Health Data and Turkish Data Protection Law: Patients' Right of Access and Confidentiality

Diagnoses, treatments, test results, prescriptions and other information in a patient file are among a person's most sensitive data. Their unlawful disclosure can have serious and lasting consequences. This article looks at the legal protection of health data, patients' right of access to their records and the main obligations of healthcare institutions under Turkish law.

Health data is a special category of personal data

Article 6(1) of the Personal Data Protection Law No. 6698 (KVKK) lists data concerning health, together with certain other data such as race, religion, sexual life, criminal convictions, biometric and genetic data, as "special categories of personal data". Because of the risk of discrimination, such data is subject to stricter protection.

Processing conditions after the 2024 amendment

Article 6(3) of the KVKK was redrafted by Law No. 7499 on 2 March 2024. Processing special categories of personal data is prohibited as a rule but permitted in the listed cases. The conditions most relevant to health data are:

• the explicit consent of the data subject,
• express provision by law,
• necessity to protect the life or bodily integrity of a person unable to give consent due to actual impossibility,
• necessity for the establishment, exercise or protection of a right,
• necessity, for persons under a duty of confidentiality or authorised institutions, for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, and the planning, management and financing of healthcare services.

The last condition is the main legal basis for processing carried out by physicians and healthcare institutions for treatment purposes. However, it does not permit the use of data for purposes other than treatment (for example marketing or sharing with third parties). Moreover, under paragraph 4 of the Article, adequate measures determined by the Personal Data Protection Board must be taken when processing special categories of data.

Patients' right of access to their records

Under Article 16 of the Regulation on Patient Rights, patients may examine the file and records containing information about their health, directly or through their attorney or legal representative, and obtain a copy; these records may only be seen by those directly involved in the patient's treatment. In its decision E. 2014/5076, K. 2015/2184, the 15th Chamber of the Council of State found that this provision and Article 10 of the Right to Information Law had been breached.

Patients may also exercise their rights under Article 11 of the KVKK by applying to the healthcare institution as data controller, including the right to learn whether their personal data is processed, to request information if it is, to know the third parties to whom it has been transferred, and to request the correction of incomplete or inaccurate data. The data controller must conclude the application within thirty days at the latest.

Duty of confidentiality

Article 23 of the Regulation on Patient Rights provides that information obtained in the course of providing healthcare may not be disclosed except where permitted by law. The duty of physicians and healthcare staff to protect professional secrets is also safeguarded under criminal law and professional rules.

Common risks in practice

• uncontrolled sharing of test results or patient images via instant messaging apps,
• staff unrelated to treatment being able to view patient records in hospital information systems,
• disclosing information to relatives without the patient's permission,
• storing health data in cloud services abroad without safeguards in accordance with Article 9 of the KVKK,
• missing privacy notices, or notices that do not accurately reflect processing activities.

Key steps for healthcare institutions

• mapping processing activities and identifying their legal bases,
• providing patients with a clear and understandable privacy notice,
• restricting access to patient records according to role and authority, and keeping access logs,
• regularly training staff on confidentiality and data security,
• establishing an internal procedure for notifying data subjects and the Personal Data Protection Board in case of a data breach.

Conclusion

Protecting health data is fundamental both to the privacy of patients and to trust in healthcare institutions. Patients have statutory rights of access and protection, while healthcare institutions must process such data only for lawful purposes and with the necessary security measures.

This article is for general information purposes only and does not constitute legal advice.