Secure use of health and social data will be further improved

In the future, personal client data saved in health and social services’ databases can be used more efficiently to support, for example, social decision-making and development of health and social services.

The Ministry of Social Affairs and Health is requesting opinions on its draft Act on Safe Use of Health and Social Data, and on amending the Act on National Institute for Health and Welfare. The consultation period begins on 15 August 2016 and ends on 30 September 2016.

Finland has exceptionally extensive high-quality data resources within the health and social care sector but the opportunities they offer have not been fully used. The planned changes would enable using the data securely, standardising practices of the authorities and developing better service.   

The legislative changes would make it possible to use client data from health and social services and other personal data relating to health and wellbeing in a more flexible and effective way. The data can nowadays be used, on conditions laid down by law, for scientific research, compilation of statistics, steering and enforcement duties of authorities and for other official duties like planning, analysis and assessment. Teaching, information management and development and innovation activities would be new fields of use.

The draft act takes account of data security and protection of individual privacy of clients when data is used. These would be further improved, specifically through requirements for secure handling.

All permits to use the data would be granted by one permit authority

The new act would bring together all provisions concerning the use of health and social care data from personal data files and other data regarding wellbeing. Now the provisions are scattered in different statutes. When there is need to combine data from different data controllers or use data from private health and social services, all permits to use the data would be granted by the same permit authority. After having granted a usage permit, the permit authority would collect the data from different registers, combine them and deliver them to the permit holder.  

According to the draft act, the National Institute for Health and Welfare (THL) would operate as the permit authority. The duties of the permit authority would be carried out by a special unit set up for that purpose at the Institute. Data controllers would include, for example, the National Institute for Health and Welfare, the Social Insurance Institution of Finland, Statistics Finland, Population Register Centre, and all public organisers of health and social services.

An electronic permit portal would be set up to enable permit handling and communication between the permit authority and permit applicants. Data-secure operating environments and communications would be created for sending and handling the data. Additionally, data controllers and the permit authority should organise an advisory service to help those who wish to use personal data.

The government bills would bring the provisions on handling personal data into conformity with the EU Data Protection Regulation, which entered into force on 25 May 2016. The reforms are due to come into force in stages, starting from 1 January 2018.

The change would ease and increase the use of information on health and social matters

On an international scale, Finnish authorities and service providers within the health and social sector possess extensive data resources which contain valuable information on the wellbeing and health of the population and on the use of health and social services. However, to be able to use that data for research and development purposes often requires usage permits applied for from different data controllers. The problem with using health and social data is that the various data controllers handle the requests for using the data as separate processes, even for the same research or development project. Additionally, data is disclosed from personal data files based on provisions in different acts.

The duration of handling of a permit may also vary a lot. At worst, the parallel handling processes, waiting for information and combining it can take years. This takes time and resources from authorities and causes extra trouble for the permit applicant. Permit decisions from data controllers can also be contradictory: if four data controllers would consider the permit application as legal and approved under ethical review, one data controller can make a negative decision about the same application. As a result, the whole project can lapse. This situation has led to underuse of valuable information. Some research and development projects have been transferred abroad and some planned projects have not been started at all.

This legislative project implements the growth strategy for the health sector of the Ministry of Social Affairs and Health, the Ministry of Employment and the Economy and the Ministry of Education and Culture, the Strategy for better use of health and social data of the Ministry of Social Affairs and Health, and the Government Programme of Prime Minister Juha Sipilä.

Inquiries

Hannu Hämäläinen, Ministerial Adviser tel. +358 295 163 380
Pia-Liisa Heiliö, Ministerial Adviser tel. +358 295 163 372
Helena Raula, Lawyer tel. +358 295 163 018
[email protected]