Clinic prosecuted for transferring patient data to mainland
A clinic has been prosecuted for transferring patients’ clinical file data to the mainland, the Office for Personal Data Protection (GPDP) has said in a statement.
According to the GPDP, the case is the most serious the office has detected related to the medical industry, with the entity suspected of having committed a crime.
The medical center had requested workers who were not employees to transport medical records from Macau to the mainland for archiving but, in the process, several files were allegedly lost.
By entrusting the files to a third party, the institution had breached the duty of professional confidentiality, which is aggravated by the fact that the files’ location is unknown.
Additionally, the GPDP said the medical institution made differing statements to the GPDP and the Health Bureau (SSM), a fact that constitutes perjury.
The office said the medical institution had transferred medical files to the mainland without patients’ knowledge and consent and, when questioned about it, failed to explain the reasons for the transfer or who was involved and where the files are being kept.
The GPDP has forwarded the case to the judiciary authorities for further investigation and prosecution.
The office revealed another case, in which another medical institution had failed in its data protection duties by not protecting surveillance system footage.
The case involves someone accessing and sharing videos captured by the internal surveillance system with a third party. The GPDP said the medical center used the surveillance camera footage to “better explain the situation of the patient to his family members,” sharing them via a mobile communication application.
In this case, the GPDP said the investigation revealed a flaw that was only an administrative offense, and as such was sanctioned with a MOP6,000 fine.
Still, the GPDP said such cases are rare and that since they began to jointly promote the e-HR platform in the private medical sector with the SSM, there had not been many cases related to flaws or breaches in the use of the system.
