A legal overview of the use of messaging platforms in healthcare

Abstract

Medical interventions are becoming more complex day by day. Moreover, compared with the past, more healthcare professionals take part in the same intervention in the field of medicine. The use of technology in medical interventions has also increased. This change in the health sector brings together several legal discussions. In this study, the legal consequences that arise from the treatment processes carried out by the residents and resident educators (registerers / attending physicians), the exchange of information between them, and the usage of some messaging platforms, especially WhatsApp, in this process will be analyzed.

Introduction

The use of technology in healthcare has increased enormously. While the use of very advanced technologies is increasing day by day, some simpler technological possibilities are also used extremely. The messaging platforms like WhatsApp are used intensively between the healthcare professionals. At this point, there are many legal discussions arise from sharing patients’ information via messaging platforms, especially WhatsApp. Within the scope of this study, potential legal problems will be analyzed and some legal discussions on this topic will be evaluated from a legal aspect.

The use of whatsapp and other messaging platforms between the health professionals as a communication instrument during the healthcare services

It is impossible for a physician to carry out the entire medical intervention process alone. They mostly need the support of other health professionals with different specialties and powers. Parallel to the increase in specialization in their fields of expertise and sub-branches, the need of other health professionals’ support in the healthcare services are increasing day by day. They also need the assistance of residents who are already doctors and trained in the relevant field. They even need the help of the secretaries, caregivers, nurses, etc. Parallelly they need to be in contact with them. WhatsApp and equivalent messaging platforms are perfect fit to meet this need.

Although the opportunities provided by technology are at an advanced stage, the scope of this study is limited with the use of WhatsApp and similar messaging platforms in the healthcare activities. In practice, it is known that the information sharing about the patient between the Residents and resident educator (registerer / attending physician) is made through a specific automation system while treating patients, but they often use some messaging platforms like WhatsApp.

As mentioned before, in this study, the legal consequences of the use of WhatsApp and other messaging platforms in the medical diagnosis and treatment process will be examined.

Potential legal problems arising from the share of patients’ personal data through messaging platforms

In practice, residents, and resident educators (registerers / attending physicians) use WhatsApp and some other messaging platforms to communicate between themselves. Through these messaging platforms, information of the patients, certain examinations, analysis or imaging results, diagnoses, and treatments to be applied are shared between the residents and the resident educators (registerers / attending physicians). This exchange of information between educators and residents through WhatsApp and so on causes some legal discussions.

First of all, sharing patients’ information between health professionals involved in their medical intervention does not constitute a violation on its own, if it provides other conditions explained below. Confidentiality of the personal information of patients is against third parties not against the healthcare staff that involve the treatment process. Therefore, sharing information with healthcare staff who involves in the treatment process does not constitute a violation of a patient’s personal data on its own. In this context, the concerned professional should immediately destroy the information on these messaging platforms as soon as the work is completed, and, in the process of storing the data, they should also protect them against all other third parties, including their spouse, friends and other family members, of course who are not related to the treatment process, even if they are physicians. If this information cannot be protected and third parties can reach them, that constitutes a violation of the law and causes the legal responsibility of the healthcare professionals.

Sharing the information via WhatsApp or other similar platforms may cause violations of Law on the Protection of Personal Data (KVKK) as explained. According to KVKK, as a rule, transferring personal data to a database abroad is only possible with the explicit consent of the data owner (1). On the other hand, there are some exceptions of that rule. One of these is the exception for the health data. According to the conditions of the article 9 of KVKK referring to article 6 the same code, explicit consent is not required for processing the personal health data for diagnosis, treatment, and healthcare services (1). These conditions are either having adequate protection in the country where the information are transferred or, in the absence of that, having written commitment of the data controller of the relevant country and the data controller in Turkey to provide adequate protection. According to the article 9 paragraph 3 of the KVKK, the countries have adequate protection are determined and announced by Personal Data Protection Authority of Turkey (1). However, there is no list announced until now, but the Authority announced the criteria to determine the safe countries with the decision dated 02/05/2019 and numbered 2019/125 and published a list of these criteria in its web-site (2). Despite that, it is not possible to make a precise determination without the decision of the Authority. For this reason, it does not seem possible to take advantage of this exception of safe countries until the announcement of the list of safe countries by the Authority in Turkish legal system.

Going back to utilisation of WhatsApp; because there is no safe country determined according to KVKK, it is not possible for WhatsApp application to meet the first requirement of the KVKK. Assuming that there is no written commitment between the medicines or the data controllers of who is sharing the information and the data controller of WhatsApp application, sharing the information of the patients via WhatsApp will be the violation of the KVKK. For other messaging platforms the answer is the same. The possible lawful solutions are to meet the written commitment requirements or having explicit consent of each patient whose information is shared for correspondence about the patient through the messaging platforms. However, it should not be forgotten that the data should only be shared with those concerned with treatment, only for this purpose and to the necessary extent.

Evaluation in terms of information and communication security guide of Turkish Presidency Digital Transformation Office

The Information and Communication Security Guide of the Turkish Presidency Digital Transformation Office, published in July 2020, is one of the resources that should be examined within the scope of this study (3). According to the guide, it binds all public institutions and organizations, as well as private enterprises serving in the health sector. According to the guide, it is recommended to use messaging platforms controlled by the institution, if possible, and to prefer local and national applications if not available. This guide is located at a level below the regulations in the hierarchy of norms and is a guiding source for the implementation of laws. Because it is below the codes, it can neither contains the provisions contrary to them nor they can be interpreted in a way that is against the codes. As it was mentioned before, the Law on the Protection of Personal Data brought an exception to health data in this regard, while the export of data abroad by sharing the data over the platforms whose databases’ are abroad is subject to explicit. Therefore, the existence of this guide does not change the situation. In terms of health data, the guide can be interpreted in accordance with the Code. The guide cannot eliminate exceptions recognized by the Codes.

Conclusion

In medical diagnosis and treatment processes, it is possible for the health professionals to benefit from the support of the residents or the technological opportunities, which are the main subject of this study. However, while benefiting from the supports, some issues should be considered to not encounter certain legal responsibilities.

It is necessary to pay attention to the legal compliance conditions of medical intervention under all circumstances. The communication between the relevant faculty member/lecturer or specialist physician and resident or between the medicines through WhatsApp and similar messaging platforms, as automation systems, during diagnosis and treatment period can constitute a violation of the data protection law. Firstly, utmost care should be taken to not give the personal data of the patient outside of the people involved in the treatment process, even if it is a physician. Since the data are transferred abroad in such messaging platforms because the databases are abroad, the use of these platforms will constitute legal responsibility in the absence some conditions. As it is explained below, for now, it is not possible the meet the requirement of transferring the data in a safe country because of current state in Turkey. Therefore, sharing patients’ data via WhatsApp or other messaging platforms without the explicit consent of the concerned patient or the written commitment made with the data controller of these platforms will be the violation of the KVKK.