Przetwarzanie i ochrona danych dotyczących zdrowia przez organizatora systemu opieki zdrowotnej

The protection of individuals regarding to the processing of personal data is one of the fundamental rights. The General Data Protection Regulation (GDPR) lays down rules relating to the protection of natural persons with regard to the processing of personal data and rules relating to the free movement of personal data. Data concerning health is one of the areas the GDPR defines as special personal data, the so-called sensitive data. With regard to these data, the GDPR allows their processing only on an exceptional basis, in certain situations. According to Art. 6 sec. 1 let. e GDPR and art. 9 sec. 2 let. b GDPR, data processing is allowed, inter alia, when such processing is necessary for the purposes of meeting the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law. In turn, Art. 9 sec. 2 let. h GDPR permits the processing of health data that is necessary for the purposes of providing health or social care or treatment, or for managing health or social care systems and services on the basis of European Union or Member State law. The article discusses the national legal regulations regarding the collection and processing of personal data concerning health in the light of the organization of the health care system and the tasks of the National Health Fund (NFZ) as a placeholder, whose task is only to manage financial resources and conclude health care contracts on its own behalf with independent healthcare providers and their accounting. Against the background of the GDPR, the author discusses the provisions of the acts on health care services financed from public funds and on the information system in health care. Finally, specific regulation regarding the COVID-19 pandemic are presented.