When does medical privacy start? In a conversation between, say, Alice and Bob, if Bob shares his medical history with Alice, under which conditions is this information considered private medical information? If Alice is a physician? If Bob knows that she is a physician? If Bob asks for medical advice/treatment specifically (as opposed to, say, simply complaining about his health)? Generally speaking, is medical information shared in an informal context (e.g. chatting with a family friend who happens to be a doctor) as protected as information provided in official medical contexts (e.g. during an appointment in a hospital)?
(Since no jurisdiction was given this answer will apply to US federal law) Hipaa lays out the standards for medical information privacy. The language of Hipaa is written in a way that clearly defines the relationship that two parties must have for the privacy of medical information to be protected. Party A: "Health Care Provider" (Could be more then one person) Party B: "Patient" If Alice is not acting as bob's Health Care Provider then Alice has no obligation to protect Bob's medical information. In addition, if Alice were to share Bob's medical information with Bob's friends, then Bob wouldn't have grounds to sue Alice under the Tort of "invasion of privacy" because Bob broke his own exception of privacy by willfully ,and intentionally disseminating his medical information. Alice is safe from both criminal and civil action.
The regulations known as HIPAA are here. A good place to start is with who the regulations apply to. §160.10 lays that out: a health plan, health care clearinghouse, care provider, their business associates, and the Inspector General. Family members are not regulated entities. Subpart E regulates individually identifiable health information (such as "person X has condition Y") – this is protected information. §164.502 states that A covered entity or business associate may not use or disclose protected health information except as permitted or required by this subpart or by subpart C of part 160 of this subchapter. The first permitted use / disclosure is that the information may be revealed to the individual (the individual). Under 164.502(a)(2)(1) they are required to reveal information to an individual "when requested under, and required by §164.524 or §164.528" (you have a right to see your own record; you have a right to know who knows). 164.502(g) requires the covered entity to treat the "Personal Representative" as the same as the individual, and then there is a list of conditions surrounding being a personal representative, reducing to being empowered under law to act on behalf of the individual in making health decisions (it gets complicated in dealing with minors). 164.510 covers disclosure in emergencies, and under (b)(2) allows disclosure to a family member with advance consent of the individual. And so on. There is no general rule "and the covered entity may / must reveal private information to an interested individual", even a spouse, without consent of the individual. In other words, the doctor has an obligation to not disclose this information, unless permitted by the individual.
united-states Is a personal text (like a diary), submitted without the consent of the author, admissible evidence? Usually, it is admissible evidence. There is no legal right to keep your diary private. Production of a diary may be compelled by subpoena and admitted into evidence subject only to general considerations regarding whether particular entries in the diary are inadmissible for some other reason (e.g. lack of relevance, they recite the contents of an otherwise privileged discussion, they contain hearsay, they recite the terms of a settlement offer, the recite inadmissible prior act evidence, etc.). If the diary revealed information that could place the diarist at risk of criminal prosecution, the 5th Amendment privilege against self-incrimination could arguably be claimed even in a civil case, but at the risk of an adverse inference to be drawn from that decision in civil matters. I haven't ever seen how that issue is resolved legally.
The relevant legal requirement to have accurate records is 45 CFR 156.526, where An individual has the right to have a covered entity amend protected health information or a record about the individual in a designated record set for as long as the protected health information is maintained in the designated record set. The request can be denied if the record is accurate and complete. A simple and pointed solution is to print that page and circle the section, in a letter requesting an amendment. A somewhat more costly and much more effective solution would be to get a lawyer to write a letter in legalese. It is hard to imagine that the provider would not comply. You will notice that they have 60 days to comply (+30 days extension if requested). If for some reason they insist on leaving the record as is, you have the right to insert rebuttal statements into the record (basically, prove that the record is false). There is no realistic hope of compensation for annoyance, but you can hope for a correction.
It's hard to prove a negative, and I'm not sure which specific part of the quoted Terms you object, to, but it specifically states that content access may be done to: Comply with the law Protect its customers; and Protect the security of its business; and Protect its business interests. It's unlikely that access of information to comply with the law is illegal. At least one EU directive, Directive 95/46/EC, sets limits on the collection and use of personal information. We're concerned with the first condition for lawful data processing, and the second principle of data quality. Data processing is only lawful if the data subject has unambiguously given his consent; or processing is necessary for the performance of a contract to which the data subject is party; or processing is necessary for compliance with a legal obligation to which the controller is subject; or processing is necessary to protect the vital interests of the data subject; or processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller or in a third party; or processing is necessary for the purposes of the legitimate interest pursued by the controller or by the third party, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject which require protection. The principles of data quality, which must be implemented for all lawful data processing activities, are the following: personal data must be processed fairly and lawfully, and collected for specified, explicit and legitimate purposes. They must also be adequate, relevant and not excessive, accurate and, where necessary, kept up to date, must not be stored for longer than necessary and solely for the purposes for which they were collected; special categories of processing: it is forbidden to process personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life. This provision comes with certain qualifications concerning, for example, cases where processing is necessary to protect the vital interests of the data subject or for the purposes of preventive medicine and medical diagnosis. So, let's say that someone has given their consent. It'd be at least a little questionable whether the inspection of private information could mean that they access personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life. I'm a bit less clear on US laws, but you'd probably look for laws around Personal Identifying Information, as that's where a lot of focus has been.
Can you anonymise people It is valid to anonymise the data of people, instead of deleting all of the records. The principles of data protection should apply to any information concerning an identified or identifiable natural person. Personal data which have undergone pseudonymisation, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person. To determine whether a natural person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person to identify the natural person directly or indirectly. To ascertain whether means are reasonably likely to be used to identify the natural person, account should be taken of all objective factors, such as the costs of and the amount of time required for identification, taking into consideration the available technology at the time of the processing and technological developments. The principles of data protection should therefore not apply to anonymous information, namely information which does not relate to an identified or identifiable natural person or to personal data rendered anonymous in such a manner that the data subject is not or no longer identifiable. This Regulation does not therefore concern the processing of such anonymous information, including for statistical or research purposes. Source As long as the person is not identifiable, then you do not need to treat the data as personal under the GDPR. You do have to inform a person once they are no longer identifiable, and be able to identify them if they provide the missing information: If the purposes for which a controller processes personal data do not or do no longer require the identification of a data subject by the controller, the controller shall not be obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with this Regulation. Where, in cases referred to in paragraph 1 of this Article, the controller is able to demonstrate that it is not in a position to identify the data subject, the controller shall inform the data subject accordingly, if possible. In such cases, Articles 15 to 20 shall not apply except where the data subject, for the purpose of exercising his or her rights under those articles, provides additional information enabling his or her identification. Source The articles covered by this are: 15 - Right of Access 16 - Right to rectification 17 - Right to erasure 18 - Right to restrict processing 19 - Right to be informed 20 - Right to data portability
I don’t understand why you think this is a “3rd party communication” - as I read it it says it’s an email from you. You are most definitely not a third party. Notwithstanding, communication between 3rd parties is not prima facie excluded. For example, correspondence between your company and your accountant (who are both third parties) is likely to be extremely relevant to a family law case. Assuming that it is relevant (which is hard to say without context) and that it doesn’t fall foul of one of the evidentiary rules (hearsay, opinion, privilege etc.) there is no reason why it wouldn’t be admissible.
Storing medical data in cloud services can be legal, but isn't necessarily so (as with any other kinds of data). The GDPR considers health-related data as “special categories” of data per Art 9. Processing such data is forbidden, unless an exception applies. Per Art 9(2)(h) such processing is allowed when it is […] necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3 Paragraph 3 requires that processing under 9(2)(h) only occurs under the responsibility of someone who is subject to an obligation of secrecy per Union or member state law, e.g. a doctor. Paragraph 4 allows individual member states to add further conditions, including limitations, to such processing. Assuming that electronic storage or processing of health data is in fact necessary, the GDPR does not make a strong distinction between in-house processing, and processing via Data Processors. Of course, the usual conditions for using data processors and performing international transfers apply. However, a data controller processing medical data will almost certainly have to first perform an Art 35 Data Protection Impact Assessment. This DPIA must consider various risks. Transferring data into third countries is risky. Using data processors is risky. But processing data in-house can also be risky, so using an external service could improve things. There is a lot to be balanced here. Where the planned processing has high risks, the responsible supervisory authority has to be consulted first (Art 36). The authority can provide “advice”, or even ban the processing per Art 58.