Medical recipes hanging with clothespins outside the window, the Privacy Guarantor fines a doctor

He had hung the medical prescriptions with clothespins outside the window of the study, located on the ground floor on a public street, thus making the names of the patients and the contents of the prescriptions visible to anyone. For having adopted this unique method of delivering prescriptions, the Privacy Guarantor has ordered a doctor to pay a fine of 10 thousand euros. The violations of national and European privacy legislation found by the Authority in the proceeding initiated following a communication from the Carabinieri Command for the Protection of Health-Nas are significant. In fact, from the photographic documentation attached to the report, it clearly emerged that the medical prescriptions, not in a sealed envelope, were freely visible and accessible to anyone passing by the windowsill of the doctor’s office. The Command had also collected information from some patients on the conduct of the doctor. In declaring the unlawfulness of the treatment implemented, the Authority reaffirmed the principles and measures that the doctor should have followed. In general, the data controller is required to adopt appropriate technical and organizational measures to guarantee a level of security adequate to the risk that may derive from unauthorized disclosure or from access, accidental or illegal, to personal data transmitted, stored, or otherwise processed. In the health sector, in particular, the owner must guarantee respect for the rights, fundamental freedoms and dignity of persons, also in the organization of services and services. Furthermore, the privacy law establishes that health information must not be disclosed, as it can only be disclosed to third parties, but on the basis of a suitable legal basis or on the indication of the patient himself by means of a written proxy. In addition to the payment of the fine, the Guarantor ordered the publication of the provision on the Authority’s institutional website and the annotation in the internal register of violations of the GDPR and of the measures adopted.