Data transmission & data protection

Health data are protected by the Federal Act on Data Protection (FADP) and must be processed in accordance with its provisions. In case of unlawful processing of health data, the affected persons can bring civil legal action (Art. 15, paragraph 4, FADP). This option comes in addition to criminal charges pursuant to article 321 of the Swiss Criminal Code (StGB). The persons and institutions with duty to report are under the obligation to carry out the data exchange with the responsible cancer registries in encrypted form. This applies to, for instance, the transmission of data to the responsible cancer registry through the HIN (Health Info Net) service. Reports of data by mail are subject to postal secrecy in accordance with article 321^tert StGB. The reporting of data to the cancer registry can be delegated to another person, but the responsibility cannot be transferred. The persons responsible for enforcement of the CRA have an obligation of confidentiality (Art. 29 CRA). In case of a breach of this obligation, Art. 320 StGB (Breach of official secrecy) and/or Art. 321 StGB (Breach of professional confidentiality in research involving human beings) apply.

The Cancer Registration Act that took effect on 1 January 2020, as well as the Cancer Registration Ordinance, regulate, among others, the persons or institutions with duty to report, the reportable data, the rights of patients (in particular the right of refusal), the organization of the cantonal cancer registries, of the Childhood Cancer Registry, and of the National Agency for Cancer Registration, as well as the basic principles of data processing. Art. 30 CRA regulates the disclosure of data and provides that federal and cantonal agencies responsible for the enforcement of this statute, as well as public and private organisations and persons, may disclose to one another personal data when this is necessary for the fulfilment of their obligations derived from this statute.

If a document is forwarded to the cancer registry in accordance with the duty to report, and also forwarded in copy form to other treating doctors, the following applies regarding the consequent disclosure of the AHV number: the service providers are entitled, in accordance with Art. 83 of the Federal Law on Health Insurance, to use the AHV number systematically in the fulfilment of their statutory obligations. Billing in particular is carried out regularly with provision of the AHV number. Thus, if a document containing the AHV number, in original form or copy, is forwarded to another treating doctor, nothing is disclosed that the recipient doesn`t already know or cannot easily obtain. Thus, the AHV number may be stated in a document, original or copy addressed to another treating doctor. A different situation arises when persons or institutions not entitled to the systematic use of the AHV number acquire knowledge of the relevant document. In such a case, the general principles of data protection apply. The disclosure of personal data, including the AHV number, is permissible only if adequate legal justification is provided (e.g., consent of the patient).