In Germany, are doctors within the same institution able to access any patients&#39; medical records?
<p>I have a friend living in Germany who is seeking therapy in her small town. However, a problem that she is facing is that all of the psychological/psychiatric institutions in her town are managed by the same company and have access to the same patient databases. In particular, one of these is the psych ward at the hospital where were mother works, and her mother routinely accesses other patients' records including hers (for instance, she found about some lab tests that she had gotten and picked up the results for her). This severely limits what she can safely share with a therapist, because there are certain things that her family has told her they want her to keep quiet about.</p>
<p>To me, this seems brazenly illegal and a huge breach of confidentiality that basically makes therapy useless. However, I live in the US and have no idea how the particulars of the law work in Germany, both in terms of whether or not this is illegal (perhaps data sharing within the owning company is a non-issue) and if it is, what particular law is being broken. Is what's going on here illegal, and if so, who should my friend contact in Germany to seek help?</p>

<p>It is <strong>not</strong> illegal for the mother to continue working there under the condition that she continues to uphold her <strong>professional confidentiality</strong>.</p>
<p>It is <strong>not</strong> a violation of the employer to allow their employees, on a need to know bases, access to such data:</p>
<blockquote>
<p><a href="https://www.gesetze-im-internet.de/englisch_stgb/englisch_stgb.html#p1892" rel="nofollow noreferrer">§ 203 (3) - Violation of private secrets (StGB)</a><br />
(3) A secret <strong>has not been revealed</strong> within the meaning of this provision if the persons referred to in subsections (1) and (2) give their professional assistants and those persons who work with them for the purposes of their professional training access to these secrets. The persons referred to in subsections (1) and (2) <strong>may reveal another’s secrets to other persons who are involved in their work or official duties to the extent that this is necessary in order to be able to use the service rendered by this other involved person</strong>; the same applies to other involved persons if they use additional people who are involved in the work or official duties of the persons referred to in subsections (1) and (2).</p>
</blockquote>
<p>Such a violation of <strong>professional confidentiality</strong> would be in 2 different areas of law:</p>
<ul>
<li>Data protection <a href="https://www.gesetze-im-internet.de/englisch_bdsg/englisch_bdsg.html#p0421" rel="nofollow noreferrer">§ 53 - Confidentiality (BDSG)</a></li>
<li>Criminal law <a href="https://www.gesetze-im-internet.de/englisch_stgb/englisch_stgb.html#p1892" rel="nofollow noreferrer">§ 203 - Violation of private secrets (StGB)</a></li>
</ul>
<p>Your friend should inform their doctor about their concerns that a near relative also works in the same praxis. It would then be up to the doctor to insure that the <strong>confidentiality</strong> is upheld. Not doing so would be a violation of <a href="https://www.gesetze-im-internet.de/englisch_stgb/englisch_stgb.html#p1892" rel="nofollow noreferrer">§ 203 (4) (StGB)</a></p>
<hr />
<blockquote>
<p><a href="https://www.datenschutz.org/arztpraxis/" rel="nofollow noreferrer">Datenschutz in der Arztpraxis I Patientendaten 2020</a><br />
Nicht nur im Falle eines Datenschutzverstoßes drohen Konsequenzen! Bei einem Verstoß gegen die <strong>berufliche Schweigepflicht</strong> handelt es sich um einen Straftatbestand. Gemäß <a href="https://www.gesetze-im-internet.de/englisch_stgb/englisch_stgb.html#p1892" rel="nofollow noreferrer">§ 203 Strafgesetzbuch</a> kann dieser <strong>mit einer Geld- oder bis zu einjährigen Freiheitsstrafe</strong> geahndet werden.</p>
<blockquote>
<p><strong>Data protection in the doctor's practice I patient data 2020</strong><br />
Not only in the event of a data protection breach there are consequences!  A violation of <strong>professional confidentiality</strong> is a criminal offense.  According to <a href="https://www.gesetze-im-internet.de/englisch_stgb/englisch_stgb.html#p1892" rel="nofollow noreferrer">§ 203 Criminal Code</a> this person can be punished <strong>with a fine or up to one year imprisonment</strong>.</p>
</blockquote>
</blockquote>
<hr />
<p><strong>Sources</strong>:</p>
<ul>
<li><a href="https://www.datenschutz.org/arztpraxis/" rel="nofollow noreferrer">Datenschutz in der Arztpraxis I Patientendaten 2020</a> (german)</li>
<li><a href="https://europa.eu/youreurope/business/dealing-with-customers/data-protection/data-protection-gdpr/index_en.htm" rel="nofollow noreferrer">General Data Protection Regulation (GDPR)</a> Overview
<ul>
<li><a href="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32016R0679" rel="nofollow noreferrer">Regulation (EU) 2016/679, EUR-Lex - 32016R0679 - EN</a></li>
<li><a href="https://www.gesetze-im-internet.de/englisch_bdsg/index.html" rel="nofollow noreferrer">Federal Data Protection Act, Bundesdatenschutzgesetz (BDSG)</a> (implementation of GDPR, Regulation (EU) 2016/679 of <strong>25th of May 2018</strong>)</li>
</ul>
</li>
<li><a href="https://www.gesetze-im-internet.de/englisch_stgb/englisch_stgb.html#p1892" rel="nofollow noreferrer">§ 203 - Violation of private secrets StGB</a></li>
</ul>

germany health confidentiality mental-health