Act on a Health Sector Database nº. 139/1998
(Passed by Parliament at 123rd session, 1998-99)
Index:
Section I - General terms
Section II - Licence and committee on the creation and operation of a health sector database
Section III - Collection of information
Section IV - Access to the database and utilisation of data, etc.
Section V - Monitoring
Section VI - Penalties
Section VII - Various provisions
SECTION I. General terms
Art. 1. Objectives
The objective of this legislation is to authorise the creation and operation of a centralised database of non-personally identifiable health data with the aim of increasing knowledge in order to improve health and health services.
Art. 2. Scope
This legislation extends to the creation and operation of a centralised health sector database. The legislation does not apply to the medical record systems of individual health and research institutions, data collections made in connection with scientific research into individual diseases or groups of diseases, nor to records kept by health and social security authorities on users of the health service and operation of the health service. The legislation does not apply to the storage or handling of, or access to, biological samples.
Art. 3. Definitions
In this legislation the following definitions apply:
1. Health sector database: A collection of data containing
information on health and other related information, recorded in
a standardised systematic fashion on a single centralised
database, intended for processing and as a source of
information.
2. Personal data: all data on a personally identified or
personally identifiable individual. An individual shall be
counted as personally identifiable if he can be identified,
directly or indirectly, especially by reference to an identity
number, or one or more factors specific to his physical,
physiological, mental, economic, cultural or social identity.
3. Non-personally identifiable data: data on a person who is not
personally identifiable as defined in clause 2.
4. Coding: the transformation of words or numbers into an
incomprehensible series of symbols.
5. One-way coding: the transformation of words or series of
digits into an incomprehensible series of symbols which cannot
be traced by means of a decoding key.
6. Health data: information on the health of individuals,
including genetic information.
7. Genetic data: any data; of whatever type, concerning the
heriditary characteristics of an individual or concerning the
pattern of inheritance of such characteristics within a related
group of individuals. It also refers to all data on the carrying
of any genetic information (genes) in an individual or genetic
line relating to any aspect of health or disease, whether
present as identifiable characteristics or not.
SECTION II. Licence and committee on the creation and operation of a health sector database
Art. 4. Grant of operating licence and payments by licensee
The creation and operation of a health sector database are only
permitted to those who have an operating licence by the terms of
this legislation.
When an application has been received, the Minister of Health
may grant an operating licence to create and operate a health
sector database subject to the further terms of this
legislation.
The licensee shall pay a fee for the grant of the licence in
order to meet the costs of preparing and issuing the licence.
The licensee shall also pay a yearly fee equivalent to the costs
of the work of the committee under the terms of Art. 6, and
other costs pertaining to service and monitoring of the
operation, including monitoring by the Data Protection
Commission under the terms of legislation on the recording and
handling of personal data, and costs of publication and
publicity cp. Art.8.
The licensee shall pay all costs of processing information for
entry onto the database, cp. Clause 8, Art 5.
The minister and licensee may agree on further payments to the
Treasury, which shall be devoted to promoting the health
service, research and development.
Art. 5. Conditions of licence etc.
An operating licence for the creation and operation of a health
sector database is contingent upon the following conditions:
1. The database must be located exclusively here in Iceland.
2. Technical, security and organisational standards meet the
requirements of the Data Protection Commission.
3. The recording and processing of health data shall be carried
out by, or under the supervision of, people who are
professionally qualified in the health sector.
4. Detailed information shall be available on the area of
activity and projects of the applicant for a licence.
5. A detailed work plan from the applicant shall be available,
which shall fulfil the conditions and objectives of this Act
regarding working arrangements and progress.
6. The operation of the database shall be financially separate
from the licensee's other business.
7. The Ministry of Health and Social Security and the Director
General of Public Health shall at all times have access to
statistical data from the database in accessible form, so that
they will be of use in statistical processing for compiling
health reports and planning, policy-making and other projects of
the parties specified.
8. The licensee shall pay all costs of processing data from
health institutions and self-employed health workers for entry
onto the database. The data shall be processed in a manner that
fulfils the needs of the relevant institution or self-employed
health worker for a standardised information system, the needs
of medical specialist fields and the requirements of health
authorities, cp. Clause 7, and so that it can be used in
scientific research.
9. The licence shall be temporary, and it shall not be granted
for more than 12 years at a time.
10. The licensee shall hand over to the committee cp. art. 6 a
copy of the database, which shall be updated regularly, to be
further specified in the licence. A copy of the database shall
always be stored in a bank safety deposit box, or in some other
secure manner, to be further specified in the licence.
11. The licensee shall ensure that after the expiry of the
period of the licence, the Minister of Health and Social
Security, or the party assigned by the Minister to operate the
database, shall receive indefinite use of all software and right
required for the maintenance and operation of the database.
The Minister may make the licence subject to further conditions
than those specified above.
At the end of the period of the licence by the terms of the
licence, the Minister shall make a decision on the operation of
the database, after receiving the opinion of the committee cp.
art. 6 and the Data Protection Commission. The same applies if
the licence is revoked or if the licence is withdrawn from the
licensee by the terms of this legislation.
The licence and database under the terms of this legislation
cannot be transferred, nor can they be subjected to attachment
for debt. Neither the licence nor the database may be used as
collateral for financial liabilities.
Art. 6. Committee on the creation and operation of a health
service database
The Minister shall appoint a committee on the creation and
operation of a database under the terms of this legislation. The
committee shall comprise three people and three substitutes,
appointed for four years at a time. One shall be a health sector
worker with a knowledge of epidemiology, another shall have
knowledge of information technology and/or computer science, and
the third shall be a lawyer, and shall chair the committee.
Their substitutes shall fulfil the same conditions.
The role of the committee is to ensure that the creation and
operation of the database are in keeping with the terms of this
legislation, regulations made on the basis of the legislation,
and conditions laid down in the operating licence, in so far as
this does not fall within the ambit of the Data Protection
Commission. The committee shall supervise the negotiation of
contracts between the licensee on the one hand and health
institutions and self-employed health workers on the other. It
shall protect the interests of health authorities, health
institutions, self-employed health workers and scientists in the
drawing up of agreements. The sum to be paid by the licensee
under the terms of para.3 art. 4. shall be negotiated by the
committee, as shall recompense in the form of access to data
from the database for health institutions, self-employed health
workers and their staff for purposes of scientific research.
The committee shall advise the Ministry of Health and the
Director General of Public Health on the utilisation of data
from the database. Should the operating licence be revoked or
the licence withdrawn from the licensee, the database shall be
operated by the committee until the Minister has reached a
decision on its long-term operation, cp. Para. 3, Art. 5.
The committee shall be provided with staff and working
facilities. The committee shall seek specialist assistance as
deemed necessary.
The committee shall inform the Minister and the Data Protection
Commission without delay if it believes that there is some
defect in the operation of the database.
The committee shall, no later than 1 March each year, submit a
report to the Minister on the operations of the past year
SECTION III. Collection of information
Art. 7. Access to data from health records
With the consent of health institutions or self-employed health
workers, the licensee may be provided with data derived from
medical records for entry onto a health sector database. The
health institutions shall confer with the physicians' council
and specialist management of the relevant institution before
contracts are concluded with the licensee.
In the handling of records, other data and information, the
conditions deemed necessary by the Data Protection Commission at
any time shall be complied with. Personal identification shall
be coded before entry on the database, so that it is ensured
that the licensee's staff work only with non-personally
identifiable data. The staff of the relevant health institution
or self-employed health workers shall prepare the data for entry
on the health-sector database. Health data shall be transferred
in coded form in order to ensure their security. Personal
identification shall be coded one-way, i.e. by coding that
cannot be traced using a decoding key. The Data Protection
Commission shall carry out further coding of personal
identification, using those methods that the commission deems to
ensure confidentiality best.
With regard to access to data from medical records, this shall
otherwise be subject to the Acts on the rights of patients, on
physicians, on the health service and on the recording and
handling of personal data.
Art. 8. Rights of patients
A patient may request at any time that information on him/her not be entered onto the health-sector database. The patient's request may apply to all existing information on him/her or that which may be recorded in the future, or to some specific information. Such a request must be complied with. The patient shall inform the Director General of Public Health of his/her wish. The Director General of Public Health shall produce forms for giving such notice, and shall ensure that these are available at health institutions and at the premises of self-employed health workers. The Director General of Public Health shall ensure that a coded register of the relevant patients is always accessible for those who carry out the entry of data onto the health-sector database.
The Director General of Public Health shall ensure that information on the health-sector database and on the rights of patients cp. para. 1 shall be accessible to the public. Health institutions and self-employed health workers shall have this information available to patients on their premises.
SECTION IV. Access to the database and utilisation of data, etc.
Art. 9. Access by health authorities to data on the
health-sector database
The Ministry of Health and Director General of Public Health shall always be entitled to statistical data from the health sector database so that it may be used in statistical processing for the making of health reports and planning, policy-making and other projects of these bodies. This information to the specified parties shall be provided free of charge.
Art. 10. Utilisation of the health sector database
Data recorded or acquired by processing on the health-sector
database may be used to develop new or improved methods of
achieving better health, prediction, diagnosis and treatment of
disease, to seek the most economic ways of operating health
services, and for making reports in the health sector.
The licensee shall be authorised to process data on the health
sector database from the health data recorded there, provided
that data are processed and connected in such a way that they
cannot be linked to identifiable individuals. The licensee shall
develop methods and protocols that meet the requirements of the
Data Protection Commission in order to ensure confidentiality in
connecting data from the health-sector database, from a database
of genealogical data, and from a database of genetic data. With
regard to linking the data on the health-sector database with
other databases than those specified here, the Act on recording
and handling of personal data shall apply. It is not permissible
to give information on individuals, and this shall be ensured
e.g. by limitation of access.
The licensee may not grant direct access to data on the
database.
The licensee is authorised during the period of the licence to
use the data on the database for purposes of financial profit,
under the conditions laid down in this legislation and the
licence.
The health service database may not be transported out of
Iceland, and processing of it may only be carried out here in
Iceland.
Art. 11. Confidentiality
Employees of the licensee, including contractors, are bound by an obligation of confidentiality on matters that they become aware of in their work which should remain confidential, by law or by their nature. They shall sign an oath of confidentiality before they begin work. The obligation of confidentiality remains in force, even if employment ceases.
SECTION V. Monitoring
Art. 12. Monitoring of the creation and operation of a
health-sector database
The Data Protection Commission shall monitor the creation and operation of the health sector database with regard to recording and handling of personal data and the security of data on the database, and is responsible for monitoring compliance with conditions laid down by the commission.
The committee on the operation of the database, cp. Art. 6,
shall be responsible for monitoring the compliance in every way
of the activities of the health sector database with the terms
of this legislation, regulations issued under the terms of this
legislation, and the conditions of the licence. The committee
shall monitor all questions to and processing from the database.
It shall regularly send to the Science Ethics Committee a record
of all questions processed on the database, together with
information on the enquirers.
The minister shall issue regulations on an interdisciplinary
ethics committee which shall assess studies carried out within
the licensee's company and questions which are received. The
committee's evaluation must reveal that there is no scientific
or ethical reason to prevent the study in question being carried
out, or the questions processed from the database.
SECTION VI. Penalties
Art. 13. Revocation of licence
The Minister may revoke the licence under the terms of this legislation if the licensee or the licensee's employees violate the terms of legislation, if the conditions of the licence are not fulfilled, or if the licensee becomes unable to operate the database. Should the licensee violate the terms of this legislation or not comply with the conditions of the licence, the Minister shall give the licensee a written warning, allowing a reasonable period of grace to rectify matters. Should the licensee not comply with such a warning, the licence shall be revoked. In the case of deliberate violation or gross negligence, the Minister may revoke the licence without notice and without allowing time for rectification.
Art. 14. Penalties
Violation of the terms of this legislation entails fines or
imprisonment for up to three years, unless a more severe penalty
is prescribed in other legislation.
The same penalties apply to failure to comply with the
conditions for granting of an operating licence under the terms
of this legislation, or government regulations under the terms
of the legislation, or failure to comply with a command or
prohibition under the terms of the legislation, or government
regulations under the terms of the legislation.
A legal entity may be sentenced to pay fines due to violation of
this Act or regulations based on it. A legal entity may be fined
regardless of the guilt of its employees. The legal entity shall
be responsible for payment of a fine imposed upon an employee of
the legal entity, provided that the offence is connected to the
employee's work for the legal entity.
Art. 15. Withdrawal of licence etc.
The licensee may, in addition to the penalties specified in
Art. 14, be subject to revocation of the licence by legal
verdict, in the case of deliberate violation or gross
negligence.
Equipment which has been used for serious violation of this
legislation may be confiscated, together with the profits of the
violation, cp. Art. 69 of the Penal Code no. 19/1940.
Art. 16
Attempted violation, and participation in violation, of this
legislation are subject to penalties as stated in section III of
the Penal Code, no. 19/1940.
Art. 17. Compensation
Should the licensee, an employee of the licensee or a person
assigned to process data violate the provisions of this Act with
regard to confidentiality, regulations issued on the basis of
them, or the conditions laid down by the Data Protection
Commission, the licensee shall compensate the person to whom the
data relate for financial loss which this has caused.
The licensee, however, is not obliged to compensate for loss
which the licensee proves not to be attributable to a mistake or
negligence on the licensee's part, or that of an employee or
processor.
SECTION VII. Various provisions
Art. 18. Regulations
The Minister may prescribe further terms on the practice of
this Act by issuing regulations.
The Minister shall issue regulations on the activity of the
committee on operation of a health sector database under Art. 6,
and on limitation of access under para. 2 art. 10.
Art. 18. Enactment
This Act shall take force immediately.
This Act shall be reviewed no later than 10 years after its
enactment.
Provisional clauses
I
The licensee's licence fee under para. 3, Art. 4 shall for the first year be based upon estimated costs pertaining to the preparation and monitoring of the operations of the health sector database.
II
The entry of data onto the health-sector database shall not commence until six months after the enactment of this Act.
III
Before processing begins on the health-sector database, the committee on the operation of the database cp. art. 6 shall ensure that the assessment of an independent expert on the security of information systems has been sought.
Passed by the Alþingi 17 December 1998.