The Latvian Data Protection Authority (DVI) has clarified the rules applicable to the processing of patient data by healthcare professionals, particularly regarding photography, communication, and deletion of medical information.

The authority examined the case of a doctor photographing a patient with their personal phone for treatment purposes. Although taking photos may be necessary for care and does not require specific consent, using a personal device presents security risks. It is the responsibility of the healthcare establishment, as the data controller, to define the modalities of this collection, notably by favoring devices provided and managed by the establishment to ensure that images are stored in a secure and controlled system, and not on a personal device or storage space.

Regarding the sending of test results by electronic means such as email or WhatsApp, the DVI recalls that the GDPR does not specifically prohibit these channels. However, the healthcare establishment must assess on a case-by-case basis whether the chosen communication method ensures adequate protection of health data. This assessment must consider verifying the recipient, the nature of the information transmitted, and the existence of safer alternatives; transmitting detailed results requires a higher level of security than a simple appointment reminder.

Finally, the authority specified that the right to erasure of a patient's data is not absolute. Medical records are subject to legal retention obligations that take precedence over the patient's deletion request. If a patient believes their information is inaccurate, they may exercise their right to rectification to have it completed or corrected, but a request to erase medical history may be refused due to these regulatory requirements.