Privacy Policy for patients at the Europe hospitals
1. Preamble
The non-profit association, "Europe hospitals", established at Avenue De Fré 206, 1180 Uccle and registered under company number BE 0432.011.571 (hereinafter: we/us or the NPO) pays particular attention to the protection of the privacy of all persons whose data it collects and processes.
The NPO brings together the following hospitals:
- Site Ste-Elisabeth (avenue De Fré 206, 1180 Uccle)
- Site St-Michel (rue de Linthout 150, 1040 Etterbeek)
- Bella Vita Medical Center (Allée André Delvaux 16, 1410 Waterloo)
The non-profit association is responsible for data processing for all establishments. In some cases, another person may be jointly responsible with us for the processing of your data as patient. If this is the case, we will act as the initial point of contact.
We have also appointed a Data Protection Officer (hereinafter: DPO) who can be contacted at the following email address gdpr@cdle.be.
We keep our processing records with the utmost rigor in order to prove at all times our compliance with all the data protection provisions applicable to our sector of activity.
The purpose of this statement is to explain to you who we are, what data we process, why and how we process your personal data, for how long we process them, to whom your data may be transmitted and above all what your rights are with regard to your data and how you can exercise them, as well as all the information made mandatory by the provisions on privacy in force in Belgium, and in particular Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and the repealing Directive 95/46/EC, hereinafter referred to as the GDPR.
2. Definitions
Personal data: any information or group of information that identifies or makes identifiable a natural person. This may include an identifier such as name, identification number, location data, online identifier, etc. It may also be one or more elements specific to his health and his physical, physiological, genetic, mental, economic, cultural or social identity.
Processing: any operation or set of operations whether or not performed by automated means and applied to data or sets of personal data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure, communication by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Data subject: the identifiable or identified natural person whose personal data are processed.
Data controller: the legal (public body, company, NPO, etc.) or natural person who determines the purposes and means of a processing operation, i.e. the objective and the way in which it is carried out. In practice and in general, this is the legal person embodied by its legal representative(s).
Subcontractor: the natural or legal person who processes data on behalf of another organization (“the controller”), as part of a service or provision. For example, the subcontracting of laboratory analyses, mail dispatch, etc.
Receiver: a person entitled to obtain communication of data recorded in a file or a processing operation by virtue of his or her functions.
Third party: a natural or legal person, a public authority, a service or a body other than the data subject, the controller, the subcontractor and the persons who, under the direct authority of the controller or the subcontractor, are authorized to process personal data. For example, the National Institute for Health and Disability Insurance (INAMI), the mutual insurance, the attending physician, etc
3. What it the scope of this Policy?
This statement is intended for people who have at least one of the following qualities:
- Are patient of the Europe hospitals;
- Are family members of a patient or assisting a patient;
- Have legal access to a patient file.
It applies to all processing of personal data of patients who attend one of our facilities, carried out by its staff members and/or independent practitioners.
4. What data are processed and how are they processed?
The Europe hospitals collect the relevant data necessary for your care by the care services (medical, nursing, paramedical), the constitution of your patient file and the management of your administrative and social file.
The Europe hospitals process your medical data (e.g. state of health, test results, pathologies, history, etc.), your administrative data (e.g. identification data such as surname and first name, national registration number, billing data, etc.).
The Europe hospitals also process other data necessary for the pursuit of the purposes determined or imposed by law (for example: data relating to lifestyle, family and professional situation, contact persons or trusted persons or representatives, philosophical or religious opinion, sexual behavior, racial or ethnic origin, etc.).
This data can be collected either directly from you or indirectly from your representative, your prescribing doctor or general practitioner, or your mutual insurance.
Read more...
Depending on the purpose of the processing, the personal data processed by the Europe hospitals can concern the following categories:
Personal data :
- Identification data (e.g. surname, first name, unique patient number, etc.) ;
- Contact details (e.g. contact and/or home address, phone and/or mobile phone number, etc.);
- Personal data (e.g. age or date of birth, place of birth, gender, nationality, language spoken, etc.);
- Personal life (e.g. marital status, household composition, etc.);
- Lifestyle (e.g. dependency - alone, in an institution, independent, bedridden -, assistance - domestic help, family -, physical exercise, diet and dietary behavior, urban, semi-urban, nomadic, sedentary lifestyle, housing);
- Contact person data (e.g. representatives, legal representative, trusted person, care providers, prescribing specialist, attending physician, etc.);
- Educational level (e.g. primary, secondary, tertiary);
- Professional life (e.g. training, experience, CV, etc.);
- Connection data (e.g. IP addresses, logs, terminal identifiers, connection identifiers, timestamp information, etc.);
- Images (e.g. passport photos, surveillance camera footage, etc.).
« Sensitive » data:
- Health data (e.g. weight, height, blood type, diagnosis, test results, personal or family history, appointment, consultation and hospitalization data, pathology history, list of allergies, care plan, administration of medication, nutrition and dietetic data, neuroimaging results, etc.);
- Biometric data (e.g. fingerprints, eye fundus, eye biometry, etc.);
- Genetic data;
- Samples taken;
- Ethnic origin;
- Political opinions ;
- Religious or philosophical beliefs or trade union membership;
- Data concerning the sex life or sexual orientation of a natural person.
Data perceived as « sensitive »:
- Financial and administrative data related to admission and invoicing (e.g. bank account number, data concerning affiliation with mutual insurance or insurance companies, etc.);
- Social data (e.g. identification of aftercare structures and other rehabilitation centers, intervention of the public social welfare center (CPAS), agency growing up (Office National de l’Enfance) or any other parastatal body, etc.);
- National register number.
5. When and how do we collect your personal data?
The collection and processing of personal data applies to all patients in accordance with the provisions on hospital and nursing records, in particular articles 20 and 25 of the hospital law.
Personal health data are collected by independent practitioners and/or hospital workers from the patient himself, unless the patient is not in a condition to communicate his data personally.
We collect your personal data through various channels:
- When you register or request information;
- When making appointments by telephone, website or health practitioner;
- When requesting assistance;
- When undergoing various health tests, evaluation of various health examinations;
- When you register for a care protocol (medical follow-up);
- On your initiative by any clear positive act, any manifestation of free, specific, informed and univocal will, in particular e-mail, sms, oral request by telephone, during a visit to our categories, or when you fill in our information request forms, during an event or a training course that we organize by handing over your business card or in any other way;
- When your data are publicly disclosed or if you have made it publicly available on public/social media, including professional media (such as LinkedIn, Facebook, ...);
- Through your visit to the emergency room.
6. Legal basis
Depending on the type of processing applied, the persons whose data we collect, the purposes, we use and process personal data with different bases of lawfulness:
- The processing is necessary for the performance of a contract (e.g. processing of data relating to the invoicing of services requested and/or performed);
- The processing is necessary for the execution of a mission of public interest entrusted to the Europe hospitals (for example: the processing of data for teaching or scientific research purposes);
- The processing corresponds to compliance with a legal obligation (for example: processing of data relating to risk groups or organ donors);
- The processing is necessary for the purposes of the legitimate interests pursued by the Europe hospitals (for example: the recording and management of risks and undesirable events, processing relating to technical management, logistics, security of goods, access control, improvement and optimization of processes, benchmarking, follow-up of legal actions, etc.).
If the processing of personal data can’t be based on one of these grounds, the processing may only be carried out with your written consent.
7. For what purposes are your data used?
The purpose of processing your data is to organize your care and to compile your patient file, as well as to manage your administrative, financial and social follow-up within the Europe hospitals and the care network in which it participates.
Your personal data can also be used to enable the Europe hospitals to fulfil its other missions, namely clinical teaching and scientific research, unless you object.
The Europe hospitals pay particular attention to ensuring that personal data are processed in an appropriate manner, limited to the purpose for which the data are processed and in accordance with the applicable legislation.
Read more...
The purposes for which the Europe hospitals process personal data are the following:
Care activities
- Computerized management of the patient file, intended to enable diagnosis, therapeutic management and communication of information relating to the provision of medical, nursing and paramedical care to patients in the safest security conditions;
- Care of patients admitted via all hospital departments (including emergencies, hospitalization, consultations or external medical consultations);
- Social care;
- Management of the prescription and results of medico-technical examinations;
- Prescription, dispensing and administering health products and requests for procedures;
- Registration of risk groups, with the aim of identifying and monitoring persons representing a medical risk;
- Donor registration with the aim of creating, promoting and exploiting files of persons who wish to be donors;
- Management of birth and death declarations;
- Registration of screening or follow-up test results in official registers or with official bodies (e.g. cancer registration with the Belgian Cancer Registry Foundation, deafness registration with the agency growing up ONE, follow-up registration of rare diseases with Sciensano, etc.).
- Blood bank, stem cell bank, tissue bank, etc.
Support activities
- Administrative and financial management of patients for billing and payment purposes, which involves the communication of information to authorized third parties (mutual insurance, insurance companies, collection companies, etc.);
- Management of contacts relating to the family, proxies, contact persons and trusted persons designated by the patient in order to improve his or her therapeutic, administrative and social care;
- Management of contacts and directories relating to treating doctors, prescribers, dispensers and signatories in order to ensure therapeutic follow-up;
- Technical management of the information system supporting the infrastructures and institutional applications that process personal data;
- Logistical management allowing the care of patients, i.e. stretcher transport, reception, appointments, guarding, dietetics;
- Recording and management of adverse events relating to patient safety;
- Management of requests made by the patient concerning the exercise of his/her rights under the General Data Protection Regulation and the law of 22 August 2002 on patients' rights;
- Management of complaints and litigation;
- Management of spiritual care and well-being;
- Security of persons and property, including video surveillance cameras and access control.
Medical and economic management activities
- Recording of medical and data of patient’s stay for internal management at the Europe hospitals or for purposes imposed by the public authorities;
- Evaluation of the quality of care, resource management and control of hospital activities.
Research and teaching activities
- Clinical education and training of physicians and other health care professionals;
- Applied scientific research (retrospective and prospective studies and clinical trials);
- Development of new technologies;
- Management of the Human Body Material Bank/Tissue Bank;
- Setting up single or multi-center registers.
Data communication
- Communication of demands for medical tests and examinations and their results to health care professionals;
- Communication of information necessary for the discharge of patients, to organizations in the social and family aid, medico-social, psycho-educational sectors or upstream reception structures and necessary for the reception of the patient from a downstream structure;
- Electronic exchange of computerized health documents (test results, medical reports, letters, appointment scheduling and reminders by SMS, etc.) to and from the patient and between care providers working for the same patient and patients who wish so;
- Communication of the patient's presence and location to third parties, unless the patient objects or such communication is detrimental to the patient's interest.
In the event of future processing, the Europe hospitals undertakes to modify this Declaration in order to introduce said new processing. In any event, future processing will only be carried out if it pursues specific, explicit and legitimate purposes.
In the event of secondary use of data, the Europe hospitals undertakes to guarantee that the purpose of the secondary processing is compatible with the initial purpose of the processing.
8. With whom do we share your data?
The data listed above are accessible only to those persons who are members of our services to the extent necessary for the performance of their duties. All staff members are also obliged to respect the confidentiality of all personal data managed by us.
Personal data relating to health care, in accordance with article 9(3) of the GDPR, processed under the sole control and responsibility of a professional healthcare practitioner who is bound by a legal obligation of professional secrecy.
The Chief Medical Officer, assisted by the Director of Nursing, is the guarantor and controller of the patient file containing personal health data (medical, paramedical and nursing data). The financial director and the administrative director assist him in his task as regards non-medical personal data.
In addition, we are obliged to transmit the personal data collected to the authorities or entities established by the law, the decree or any regulatory provision.
Within the limits of the provisions of articles 6 and 9 of the GDPR and insofar as necessary, the following categories of recipients are allowed to consult patients' personal data:
- Insurance companies, insofar as this is required by or under the law or authorized by the patient;
- The National Institute for Health and Disability Insurance (INAMI) under the law or as authorized by the patient;
- The patients concerned or their representatives in accordance with the provisions of the law of 22 August 2002 on patients' rights;
- At the patient's demand, after the patient has been informed and given explicit consent, any authorized person;
- Public bodies authorized by a decision of the authorities;
- The patient's external care providers in the context of the patient's care;
- All bodies to the extent that this is required by or under the law or authorized by the patient;
- The hospital's professional liability insurer or the hospital's appointed practitioner, insofar as such disclosure is necessary for the defense in a legal claim or to initiate, exercise or support a legal action.
We may also communicate some of your personal data to respond to legitimate requests from university researchers or research departments, in the context of scientific, historical or statistical surveys, insofar that these data are made anonymous or pseudonymized.
Finally, we may also share some of your data with our co-contractors, qualified as subcontractors within the meaning of the RGPD, insofar as this is strictly necessary for the operation of computerized or non-computerized applications or management systems to which we have subscribed.
The list of subcontractors to whom your data are communicated, their field of activity, the purpose and, if applicable, the country in which the data are stored is available from the “privacy” department gdpr@cdle.be or from our DPO.
In all circumstances, we will not pass on any personal data to third parties without your consent, except in the cases listed above. Any other transfer of data will be subject to your prior consent.
The Europe hospitals participate in care networks. Within these networks, the partner institutions will make the information they hold on you available to professionals via the shared care file. These institutions for health and care services participate in the following care networks:
- Cliniques Universitaires Saint Luc
- Clinique Saint-Jean
- Clinique Saint Pierre Ottignies
These networks are ruled by the law amending the coordinated law of 10 July 2008 on hospitals and other care institutions with regard to clinical networking between hospitals.
9. Safety measures
The Europe hospitals as data controller and its subcontractors, where applicable, implement and maintain adequate technical and organizational measures to secure personal data against any prohibited or illicit access, communication, modification, loss or accidental destruction.
The conservation, hosting, storage, consultation and communication of your data are carried out in accordance with the good practices and minimum standards imposed on the health care sector by the competent authorities.
The Europe hospitals have put in place appropriate procedures to deal with any suspected breach of personal data. Where it is legally required to do so, the Europe hospitals will inform you in the event of a breach which has an impact on your data as well as the Data Protection Authority and any competent body.
Read more...
The main security measures taken by the Europe hospitals are the following:
- Protection by physical security measures of the premises where the stored data are located (identified and protected premises, limited access, devices to prevent the treatment of physical dangers such as fire, water damage, etc.);
- Protection of secure areas to ensure that only authorized staff members are allowed access (physical access controls);
- Restricting access to information and information processing facilities. Restrictions and controls are carried out in relation to the limited and authorized logical access of the staff members of the Europe hospitals. Each user has a personal and confidential identifier and password (logical access control);
- Implementation of a password policy including a single authentication service and the obligation to change the password periodically;
- Implementation of traceability mechanisms for the identification, collection, processing, retention and deletion of information, which may be used as evidence;
- Reduction or elimination of the identifying character of personal data when the processing allows it (pseudonymization or anonymization). Pseudonymization is particularly reinforced in development or test environments;
- Protection of information and information processing equipment against malicious software (protection against malicious codes);
- Management of security incidents according to a specific procedure;
- implementation of a data backup and restoration policy;
- Implementation of measures to protect information on communication networks (network security);
- Implementation of measures to protect information when it is transferred to an external entity (transfer of information);
- Data protection awareness among staff members;
- Restricting access to external recipients who have secure access to only those data and environments that are necessary for their work.
10. Transfers outside of Europe
Les transferts des données vers un pays hors de l’Union Européenne seront autorisés uniquement dans les occurrences suivantes :
- The European Commission has issued a decision granting an adequate level of protection equivalent to that provided by European legislation, and personal data will be transferred on this basis.
- The transfer is covered by an adequate measure granting a level of protection equivalent to that provided by European legislation, such as the Commission's standard clauses or your consent.
11. How long are your data processed ?
We will only keep your personal data for as long as is strictly necessary to fulfil our legal obligations or contractual obligations in the context of processing your file.
Taking into account any legal provisions, the minimum storage periods are as follows:
- 30 years minimum to 50 years maximum for medical data;
- 7 years for billing data from patient files used as supporting accounting documents and for duplicates of certificates of assistance provided, individual invoices and summary invoice;
- 1 year for closed mediation service files;
- 1 month for camera images (except in the case of proof of infraction).
The time limits start from the last hospital discharge or the last treatment of the patient.
On expiry, the personal data concerned are deleted from the files and destroyed within one year.
The destruction is postponed if:
- Retention is required by law;
- Storage is necessary from a medical point of view or in order to defend our interests or those of another person concerned;
- Storage is agreed between the patient and the treating hospital doctor or, in the absence, the head doctor.
- Anonymized data are not subject to destruction.
12. Your rights
We pay particular attention to your rights as a data subject. We are at your disposal and invite you to contact our DPO at the following e-mail address: gdpr@cdle.be.
You can use the following rights:
Right of access, information and rectification
At any time you may request information about our processing operations, the purposes for which they are carried out, the categories of personal data we keep about you, the categories of recipients of such data (third countries or international organizations), the retention periods or the criteria used to determine them, your other rights, the other sources from which your data originate and the existence of an automated decision-making process.
You may also request that your data are corrected or completed if they are inaccurate or incomplete. When exercising this right you must indicate the precise data you wish to have corrected or completed (for example your age, your address, etc.). Please note that not all data contained in the medical file can be modified. The data that can be modified are only the fatal data on which an error has occurred.
We will respond to your request as soon as possible, but we are always obliged to take into account the rights and freedoms of other persons when providing this information.
Right to restrict processing
You have the right to demand the restriction of the processing of your personal data if:
- You contest the accuracy of this data;
- You are in the waiting period necessary to assess the interests involved before exercising the right to object to the processing of some of your personal data;
- The processing of your personal data would be unlawful, nevertheless you do not wish to exercise your right to data erasure.
We no longer need your personal data for the purposes listed in this data protection statement, but you do need it for the purposes of legal proceedings.
This is a kind of freeze on the use of your data, which will be retained but not used.
Right of objection
You may object to the processing of your personal data if your data are processed based on our legitimate interest or based on consent. In order to exercise this right, you will need to indicate in an e-mail which specific processing you object to and for what specific reasons. This information is necessary in order to ensure the correct balance of interests. The Europe hospitals will cease processing your data unless it can demonstrate that there are compelling legitimate reasons that override your interests.
You can also click on the “unsubscribe” tab that you will find in every e-mail you receive from us.
Right to portability of your data
If your data are processed in the context of our contractual obligations or consent, you have the right to request that your personal data are transferred to you in the form in which we hold them or be transferred to another controller designated by you.
To exercise this right, you should indicate on the form, which we make available to you on our website. You can also send us an e-mail to the following address: gdpr@cdle.be.
Right to erasure of data (right to be forgotten)
In the cases provided for by the GDPR or the law, we will delete your personal data on your simple request.
In principle, you can exercise your rights free of charge. To do so, you can send us an e-mail to the following address: gdpr@cdle.be.
Within one month of receiving your request, we will inform you in writing of the action we have taken on your request. Depending on the difficulty of your request or the number of requests we receive from other people, this deadline may be extended by two months. In this case, we will notify you of this extension within one month of receiving your request. In certain cases (e.g. legal obligations, rights of other persons, limitation periods,...), you will not be able to exercise your rights, in whole or in part. You will be informed of this and of the reasons why we can’t fully comply with your request.
Right to withdraw your consent
You have the right to withdraw your consent:
- at any time;
- without any particular reason;
- without affecting the validity of the processing carried out prior to the withdrawal.
To exercise this right, please contact gdpr@cdle.be
13. Questions and remarks or complaints
If you have any questions, remarks or complaints about the protection of your personal data, we are at your disposal. If you are aware of a data leak or suspect a data leak, we ask you to notify us immediately at gdpr@cdle.be
In addition and in accordance with article 37 of the GDPR, we have appointed a DPO. You can contact her at the following e-mail address gdpr@cdle.be or by post at the following address: Europe hospitals, Avenue De Fré 206, 1180 Uccle.
You also have the right to lodge a complaint with the Data Protection Authority (DPA) at the following address: rue de la Presse 35 - 1000 Bruxelles - telephone 02/274.48.00 - or via their website: https://www.autoriteprotectiondonnees.be
14. Data leakage
Any person who becomes aware of a breach, leakage or loss of personal data must notify the Europe hospitals through its data protection officer as quickly as possible and provide as much information as possible about the breach.
Thereafter, the Europe hospitals will take all necessary steps, namely:
- Investigation, evaluation and follow-up of the incident;
- Taking measures to remedy, prevent or reduce the consequences of the incident;
- Notification to the Data Protection Authority, if applicable;
- Communication to data subjects, if applicable