Privacy policy: Patient Register

Privacy policy
General Data Protection Regulation of the European Union (2016/679)

The County Board of the Western Uusimaa Wellbeing Services County

The Wellbeing Services County Director

The register holds the patient’s basic data, data related to provision of care, information on health and illnesses, and data on client fees.

The basic data of the patient consists of identification and contact information, such as the following: personal identity code, name, preferred first name, gender, address and whether the address is subject to non-disclosure for personal safety reasons, telephone numbers, municipality of residence, mother tongue, service language, marital status, email address and other necessary contact information Data related to provision of care include, for instance, the following: data on appointment booking, queues, and treatment reservations; visits and care period data of the operational units of the wellbeing services county and in other care facilities based on contracts; as well as the names and professional details of the note-makers. Information on health and illnesses consist of data on medical risks, data regarding health counselling, disease diagnosis, treatment planning, progress monitoring, and assessments related to appointments and care periods, laboratory and radiology requests and results, functional capacity information, statements and certifications given, consultation requests and responses (including those obtained from outside the Wellbeing Services County, such as responses received from HUS), referrals and epicrisis documents, and final medical statements. In addition, the processed information includes information that the patient produces or provides about themselves, as well as information on prohibitions, restrictions, consent, and other preference data.

In addition, insurance information that may pertain to the client relationship is processed.

The patient register also includes care and radiology statement information recorded by healthcare professionals and purchased on behalf of the Wellbeing Services County, as well as information arising from payment commitments and service voucher services.

Personal data is disclosed, based on legislation or a detailed information request, to authorised authorities in accordance with the legislation.

Under the Secondary Use Act, information concerning patients is provided to Findata for the purpose of scientific research, statistics, development and innovation activities, teaching, social and healthcare authority guidance and supervision as well as for planning and reporting duties of authorities. In addition, under the Secondary Use Act, the Wellbeing Services County discloses patient information for applicants for the purpose of scientific research, statistics, teaching, social and healthcare authority guidance and supervision as well as for planning and reporting duties of authorities, when the application pertains only to the data maintained by the Wellbeing Services County.

In addition, the Wellbeing Services County discloses patient information to service providers (e.g., in the case of outsourced services) if necessary for the provision of the patient’s health care. On legislative grounds, the Wellbeing Services County will also disclose patient information to supervisory authorities (e.g., AVI, EOA, Valvira).

As a rule, data is not transferred from the register to countries outside the EU or the EEA. However, personal data may be transferred to countries outside the EU/EEA area where the European Commission has determined that the level of data protection is adequate. In addition, personal data may be transferred to countries outside the EU/EEA when the protection measures required by the General Data Protection Regulation have been implemented, for example, by incorporating standard data protection clauses into contracts and by employing additional measures recommended by the European Data Protection Board as necessary.

Storage periods for patient documents are defined in the appendix concerning storage times for client documents of the Act on the Processing of Client Data in Healthcare and Social Welfare (703/2023) as well as in decisions on storage times for client documents and decisions by the National Archives of Finland.

As a general rule, patient documents are kept for 12 years after the patient’s death. If the date of death is unknown, documents are kept for 120 after the patient’s birth. These documents include the patient’s basic information, key treatment and care details, living will, summaries, care planning, implementation, follow-up or assessment records, referrals, epicrisis documents, consultation documents, medical statements, and treatment decisions.

Permanently stored documents include public healthcare patient records and documents for people born on the 18th and 28th of each month, as well as documents from hereditary medicine units.

All patient records archived to the Kela electronic archive will be permanently stored electronically. 

The Digital and Population Data Services Agency primarily provides patients’ identification and contact information, such as name and address.

Information in the patient register related to organising care is obtained and maintained based on information received from the patient or their representative as well as on information produced within health care units.

In addition, data on imaging and laboratory results are obtained from service providers. Data on services purchased with service vouchers is also obtained from service providers.

If the patient has not prohibited the disclosure of their information within the Uusimaa region, the authority organising and implementing health services of the wellbeing services county, the City of Helsinki, and the HUS Group, and those operating on its behalf, have the right, regardless of confidentiality regulations, to obtain and use another patient's information from an authorised health service provider of another wellbeing services county in the Uusimaa region, the City of Helsinki, or the HUS Group. This right extends to the extent that is necessary for providing the patient's treatment. The patient must be informed of their right to prohibit disclosure of information.