Privacy Statement for Sørlandet Hospital
This statement explains how Sørlandet Hospital collects and uses personal data. Whether you are a patient, employee, visitor, or otherwise in contact with the hospital, you have rights regarding privacy, and the hospital has obligations to uphold them.
Privacy is the right to a private life and the right to decide how your personal data is used. Personal data is information and assessments that can be linked to an individual.
At Sørlandet Hospital, we process personal data to carry out all our public service responsibilities. Processing personal data essentially means using it for or in our operations.
Sørlandet Hospital is legally required to ensure that your personal data is stored securely, including ensuring its confidentiality, integrity, availability, and quality. This privacy statement explains how we collect and use personal data and what rights you have when we have registered personal data about you.
Under Article 8 of the European Convention on Human Rights and Section 102 of the Constitution, everyone has the right to respect for their private life. On this basis, specific and detailed regulations have been developed to safeguard privacy. In particular, the new Personal Data Act of 20 July 2018 and the EU General Data Protection Regulation (also known as GDPR) are central. These legal provisions set out obligations for Sørlandet Hospital, which processes other people’s personal data, and rights for individuals whose personal data is registered.
The most important laws authorizing Sørlandet Hospital to process personal data are as follows (the list is not exhaustive):
Working Environment Act
Archives Act
Public Administration Act
EU General Data Protection Regulation/GDPR
Health Research Act
Health Personnel Act
Health Registers Act
Freedom of Information Act
Patients’ Rights Act
Patient Records Act
Personal Data Act
Sørlandet Hospital collects and processes personal data either because we are required to do so by law or regulation, or because we have obtained your consent. How we collect personal data depends on the applicable legal basis and where the information comes from.
Sørlandet Hospital is a public hospital and is therefore required to collect and process various personal data about you as a patient. For example, we are required to keep records for all patients. These records will contain sensitivepersonal data(referred to as special categories of personal data in legislation) because they are health information. Information in your patient record may be collected in various ways, either through your conversations with healthcare personnel, specific treatment and/or follow-up of your illness at Sørlandet Hospital, or from other providers you have previously visited, such as your general practitioner or another public or private hospital. As a general rule, such collection requires your consent. Your personal data is mainly used to provide safe healthcare and medical treatment for your illness or condition. Stored personal data may also be used for research or quality assurance. As a general rule, your consent is required if it is to be used for other purposes.
Sørlandet Hospital processes necessary personal data about our employees to fulfil our role as an employer, including to administer salaries and exercise personnel responsibilities. These data are stored, among other things, to keep track of employment relationships, pay the correct person, and communicate with other public agencies and registers.
If you contact us without having been a patient or being or having been employed by us, relevant personal data about you may also be stored, for example in connection with complaints or if you have applied for a job with us.
As a public administrative body, Sørlandet Hospital must collect and process some personal data in connection with, among other things, case processing, meetings and visits, the exchange of emails and telephone calls, and public tenders.
Some personal data is also registered when youvisit our website.
Sørlandet Hospital may only process relevant personal data for the purposes applicable to the processing in question. Processing must also be proportionate; that is, we cannot store more data or more types of personal data than necessary.
When you are a patient with us, we process information about who you are (e.g. name and national identity number) and your contact information (address, telephone number, email). We also process sensitive personal data relating to your health. All information is stored either on Sørlandet Hospital’s computer systems or with data processors with whom we have an agreement.
If you are employed by us, we process various items of your personal data, such as your name, national identity number, bank account number, union membership, CV, course attendance, further education, and more. The information is stored, among other places, in dedicated systems such as the Personnel Portal and/or GAT.
Personal data collected from the websitesshf.nois managed by our Communications Department.
Cookies are small text files stored in your browser when you open a website. Under Section 2-7b of the Electronic Communications Act, you are entitled to know and approve what information is stored, what it is used for, and who uses it. You can manage which cookies you allow. For more information about the cookies used on our website, seehttps://sshf.no/om-nettstedet/informasjonskapsler
Information you enter in the contact form on our websitesshf.noor inquiries sent to our shared email address atpostmottak@sshf.nowill be forwarded by email to the appropriate department. Please note that email is not a secure means of communication, and we want to prevent your personal data from being compromised. Therefore, never send sensitive personal data by email.
Please note that the case archive registers all emails sent topostmottak@sshf.noin accordance with the applicable case-processing rules. Personal data you provide in an email to us may be subject to archiving under the Archives Act and Archives Regulations, and such inquiries are stored in the Public360 case-processing and archiving system. We process personal data such as names, addresses, telephone numbers, email addresses, and other relevant information in accordance with the provisions of the Archives Act.
Requests for access to information and media inquiries to Sørlandet Hospital are stored in our Public360 case-processing and archiving system. This includes, among other things, the name of the person making the inquiry and where it came from.
Sørlandet Hospital has procedures governing access control and who can access which information and personal data.
Employees whose duties require access and/or who have a work-related need will have access to personal data from relevant registers and/or examinations related to the task to be performed.
Sørlandet Hospital is required to maintain a record providing a comprehensive overview of the ways in which we process personal data.
Sørlandet Hospital stores personal data in various databases. Access to the databases is controlled according to access permissions and need, in accordance with our internal procedures set out in the electronic quality handbook (also known as EK).
Our employees are bound by a duty of confidentiality, either by law because they are healthcare personnel or under their employment contracts.
We handle correspondence in the form of letters, emails, and telephone calls, and process and archive cases in our own specialist, file, and archive systems. For example, Public360 is our case-processing and archiving system, while Dips is one of our patient record systems.
The retention period depends on the legal basis on which the personal data were originally stored.
The different legal bases are usually legislation, regulations or consent, as described above under “How does Sørlandet Hospital collect personal data?”. For example, the retention period may be prescribed by law, or it may depend on an assessment of the specific purpose and proportionality to determine what retention period is necessary and relevant.
Personal data collected with your consent are stored in accordance with the consent given.
As a general rule, the case documents of a public administrative body such as Sørlandet Hospital are publicly accessible under the Freedom of Information Act. This means that anyone who asks, including the press and others, may access the contents of documents. As a clear general rule, your enquiry to us will also be public, whether sent by letter, email, fax or SMS, and we publish a list of public enquiries online (the public records log). However, much of the information processed by Sørlandet Hospital is confidential, and patient information, for example, is exempt from public disclosure. Internal documents may also be exempt from public disclosure.
In addition, the general rule is that Sørlandet Hospital cannot disclose your personal data without your consent. However, in some cases we are legally required to disclose personal data without your consent, including to the following (non-exhaustive list):
The data subject’s employer: To the extent that the personal data concern the employee’s safety in connection with specific work or an assignment
Research: Where the research project has been granted an exemption from the duty of confidentiality by the Regional Committee for Medical and Health Research Ethics
Quality assurance: This usually applies to departments at Sørlandet Hospital that need to ensure the quality of patient care. You have the right to opt out of being included in quality registries. In several cases, inclusion in a quality registry also requires your consent.
NAV: Under the National Insurance Act, NAV has the right to obtain personal data, including for monitoring purposes
Next of kin: Under the Patients’ and Users’ Rights Act, they are entitled to information so they can make decisions on behalf of a relative who is unable to do so themselves
Parents or guardian: They are entitled to information about children aged 12 to 16 unless the child objects for reasons that should be respected, cf. the Patients’ and Users’ Rights Act. If the child is under 12, the parents have an unconditional right to information.
National health registries: Sørlandet Hospital is required to disclose personal data to several national health registries authorised by law or regulation, including the Norwegian Patient Registry, the Medical Birth Registry, the Cancer Registry and others.
Data processors, sub-processors, suppliers, partners and audit authorities may sometimes have access to personal data. To protect privacy in such cases, a formal data processing agreement must always be in place, or the party concerned must be subject to a strict duty of confidentiality.
As a general rule, you may request access to the information Sørlandet Hospital has registered about you. When accessing records used for healthcare purposes, such as your patient record, you are also entitled to access the log showing which of our employees have viewed your personal data.
You have the right to ask us to transfer all of your personal data to others (the so-called right to data portability).
If you believe that the information registered about you is incomplete or incorrect, you may generally request that it be corrected and/or deleted. To have it corrected and/or deleted, contact the doctor named as the data controller, the research project manager or, if applicable, the Data Protection Officer at Sørlandet Hospital (see contact details in the relevant section).
If you are not satisfied with the responses you receive, you can complain to the Norwegian Data Protection Authority. Read more about thishere.
If you have given your consent to the processing of your personal data, you may withdraw your consent at any time. You may also request that Sørlandet Hospital delete your personal data from its systems, provided that the personal data have not already been anonymised, processed or included in completed analyses. Please note that withdrawing your consent will not affect the lawfulness of the processing of personal data that took place before the consent was withdrawn.
You can contact the Data Protection Officer by email, telephone or letter. Contact details are available here:https://sshf.no/om-oss/kontakt-oss
As a general rule, the Data Protection Officer will respond to your enquiry within 30 days.
For more information about the role of a Data Protection Officer and its responsibilities, seehttps://www.datatilsynet.no/rettigheter-og-plikter/virksomhetenes-plikter/personvernombud/personvernombudets-oppgaver/