We are nowadays more than familiar with the term ‘data protection law’, especially from the user’s point of view. However, businesses also have a very important responsibility, which is to comply with this law and to inform customers about the processing of their data.
In laboratories, which handle and coordinate thousands of different patients’ data, their security is paramount, as they are the ones who keep the patient’s medical history and any information they may need to assist in medical monitoring or to make a diagnosis. How might this differ from other sectors with regard to data handling? As a laboratory, is there anything we need to know? Today we will look at all these questions, but first we need to address a more general one.
What is data protection law?
Although we often hear or read that our data is protected, we may not fully understand the scope of this law. In fact, it is actually a set of regulations designed to protect the privacy and security of individuals’ personal information.
The central aim of data protection law is to protect the rights of individuals over their personal information, ensuring that they have control over their data and that it is treated with appropriate respect and confidentiality. This includes preventing the misuse of data, preventing data from being collected without consent, and protecting against potential privacy breaches.
Key concepts
Although data protection law is of fundamental importance in any field or sector, given all the digital developments, the laboratory sector has been the most affected. Clinicians should always go one step further and pay special attention to all the information they have in storage. This can be divided into several key groups:
Personal data
Refers to any information that can directly or indirectly identify an individual. This includes data such as name, address, identification number, contact information, images, and even biometric and health data. The latter would be the most necessary and useful in a laboratory.
Sensitive data
They are those which, due to their nature, require additional protection, such as information related to a person’s health, religious beliefs, sexual orientation or political opinions. They are accorded more stringent treatment because they are considered more vulnerable.
Consent
Data protection laws require individuals to give their free, specific, informed and explicit consent for their data to be processed. This means that they must clearly understand what their data will be used for and be aware that they are free to give or withhold that permission.
Data subjects’ rights
Individuals have certain rights over their personal information, such as the right of access, rectification, erasure and/or objection.
Responsibility of entities
Organisations that handle personal data are responsible for protecting that information. They should implement appropriate security measures, such as data encryption, and ensure that only authorised personnel have access to the information.
Data protection has become essential in the digital age, as the amount of personal information being collected and processed has increased significantly due to the digitisation of services, the use of social media, e-commerce and other technologies. Data protection law seeks to balance the power between individuals and the entities that handle their information, ensuring that technological development does not compromise individuals’ rights to privacy and control over their information.
What are its objectives?
The aim of data protection law is to guarantee the privacy and security of individuals’ personal information by regulating how organisations, companies and public or private entities should collect, store, use and share such information. These regulations ultimately seek to protect the rights of individuals over their own information, ensuring that it is treated in a transparent, secure and fair manner. Some of their other objectives, in addition to protecting the privacy of individuals, are:
Securing the right to our data
Data protection laws give individuals specific rights over their information, such as the right of access, rectification, erasure and objection (known as ARCO rights). This means that individuals can find out what information an entity holds about them, correct it if it is incorrect, request its deletion and object to its processing.
Establishing security standards for data processing
Impose on organisations the obligation to implement technical and organisational security measures to protect personal data against unauthorised access, loss, destruction or alteration. By this we mean the use of encryption, user authentication and security protocols that guarantee the integrity of the information.
Promoting transparency in data processing
This set of laws obliges organisations to be transparent about how they handle personal information, advising users of the purpose for which their data will be processed. This is reflected in the need for clear privacy policies, which explain in a simple way to users how their data will be handled.
Regulating international transfers
Data protection laws also regulate how personal data can be transferred between different countries to ensure that the same level of protection is maintained, even when information is shared across national borders. This is especially important for companies that manage data globally and need to ensure that it is protected, no matter where it is located.
Promoting the accountability of entities
Organisations that collect and process personal data have an obligation to be responsible and accountable for how they handle this information. This implies that they must be able to demonstrate that they comply with data protection regulations (the principle of proactive accountability or ‘proactive accountability’).
How does data protection law work in a laboratory?
Data protection law in a laboratory, as in any other data collection institution, aims to ensure the privacy and security of information relating to individuals.
In the context of a clinical or research laboratory, the application of these regulations is particularly relevant, as sensitive data about people’s health, such as medical test results and diagnoses, are handled. Hence, there are certain key aspects that only laboratories should take into account:
Main data protection regulations
The laws regulating data protection vary according to jurisdiction, but the most relevant at the international level within the European Union is the General Data Protection Regulation (GDPR). In many Latin American countries there are national laws such as the Ley Federal de Protección de Datos Personales (in Mexico) or the Ley de Protección de Datos Personales (in Argentina). All of them establish principles and obligations for entities that process personal data, which include clinical laboratories.
Relevant types of data in a laboratory
This includes information such as name, address, identification number, telephone number and e-mail address. In the context of a laboratory, the most relevant and sensitive would be health-related data, such as clinical test results, medical diagnoses, disease history and other data that could reveal information about a person’s health.
The law provides a higher level of protection for sensitive data because of its confidential nature and the impact that a leak or misuse of this information could have.
Obligations of laboratories
Laboratories should only collect data necessary to perform their functions, such as testing and analysis. They must have the patient’s informed consent before collecting and processing their data. This must be clear, specific and must detail what the data will be used for and how it will be stored.
The patient has the right to know what data has been collected, the purpose of its use and, in some cases, to request its deletion once it is no longer needed.
Transparency and data subjects’ rights
Laboratories must inform patients about their rights, such as the right of access, rectification, erasure and objection. A patient can request to know what information the laboratory holds about them, correct errors, request deletion of their information, or limit the use of their data for certain purposes.
It is essential that laboratories implement appropriate security measures to protect patients’ personal and health information. This includes technical (encrypted systems, secure networks, etc.) and organisational measures (staff training on data protection issues, procedures for secure handling of information, etc.).
All of them must be proportionate to the sensitivity of the data being handled and must be regularly reviewed and updated to adapt to new threats.
Management of security breaches
In the event of a security breach, laboratories are obliged to notify the relevant data protection authorities and, in some cases, the data subjects within a specified time. Patients then take steps to protect themselves.
Confidentiality of personnel
Laboratory staff, especially technicians, analysts and administrative staff, who manage patient data, must sign confidentiality agreements that ensure that they will not disclose information obtained in the course of their work. In addition, ongoing training of staff in the proper handling of information is essential, ensuring that they understand the importance of data protection and the legal consequences of improper handling.
Data processing in research studies
When a laboratory conducts research studies, especially with patient data, they must take into account the regulations on the processing of patient data for scientific purposes. In many cases, additional consent from the patient is required for the use of their information. In addition, anonymisation techniques may have to be applied to protect the identity of individuals.
Storage and retention of data
Personal data should not be retained for longer than is necessary to fulfil the purpose for which it was collected. Laboratories should establish retention policies that indicate the length of time for which information will be stored and the procedures for its secure destruction once it is no longer needed.
A laboratory must take into account a multitude of issues, with patient data being one of the most important, especially with the development of technology. That’s why at Ambar Lab we offer you our consultancy services. We will help you diagnose areas for improvement within your clinical laboratory, recommend actions to improve growth prospects and draw up a detailed action plan to ensure success. If you want to know what else we can do for you, just get in touch with our team, who will answer all your questions.
