidentiality of health data.
7.2.2 The Center's management shall authorize access to the health record. The authorization shall be processed by the person responsible for the record, requiring the prior and reasoned report of the tutor or the persons responsible for the research/master/degree/doctorate, which shall be subject to the prior opinion of the corresponding Ethics Committee for Care/Research. This authorization shall have the temporal limits that are appropriate for the specific purpose for which access is authorized.
7.2.3 Only those health data related to the purposes of the research may be used from the health record without revealing characteristics, facts, or circumstances that allow the identification of the patients participating in the study/research in question.
When it is necessary to publish or exhibit medical images or any other audiovisual support that shows parts of the body from which the patient's identity can be inferred, the written consent of the patient will be required.
7.2.4 The activity of researchers in the field of biomedical research and clinical trials shall comply with the provisions of Law 14/2007, of July 3, on Biomedical Research, Royal Decree 1090/2015, of December 4, regulating clinical trials with medicinal products, Ethics Committees for Research with Medicinal Products, and the Spanish Register of Clinical Studies, as well as specific regulations applicable in each case.
7.2.5 Observational studies with human-use medications shall be guided by Order SAS/3470/2009, of December 16, which publishes guidelines on post-authorization observational studies for human-use medications.
7.3 Access to the health record by third parties.
7.3.1 Requests for access to the health record made to students, by patients or involved third parties (family members, legal representatives, etc.) under the right of access recognized in Article 18 of the LBAP, shall be immediately forwarded to the tutor or specialists of the healthcare unit for processing in accordance with the procedures established by each center.
7.4 Access to the Digital Health Record of the National Health System (HCDSNS).
7.4.1 The Digital Health Record System of the National Health System (HCDSNS) allows access to certain clinical documents generated in any Health Service of the National Health System, ensuring that they can be consulted when citizens require healthcare during their travels within the national territory.
7.4.2 Access must be exclusively for healthcare purposes, and healthcare professionals with healthcare functions who have been previously authorized by their health service may access the system.
7.4.3 Therefore, students of health-related disciplines cannot access the system.
7.5 Copies.
Without prejudice to the occasional access to the health record as provided for in sections 7.1.1 and 7.1.3, students, whether residents or trainees, may not make copies of the information contained in the health record through any means or in any format, except with the written consent of the patient or in the case of anonymized health records with the explicit authorization of the responsible party for the medical records registry, upon the proposal of their tutor/educational supervisor.
- Patients' right to confidentiality of their health data.
8.1 Article 7.1 of the LBAP establishes that "every person has the right to the confidentiality of data regarding their health, and no one may access them without prior authorization under the Law."
This right translates into the duty of confidentiality/secrecy provided for in Article 2.7 of said law, which establishes that "the person who prepares or has access to clinical information and documentation is obliged to maintain due confidentiality."
8.2 Both residents and students are subject to the duty of confidentiality/secrecy, not only during their stay in the healthcare center where they are being trained but also after it ends, and this duty is not extinguished by the patient's death.
The duty of confidentiality applies not only to "intimate data" (including psychological data related to ideas, values, beliefs, personal experiences, etc.) but also to the patient's biographical data and their environment (whether intimate or not) whose knowledge by third parties could affect the rights of the person under treatment.
The duty of confidentiality/secrecy applies not only to the data contained in the patient's health record but also to those accessed through verbal communication, recordings, videos, as well as those contained in any type of computer, electronic, telematic file, or public or private registry, including data related to the degree of disability and genetic information.
The duty of secrecy is understood without prejudice to the legal cases in which its maintenance implies a risk to the life of the affected individual or third parties, or harm to public health, in which case it shall be reported to the responsible healthcare professionals of the corresponding service/healthcare unit for appropriate action.
8.3 To this end, all trainees shall subscribe to a confidentiality commitment (see indicative model in Annexes I and II) at the beginning of their stay in the healthcare center where they are being trained, and this commitment shall be recorded in the Register Book for research staff and for students mentioned in section 9, and in the case of residents in training through the residency system, their personal files held by the Teaching Commission shall be kept.
- Final provisions.
9.1 Register of students in health-related disciplines.
9.1.1 All educational institutions with which healthcare centers have signed collaboration agreements/concerts for teaching/research under applicable legislation, facilitating practical training for their students, must submit to the Center's Management, prior to the start of each academic year, a personalized list of students from each course who will be doing internships in the center, expressly indicating the degree they are pursuing, the responsible teachers mentioned in section 3.4, as well as the schedule and healthcare units involved in the practical training.
9.1.2 The personnel departments of the healthcare institutions or the body designated by their management shall have a "register book of trainee students/research personnel" that complies with the requirements established in the LOPD for the creation of files containing personal data. The aforementioned register shall annually record the mentioned data and the annotation stating that the individual commitment to confidentiality has been signed.
This register, in digital format, shall be accessible from any healthcare unit that wishes to verify that the student is authorized to remain in the center and the respective unit.
9.1.3 It is not necessary for residents in training under the residency system to be registered in the aforementioned register book. Their control, being linked by an employment contract with the entity that owns the corresponding center, shall be carried out by the personnel departments of the Institution responsible for their remuneration payments and by the Teaching Commissions to which the accredited teaching units where the resident is being trained are affiliated.
Please enable strictly necessary cookies first so that we can save your preferences.
