An insurer must not request, and healthcare professionals must not disclose, a patient’s entire medical history, but only the part of the information that is directly relevant to assessing the specific insurance claim and making a decision on it, accentuates Karina Palkova, Ombudsperson of Latvia.
Recently, the Ombudsperson has received questions and concerns from members of the public about whether insurance companies are being provided with an excessively broad range of health data when assessing claims for insurance benefits. While legislation grants insurers the right to obtain and process certain patient health data when making decisions on insurance claims, these rights are not unlimited. An insurer may request only information that is directly necessary for assessing the particular insurance claim. Healthcare institutions, for their part, have a duty to ensure that no more information is disclosed than is necessary.
Patient health data is particularly sensitive information and is subject to special protection. It is in the public interest to ensure that everyone can receive insurance benefits without concern that more information about their health will be requested or disclosed than is objectively necessary. The right to privacy is not an obstacle to an effective insurance system; rather, it is a prerequisite for people’s trust in healthcare, doctors and insurers.
Karina Palkova, Ombudsperson of Latvia.
The Ombudsperson stresses that requesting or disclosing a patient’s entire medical history is unacceptable where the decision requires only specific information concerning a particular episode of medical treatment, diagnosis or state of health.
If a person has reasonable grounds to suspect that an insurer has requested or received more health data than is necessary to assess a particular claim, the insurer should be able to explain whether the information requested was objectively necessary for making a decision on that specific insurance claim. By contacting the healthcare institution, it is possible to establish precisely what information was disclosed to the insurer and whether, when disclosing the relevant information, the healthcare institution assessed compliance with the principle of data minimisation. If there are grounds to suspect excessive data processing or inappropriate disclosure, a complaint may be made to the Data State Inspectorate.
It is in the public interest to ensure a balance between the effective operation of the insurance system and the protection of fundamental human rights. Trust in the healthcare system and the insurance sector is possible only when patients can be confident that their sensitive data is processed lawfully, transparently and responsibly.
The Ombudsperson calls on healthcare institutions and insurance companies to pay particular attention to compliance with the principles of data minimisation, confidentiality and accountability, and to ensure clear communication with patients about the use of their data. To this end, the Ombudsperson has prepared a detailed explanation for insurance companies, which has been sent to the Ministry of Health, the Latvian Insurers Association and professional organisations representing healthcare professionals, calling on them to pay particular attention to respecting patients’ human rights in the process of assessing insurance claims.
Last year, the Ombudsman’s Office it total received 2,499 various submissions, which is nearly 30% more than in 2024. This reflects not only the public’s trust but also their willingness to defend their rights and utilize legal protection mechanisms.
Photo: Courtesy of RSU
