The plan to provide individual health identifiers to every Irish citizen will have moved a step closer by the end of the year, the Health Service Executive (HSE) has indicated.
A special business unit that will operate the proposed health identifier service is currently being established and the HSE expects to have a system in place to start creating a register of health identifiers by the third-quarter of this year.
The individual health identifier (IHI) is a key part of the Government’s e-health strategy and aims to improve patient safety by using a unique number to track every person through the health system from birth to death.
While an IHI will not contain any clinical information, it will be linked with personal information such as date of birth, mother’s maiden name and sex.
It will be a criminal offence, punishable by a fine of up to €100,000, for anyone to access the register without proper authorisation.
The HSE said it was ensuring the health identifiers project was in compliance with recent guidelines from the Data Protection Commissioner on the sharing of citizens’ personal data in the public sector.
That guidance was issued following a Court of Justice of the European Union decision in a Romanian case - the Bara case - last October that public bodies in EU member states are precluded from transferring personal information to another public administrative body without the affected citizens having been informed first.
The HSE said an initial database set up to test the health identifier concept only used HSE data.
However, it is proposed that personal information from the Department of Social Protection, such as PPS numbers, will be used to populate the actual database and to keep it up to date.
Health Identifiers Act
The Health Identifiers Act 2014, which underpins the project, allows for ministers from other departments to provide data about individuals to the minister for health for the purpose of establishing and maintaining the IHI register.
However, the legislation was enacted before the Bara ruling.
The Data Protection Commissioner’s office told the HSE in discussions on the health identifiers four years ago it believed the systems in place in the health service at that time were “deficient regarding privacy”.
In its recent guidance directed at all public bodies, the Data Protection Commissioner said that even if a legislative measure provided the requisite explicit legal basis to implement a data-sharing arrangement between bodies, it was still incumbent upon the bodies concerned to ensure individuals were “fully aware” of those arrangements.
In a statement, the HSE said it was “ensuring that the IHI Project is in compliance with these guidelines”.
A public consultation on a draft privacy impact assessment for the health identifiers concluded on April 8th having been extended “in response to significant public interest”, the HSE said.
It said it was currently analysing the feedback received during this consultation.