개인건강정보보호에 관한 헌법적 고찰: 공공영역에서의 개인건강정보보호를 중심으로

Abstract

Personal health information, which is sensitive information, is information that requires a higher level of protection than general personal information as it indicates individuals' physical and mental health conditions. Considering that there have been incidents in Korea where patients' health information such as medical records are illegally collected, used, or leaked, it is possible to discover that Korea's current personal information protection and medical laws have many problems related to substantial protection of personal health information. In particular, some employees of the National Health Insurance Service of Korea, which was established for public benefit, have illegally accessed the medical records of health insurance subscribers. Personal health information protection is not ensured even in the public sector. As personal health information is a type of personal information, the data subject should be able to exercise the right to informational self-determination, which is a constitutional right, to control to whom and how his/her health information will be provided and used. However, the right to informational self-determination can be limited by law when necessary for national security/order or public welfare under Article 37-2 of the Constitution. It means that personal information can be lawfully processed by public authority for national security, criminal investigation, welfare, or public health, regardless of the will of the data subject. In regards to this, the current medical laws contain several provisions that allow the use of personal health information regardless of the will of the data subject. Even when a national or public institution limits the right to informational self-determination over personal health information under these provisions, however, this action shall follow the principle of proportionality. Some advanced countries have special acts on personal health information protection to substantially guarantee the right to informational self-determination and prohibit the use of personal health information in principle. However, they have specific exceptions to allow the use of personal health information in certain cases for harmony and balance between protection and use of personal health information. On the other hand, personal information protection laws and medical laws of Korea do not specify the rights of the data subject and state the exceptions for processing personal health information too broadly. Personal health information is simply protected by prohibiting leaks and punishing the violators. Considering the sensitivity of personal health information and particularity of the medical field, Korea should enact special acts on personal health information protection to substantially secure the rights of the data subject and ensure the harmony and balance of personal health information protection and use.