EU court ruling may impact health identifier plans

Health authorities are examining the possible impact of a major EU court ruling on their work to date on a plan to give every person in the State a unique health identifier.

In a ruling on a Romanian case earlier this month, the Court of Justice of the European Union ruled that public bodies of EU member states were precluded from transferring personal information to another public administrative body without the affected citizens having been informed first.

Known as the Smaranda Bara case, it will have significant implications for any state project that involves sharing personal information across departments or agencies.

The individual health identifier (IHI) is a key part of the Government’s e-health strategy and aims to improve patient safety by using a unique number to track every person through the health system from cradle to grave.

An initial database set up to test the identifier system draws on information from the Department of Social Protection, such as the personal public service number (PPSN).

Legislation to enable the project states that a Government minister may provide an individual’s identifying details to the Minister for Health for the purpose of setting up the national register of health identifiers.

The HSE's chief information officer Richard Corbridge recently signalled the Department of Health was seeking advice following the Bara judgment, prior to taking the next steps with the project.

Asked to comment on that review, the HSE said the introduction of health identifiers was currently being implemented as directed by the Health Identifiers Act 2014.

Any new EU legislation in this field must be considered for its impact and “where changes may be necessary they will be made”, the HSE said.

“The review of legislative changes and the impact of these will be undertaken by the Department of Health who will work with the HSE to ensure appropriate action is taken where necessary,” the HSE said.

It said the value and need for an unique identifier for health was clear in the areas of patient safety, healthcare efficiency and privacy auditing. It was committed to the delivery of the health identifiers project in 2016.

The HSE said the Data Protection Commissioner was aware of the current development work on the IHI and “is currently in agreement with how it has been created and deployed”.

Draft version

A public consultation process will commence later this year and a draft version of a privacy impact assessment – work on which has already begun – would be available then.

The Data Protection Commissioner’s office confirmed it continued to have “some discussions with the HSE in relation to the IHI”.

It had had consultations with the HSE in the past, particularly in relation to the legislation as it was being drafted.

“As is the case generally, the office would have issued guidance and made best practice recommendations to the HSE in relation to the issue. However the office does not give approval to legislation or public sector projects as it must retain its independent status should it need to investigate complaints.”

The Bara case concerned the transfer of information about self-employed individuals’ incomes by a tax authority to a health insurance fund for the purposes of assessing their liability for arrears payments.