의료정보의 공유가능성에 대한 법적 검토 - 미국, 프랑스, 유럽연합을 중심으로 -

Abstract

Medical service is one of critical elements for human life. Many people in Korea still seek most health related information(a.k.a. health information. Health information may be the inclusive concept of medical information) on the internet. It is not clear whether the health information on the internet is provided by doctors or other medical personnel and whether such information is correct. With the sharing system, the society is more prosperous and economic inequality can be relieved. However, due to the some economic aspect of the sharing system, people are reluctant to use the sharing system for health information. Moreover, health information raises serious issues surrounding privacy protection. Accordingly, people hesitate to share health information or healthcare data even for the non-profit purpose. This article reviews whether sharing health information is feasible for the non-profit purpose and whether it is possible to use the sharing system for health information based on U.S., French and E.U. laws. In the United States, the Federal Health Insurance Information Transfer and Accountability Act (HIPAA) and the Federal Health Information Technology for Economic and Clinical Health Act (HITECH) are responsible for the protection of health information. HIPAA focuses on medical fraud, administrative simplification, and computerization of health information, and recognizes the need to maintain strict privacy protection for health information. In France, the Public Health Act imposes the duty to protect personal information on medical service providers, and the Data Act applies to the sharing of health information for research purposes. Personal data protection in the European Union is governed by the GDPR, which in principle prohibits processing personal health data, but exceptions are recognized. In accordance with the GDPR, the processing of personal information must satisfy the requirements of legality, fairness, transparency, data minimization, accuracy, the limitation of the storage period, integrity and confidentiality. HIPAA does not prohibit the cross-border transfer of protected health information if the requirements of HIPAA are met. However, because of the reporting obligation to Centers for Medicare & Medicaid Services, it is common to include contractual restrictions or prohibitions on cross-border transfer in the U.S. In France, as a member of the EU, the EU's GDPR applies directly, and as a national law, Law No. 78-17 (French Data Protection Law) applies. In the European Union, cross-border transfer of private data is regulated in dividing into transfers to EU member states and transfers to non-EU countries. For transfers within the European Union, the GDPR imposes no additional requirements beyond the direct application of the GDPR. For transfers to non-EU countries, in addition to the compliance of GDPR, decision on the appropriateness by the Commission is required. If not, the contract must provide an additional guarantee.