Health Information Act 2026
| ||
Number 10 of 2026 | ||
HEALTH INFORMATION ACT 2026 | ||
CONTENTS | ||
Preliminary and General | ||
Section | ||
Duty to Share | ||
8. Copies of personal health data to be furnished at patient’s request | ||
9. Steps to be taken by health services providers on cessation of provision of health services | ||
Electronic Health Records | ||
10. Creation and assignment of Electronic Health Records by Executive | ||
11. Information to be contained in Electronic Health Records | ||
16. Regulations in relation to accessing Electronic Health Record | ||
18. Electronic exchange of information in Electronic Health Record with third country | ||
19. Request to provide personal health data for purposes of Electronic Health Record | ||
Provision of Health Information to Executive | ||
24. Use of health information obtained by Executive under section 22 | ||
Amendment of Patient Safety (Notifiable Incidents and Open Disclosure) Act 2023 | ||
25. Amendment of section 68 of Patient Safety (Notifiable Incidents and Open Disclosure) Act 2023 | ||
|
Acts Referred to | ||
Communications Regulation (Postal Services) Act 2011 (No. 21) | ||
Companies Act 2014 (No. 38) | ||
Data Protection Act 2018 (No. 7) | ||
Dentists Act 1985 (No. 9) | ||
Disability Act 2005 (No. 14) | ||
Freedom of Information Act 2014 (No. 30) | ||
Health Act 2004 (No. 42) | ||
Health Act 2007 (No. 23) | ||
Health Identifiers Act 2014 (No. 15) | ||
Interpretation Act 2005 (No. 23) | ||
Medical Practitioners Act 2007 (No. 25) | ||
Nurses and Midwives Act 2011 (No. 41) | ||
Patient Safety (Notifiable Incidents and Open Disclosure) Act 2023 (No. 10) | ||
Pharmacy Act 2007 (No. 20) | ||
| ||
Number 10 of 2026 | ||
HEALTH INFORMATION ACT 2026 | ||
An Act to give further effect to Regulation (EU) 2025/327 of the European Parliament and of the Council of 11 February 20251 on the European Health Data Space and amending Directive 2011/24/EU and Regulation (EU) 2024/2847 and for those and other purposes to provide for a duty for health services providers to share, in certain circumstances, a patient’s personal health data with other health services providers also providing care and treatment to the patient; to provide for the creation and assignment by the Health Service Executive of an Electronic Health Record in respect of every patient; to provide for the information that shall be contained in an Electronic Health Record; to provide that a health services provider shall record the personal public service number of each of his or her patients; to provide that the Health Service Executive may, where appropriate, use a personal public service number to identify a patient; to provide for access to all, or part of, an Electronic Health Record by certain categories of person; to provide for the restriction of such access in certain circumstances; to provide a patient with information in relation to access to his or her Electronic Health Record; to provide for the Minister to make regulations for the purposes of this Act; to provide for the purposes in relation to which an Electronic Health Record may be used; to provide that the Health Service Executive may enter into reciprocal arrangements with other jurisdictions in relation to the exchange of information contained in an Electronic Health Record; to provide that the Health Service Executive may request health services providers to provide the Health Service Executive with certain classes of personal health data; to provide that the Health Service Executive may request certain persons to provide the Health Service Executive with certain categories of health information; to provide that the Health Service Executive may make an application to the Circuit Court where a person fails to comply with a request; to provide for the purposes for which the Health Service Executive may use health information provided to it in accordance with this Act; to provide that the Health Service Executive shall prepare and publish guidelines for the purposes of this Act; to amend the Patient Safety (Notifiable Incidents and Open Disclosure) Act 2023 ; and to provide for related matters. | ||
[30th April, 2026] | ||
Be it enacted by the Oireachtas as follows: | ||
|
PART 1 Preliminary and General | ||
|
Short title and commencement | ||
|
1. (1) This Act may be cited as the Health Information Act 2026. | ||
(2) This Act, other than section 25 , shall come into operation on such day or days as the Minister may by order or orders appoint either generally or with reference to any particular purpose or provision and different days may be so appointed for different purposes or different provisions. | ||
|
Interpretation | ||
|
2. In this Act— | ||
“appropriate person” has the meaning assigned to it by section 13 (2); | ||
“child” means a person who has not attained the age of 18 years; | ||
“data protection impact assessment” has the same meaning as it has in Part 5 of the Data Protection Act 2018 ; | ||
“Data Protection Regulation” means EU Regulation 2016/679 of the European Parliament and of the Council of 27 April 20162 on the protection of natural persons with regard to the processing of personal data and of the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation); | ||
“data subject” has the same meaning as it has in the Data Protection Regulation; | ||
“Electronic Health Record” has the meaning assigned to it by section 10 (1); | ||
“enactment” has the same meaning as it has in the Interpretation Act 2005 ; | ||
“Executive” means the Health Service Executive; | ||
“guidelines” means guidelines prepared and published by the Executive in accordance with section 21 ; | ||
“health”, in relation to a patient, includes the well-being of the patient; | ||
“health information” includes— | ||
(a) personal health data including personal data that relates to the provision of a health service, | ||
(b) information that provides a more complete understanding of personal health data, | ||
(c) information that provides a more complete understanding of the health services, | ||
(d) information that relates to— | ||
(i) the provision of health services, including planning for such provision, and | ||
(ii) the evaluation of health services, | ||
(e) information referred to in paragraph (a), (b), (c) or (d) that has been aggregated or prepared for statistical purposes, and | ||
(f) data in relation to care (within the meaning of Regulation (EU) 2025/327 of the European Parliament and of the Council of 11 February 20253 on the European Health Data Space and amending Directive 2011/24/EU and Regulation (EU) 2024/2847); | ||
“health practitioner” means— | ||
(a) a registered medical practitioner within the meaning of the Medical Practitioners Act 2007 or a medical practitioner practising medicine pursuant to section 50 of that Act, | ||
(b) a registered dentist within the meaning of the Dentists Act 1985 , | ||
(c) a registered pharmacist or registered pharmaceutical assistant within the meaning of the Pharmacy Act 2007 , | ||
(d) a registered nurse or registered midwife within the meaning of the Nurses and Midwives Act 2011 , | ||
(e) a registrant within the meaning of the Health and Social Care Professionals Act 2005 , or | ||
(f) a person whose name is entered in the register of pre-hospital emergency care practitioners established under the Pre-Hospital Emergency Care Council (Establishment) Order 2000 (S.I. No. 109 of 2000); | ||
“health service” means a health or personal social service (including personal care and any administrative service or other ancillary matter relating to the health or personal social service) provided to a patient— | ||
(a) for— | ||
(i) the screening, preservation or improvement of the health of the patient, or | ||
(ii) the prevention, diagnosis, treatment or care of an illness or injury of the patient, | ||
and | ||
(b) by or under the direction of a health services provider; | ||
“health services provider” means— | ||
(a) the Executive, | ||
(b) a body corporate, or an unincorporated body of persons, through which or in connection with which (whether by reason of employment or otherwise) a health practitioner provides a health service, or | ||
(c) a health practitioner, where the practitioner is not providing a health service through or in connection with (whether by reason of employment or otherwise) a body referred to in paragraph (b); | ||
“in writing” includes by electronic means; | ||
“information” includes data; | ||
“Minister” means the Minister for Health; | ||
“patient”, means a person to whom a health service is, or was, provided by a health services provider; | ||
“personal data” has the same meaning as it has in the Data Protection Regulation; | ||
“personal health data”, in relation to a patient, means— | ||
(a) personal data (within the meaning of the Data Protection Regulation) concerning the patient’s health, and | ||
(b) genetic data (within the meaning of the Data Protection Regulation) relating to the patient; | ||
“personal public service number” has the same meaning as it has in section 262 of the Social Welfare Consolidation Act 2005 ; | ||
“prescribed” means prescribed by regulations made by the Minister; | ||
“processing”, in relation to personal health data, has the same meaning as it has in the Data Protection Regulation; | ||
“pseudonymisation” has the same meaning as it has in the Data Protection Regulation; | ||
“relevant person” means— | ||
(a) a body established by or under an enactment to perform functions in relation to health services, | ||
(b) a person with whom the Executive has entered into an arrangement under section 38 or 39 of the Health Act 2004 , or | ||
(c) a person, other than a person referred to in paragraph (b), with whom the Executive has entered into an arrangement to provide health services. | ||
|
Regulations | ||
|
3. (1) The Minister may by regulations provide for any matter referred to in this Act as prescribed or to be prescribed. | ||
(2) Where a provision of this Act requires or authorises the Minister to make regulations, such regulations may— | ||
(a) make different provision for different circumstances or cases, classes or types, and | ||
(b) contain such incidental, supplementary and consequential provisions as appear to the Minister to be necessary or expedient for the purposes of the regulations. | ||
(3) Every regulation under this Act (other than a regulation under section 11 (2)) shall be laid before each House of the Oireachtas as soon as may be after it is made and, if a resolution annulling the regulation is passed by either such House within the next 21 days on which that House sits after the regulation is laid before it, the regulation shall be annulled accordingly, but without prejudice to the validity of anything previously done thereunder. | ||
|
Service of documents | ||
|
4. (1) A notice or other document that is required to be served on or given to a person under this Act shall be addressed to the person concerned by name, and may be so served on or given to the person in one of the following ways: | ||
(a) by delivering it to the person; | ||
(b) by leaving it at the address at which the person ordinarily resides or, in a case in which an address for service has been furnished, at that address; | ||
(c) by sending it by post in a prepaid registered letter to the address at which the person ordinarily resides or, in a case in which an address for service has been furnished, to that address; | ||
(d) by electronic means, in a case in which the person has given notice in writing to the person serving or giving the notice or document concerned of his or her consent to the notice or document (or notices or documents of a class to which the notice or document belongs) being served on, or given to, him or her in that manner. | ||
(2) For the purpose of this section, a company formed and registered under the Companies Act 2014 or an existing company within the meaning of that Act is deemed to be ordinarily resident at its registered office, and every other body corporate and every unincorporated body of persons shall be deemed to be ordinarily resident at its principal office or place of business. | ||
|
Expenses | ||
|
5. The expenses incurred by the Minister in the administration of this Act shall, to such extent as may be sanctioned by the Minister for Public Expenditure, Infrastructure, Public Service Reform and Digitalisation be paid out of moneys provided by the Oireachtas. | ||
|
Review of operation of Act | ||
|
6. (1) The Minister shall review or cause to be reviewed the operation of this Act no later than 5 years after the date of its passing. | ||
(2) The Minister shall, in conducting a review under subsection (1), consult with the Executive, the Data Protection Commission and any other person the Minister considers appropriate. | ||
(3) The Minister shall cause a report in writing of the findings of a review under subsection (1) to be prepared and, as soon as may be after it is prepared, shall cause a copy of the report to be laid before each House of the Oireachtas. | ||
|
PART 2 Duty to Share | ||
|
Duty of health services provider to share personal health data with other health services providers | ||
|
7. (1) A health services provider who is providing care and treatment to a patient (in this section referred to as the “forwarding health services provider”) shall, for the purposes of providing integrated care and treatment and continuity of care and treatment, forward such personal health data as he or she, having regard to guidelines, considers relevant, necessary and proportionate to the provision of such care and treatment to another health services provider who is also providing care and treatment to the patient concerned (in this section referred to as the “receiving health services provider”). | ||
(2) The personal health data referred to in subsection (1), shall be forwarded by the forwarding health services provider to the receiving health services provider and received by that health services provider— | ||
(a) in a digital format, utilising the standards and interoperability requirements specified in guidelines, and | ||
(b) within the period specified in guidelines. | ||
|
Copies of personal health data to be furnished at patient’s request | ||
|
8. (1) A patient or a specified person may, by notice in writing, request a health services provider who is providing or has provided health services to the patient to furnish a copy of all or part of the personal health data that the health services provider holds in relation to the patient to a health services provider specified in the notice, who is also a health services provider of the patient concerned. | ||
(2) A health services provider who receives a notice under this section shall, as soon as practicable but not later than one month after the date he or she receives the notice, furnish in accordance with guidelines and, free of charge, a copy of the personal health data specified in the notice to the health services provider specified in the notice. | ||
(3) A health services provider shall, on or as soon as reasonably practicable after furnishing a copy of the personal health data in accordance with subsection (2), advise the patient or the specified person by notice in writing, that the copy has been furnished to the health services provider concerned. | ||
(4) Nothing in this section shall be construed as requiring a health services provider to furnish to another health services provider a copy of personal health data the subject of a request under this section where the patient or specified person has, by notice in writing, withdrawn the request. | ||
(5) This section is without prejudice to the right of access of a data subject provided for in Article 15 of the Data Protection Regulation or of a person under the Freedom of Information Act 2014 . | ||
(6) In this section, “specified person” means a person who is a member of a class of persons specified in guidelines to act on behalf of a patient for the purpose of this section. | ||
|
Steps to be taken by health services providers on cessation of provision of health services | ||
|
9. A health services provider who intends to cease providing health services shall, having regard to guidelines, take all reasonable steps to notify each patient whose personal health data the health services provider holds of the following matters— | ||
(a) the date on which the health services provider intends to cease to provide such services, and | ||
(b) the arrangements that the health services provider proposes to ensure that the personal health data of the patient concerned will be transferred to another health services provider who will provide such services. | ||
|
PART 3 Electronic Health Records | ||
|
Creation and assignment of Electronic Health Records by Executive | ||
|
10. (1) The Executive, in order to support the sharing of personal health data for patient care and treatment, may create for, and assign to, every patient a national electronic health record (in this Act referred to as an “Electronic Health Record”). | ||
(2) The Executive, having regard to the views of patients and patient representative groups, shall carry out a data protection impact assessment prior to the creation and assignment of Electronic Health Records under subsection (1). | ||
(3) A patient shall not be refused a health service solely on the basis that he or she has not been assigned an Electronic Health Record. | ||
|
Information to be contained in Electronic Health Records | ||
|
11. (1) The following information in relation to a patient shall, where available, be contained in an Electronic Health Record: | ||
(a) a patient summary containing— | ||
(i) personal details, including: | ||
(I) forename, middle name(s) and surname and any former names; | ||
(II) all former surnames (if any) of his or her mother; | ||
(III) date of birth; | ||
(IV) place of birth; | ||
(V) sex; | ||
(VI) nationality; | ||
(VII) ethnicity; | ||
(VIII) personal public service number (if any); | ||
(IX) individual health identifier within the meaning of section 2 of the Health Identifiers Act 2014 ; | ||
(X) in the case of a deceased patient, the date and cause of his or her death, | ||
(ii) contact information, including— | ||
(I) address(es) with postcode within the meaning of section 66 of the Communications Regulation (Postal Services) Act 2011 , email address and mobile phone number, | ||
(II) nominated emergency contact, and | ||
(III) the name and contact details of the patient’s general practitioner(s), | ||
(iii) information on insurance (if any), | ||
(iv) allergies, | ||
(v) medical alerts, | ||
(vi) vaccination/prophylaxis information, | ||
(vii) current, resolved, closed or inactive health-related problems, | ||
(viii) textual information related to medical history, | ||
(ix) medical devices and implants, | ||
(x) medical or care procedures, | ||
(xi) functional status, | ||
(xii) current and relevant past medicines, | ||
(xiii) social history observations related to health, | ||
(xiv) pregnancy history, | ||
(xv) patient-provided data, | ||
(xvi) observation results pertaining to health conditions, | ||
(xvii) care plan, | ||
(xviii) information on a rare disease; | ||
(b) prescriptions; | ||
(c) dispensations; | ||
(d) medical imaging studies and related imaging reports; | ||
(e) medical test results, including laboratory and other diagnostic results and related reports; | ||
(f) discharge reports; and | ||
(g) such additional information as may be prescribed in regulations under subsection (2). | ||
(2) Subject to subsection (3), the Minister may prescribe additional information to be contained in an Electronic Health Record where he or she is satisfied that it is appropriate to do so following consultation with the Data Protection Commission, the Executive, patients and patient representative groups and such other persons as the Minister considers appropriate. | ||
(3) Where regulations are proposed to be made under subsection (2), a draft of the regulations shall be laid before each House of the Oireachtas and the regulations shall not be made until a resolution approving the draft has been passed by each such House. | ||
|
Use of personal public service number | ||
|
12. (1) Subject to subsection (3), a health services provider shall record the personal public service number of each of his or her patients and shall associate the personal public service number of the patient with any record that the health services provider makes in relation to the provision of a health service to that patient. | ||
(2) For the purpose of subsection (1), a health services provider may request a patient to provide his or her personal public service number to the health services provider. | ||
(3) A health services provider shall not refuse to provide a health service to a patient to which the patient would be otherwise entitled to solely because he or she— | ||
(a) has not been allocated and issued with a personal public service number, or | ||
(b) is not in a position to provide the health services provider with his or her personal public service number. | ||
(4) For the purposes of performing its functions under this Act the Executive may, where appropriate, use a personal public service number to identify a patient in order to identify and link the patient’s health information to his or her Electronic Health Record. | ||
(5) A relevant person shall, for the purpose of providing health information to the Executive under this Act, provide the personal public service number of a patient to whom the health information relates where the number is requested by the Executive, and the relevant person has the personal public service number in his or her possession. | ||
(6) A person who uses, or seeks to have disclosed, a personal public service number in accordance with this Act does not commit an offence under section 262 (9) of the Social Welfare Consolidation Act 2005 . | ||
|
Access to Electronic Health Records | ||
|
13. (1) Subject to this Act and any regulations under section 16 , the Executive shall provide access to all or a part of an Electronic Health Record to— | ||
(a) the patient in respect of whom the Electronic Health Record was assigned, | ||
(b) an appropriate person, | ||
(c) a health services provider for the purpose of the current or ongoing treatment of a patient, and | ||
(d) an employee or agent of the Executive whilst he or she is undertaking necessary development, maintenance, management, auditing, or verification activities on behalf of the Executive. | ||
(2) The following persons (each of whom is, in this Act, referred to as an “appropriate person”) may, subject to and in accordance with regulations under section 16 , act on behalf of a patient in relation to the patient’s Electronic Health Record— | ||
(a) a person or persons authorised by the patient, | ||
(b) where the patient is a child, a parent or guardian of the patient, | ||
(c) a specified patient representative, | ||
(d) any additional class or classes of persons as may be prescribed by regulations under section 16 . | ||
(3) The Executive shall provide appropriate measures to permit a patient to request rectification of information contained in his or her Electronic Health Record and shall, where appropriate, validate the accuracy of information provided by the patient in his or her request with a relevant health practitioner. | ||
(4) A health services provider may restrict access by a patient or an appropriate person to information contained in an Electronic Health Record where the health services provider has reasonable grounds for believing that such access would be likely to cause serious harm to the physical or mental health of the patient concerned. | ||
(5) A restriction under subsection (4) shall be applied by the health services provider concerned only to the extent that is necessary and proportionate to protect the health of the patient, and only for so long as necessary and proportionate to protect the health of the patient. | ||
(6) Nothing in this section shall operate to prevent a health services provider from granting access to a patient to so much of the information sought in relation to his or her Electronic Health Record as may be granted without causing serious harm to the physical or mental health of the patient concerned. | ||
(7) Subject to subsection (8), the Executive shall— | ||
(a) in creating for, and assigning to, each patient an Electronic Health Record, and | ||
(b) in providing access to Electronic Health Records in accordance with this Act, | ||
adopt such technical, physical, organisational and governance safeguards as the Executive considers necessary to provide the required high level of security and protection against unauthorised, unlogged or inappropriate access to the information contained in an Electronic Health Record. | ||
(8) The Executive shall consult with the Data Protection Commission on the specific safeguards it proposes to adopt in accordance with subsection (7). | ||
(9) This section is without prejudice to the exercise of any right of access of a data subject provided for in Article 15 of the Data Protection Regulation or of a person under the Freedom of Information Act 2014 . | ||
(10) In this section— | ||
“Act of 2015” means the Assisted Decision-Making (Capacity) Act 2015 ; | ||
“adult” means a person who has attained the age of 18 years; | ||
“decision-making representative” has the same meaning as it has in section 2 of the Act of 2015; | ||
“decision-making representation order” has the same meaning as it has in section 2 of the Act of 2015; | ||
“specified patient representative”, in relation to an adult patient who lacks capacity, means any of the following: | ||
(a) a decision-making representative where the terms of the decision-making representation order made in that regard under section 38(2)(b) of the Act of 2015 confers functions on the representative concerned in respect of the matter; | ||
(b) in the case of a ward of court, the committee of the ward of court; | ||
(c) any other person duly appointed in that behalf by the High Court. | ||
|
Restrictions on access to Electronic Health Records | ||
|
14. (1) Subject to this Part, a patient or an appropriate person may, in the prescribed form and manner, restrict access by health services providers to all or part of the patient’s Electronic Health Record. | ||
(2) A patient or an appropriate person may, in the prescribed form and manner, amend or modify a restriction made under subsection (1). | ||
(3) (a) The Executive shall inform a patient or an appropriate person that restricting access to the patient’s Electronic Health Record shall mean that, when providing care and treatment to the patient, a health services provider will not be able to take account of any information contained in the Electronic Health Record that he or she does not have access to by virtue of the patient’s restriction of such access and therefore such restriction may have an adverse impact on the provision of care and treatment to the patient. | ||
(b) The Executive shall retain, for a prescribed period, a record that the patient or appropriate person acknowledged that he or she had been informed of the matters referred to in paragraph (a) prior to the restriction of access to all or part of his or her Electronic Health Record in accordance with subsection (1). | ||
(4) (a) A health services provider may access such part of a patient’s Electronic Health Record in relation to which access is restricted in accordance with subsection (1) (in this subsection referred to as “restricted information”) where he or she considers that access is necessary in order to protect the vital interests of the patient. | ||
(b) Where a health services provider accesses restricted information the Executive shall— | ||
(i) retain, for a prescribed period, a record in relation to the matter, including the reason given by the health services provider for his or her decision to access the restricted information, and | ||
(ii) make available to the patient concerned, in the prescribed form and manner, a copy of the record referred to in subparagraph (i). | ||
|
Information on access to Electronic Health Records | ||
|
15. (1) Subject to subsection (2), the Executive shall make available without delay and free of charge, to a patient or an appropriate person information, including by way of automatic electronic notifications, in relation to any access to the patient’s Electronic Health Record. | ||
(2) The Executive may, in exceptional circumstances, where there are factual indications that disclosure would endanger the vital interests or rights of the health practitioner or the care of the patient concerned, restrict the application of subsection (1) in accordance with regulations under section 16 (3)(j). | ||
(3) In this section, “information” includes— | ||
(a) details of the health services provider or other individual who accessed the Electronic Health Record, | ||
(b) the date and time of such access, and | ||
(c) the personal health data that was accessed. | ||
|
Regulations in relation to accessing Electronic Health Record | ||
|
16. (1) Subject to subsection (4), the Minister may, having regard to the matters specified in subsection (2), make regulations for the purpose of enabling access to an Electronic Health Record. | ||
(2) When making regulations under subsection (1), the Minister shall have regard to the following: | ||
(a) the need to improve a patient’s access to, and control over, his or her personal health data; | ||
(b) the need to improve health outcomes for patients and patient safety; | ||
(c) the benefits of integrated care and treatment of patients; | ||
(d) the need to ensure the efficient use of resources in the delivery of health services; | ||
(e) the need to ensure the effective and efficient management and delivery of health services; | ||
(f) the need to improve the interaction of patients with health practitioners; | ||
(g) when the regulations relate to patients who are children, the best interests of the class or classes of child specified in the regulations, having regard to the age and maturity of such class or classes of child and such other matters as the Minister considers appropriate for the purposes of the regulations; | ||
(h) the views of such persons as the Minister has consulted under subsection (4). | ||
(3) Notwithstanding the generality of subsection (1), regulations under that subsection may provide for all or any of the following: | ||
(a) measures to permit a patient to access all, or a specified part, of his or her Electronic Health Record; | ||
(b) measures to permit a patient to authorise a named person or persons to access all, or a specified part, of the patient’s Electronic Health Record; | ||
(c) measures to permit an appropriate person to access all, or a specified part, of a patient’s Electronic Health Record; | ||
(d) an additional class or classes of person who may act as an appropriate person on behalf of a patient or class or classes of patient; | ||
(e) measures to permit a patient to restrict access by a health services provider to all, or a specified part, of his or her Electronic Health Record under section 14 (1); | ||
(f) measures to permit an appropriate person to restrict access by a health services provider to all, or a specified part, of a patient’s Electronic Health Record under section 14 (1); | ||
(g) the form and manner in which restriction of access to a patient’s Electronic Health Record may be amended or modified by a patient or an appropriate person under section 14 (2); | ||
(h) the form and manner in relation to which, and period during which, a record under section 14 (3)(b) shall be retained by the Executive; | ||
(i) the form and manner in relation to which, and period during which, a record under section 14 (4)(b)(i) shall be retained by the Executive; | ||
(j) the form and manner in which a record under section 14 (4)(b)(i) may be made available to a patient; | ||
(k) measures to permit the Executive to restrict the application of section 15(1); | ||
(l) such additional, incidental, consequential or supplemental matters as the Minister considers necessary or expedient for the purposes of giving full effect to the regulations. | ||
(4) Prior to making regulations under subsection (1), the Minister— | ||
(a) shall consult— | ||
(i) any other Minister of the Government as he or she considers appropriate having regard to the functions of that other Minister of the Government, and | ||
(ii) the Data Protection Commission, | ||
and | ||
(b) may consult any other person the Minister considers appropriate. | ||
|
Uses of Electronic Health Record | ||
|
17. An Electronic Health Record may— | ||
(a) be used by a health services provider only for the purpose of the care and treatment of the patient to whom it relates except where the patient concerned consents to its use for another purpose, and | ||
(b) subject to suitable transparency arrangements being in place, be used by the Executive where it considers that its use is necessary for— | ||
(i) a public interest purpose in the area of public and occupational health, including activities for the protection against serious cross-border threats to health and public health surveillance or activities ensuring high levels of quality and safety of health services, including patient safety, and of medicinal products or medical devices, | ||
(ii) the development of policy and regulatory activities in order to improve, promote and protect the health and welfare of the public, including integrated service planning, performance management and the efficient and effective use of resources in the area of health, or | ||
(iii) the purpose of statistics, including national, multi-national and EU level official statistics, within the meaning of Regulation (EC) No. 223/2009 of the European Parliament and of the Council of 11 March 20094 , related to health or care sectors. | ||
|
Electronic exchange of information in Electronic Health Record with third country | ||
|
18. (1) Subject to this section, the Executive may in the interests of the care and treatment of— | ||
(a) patients who have been assigned an Electronic Health Record who travel to, and may require care and treatment in, a third country, and | ||
(b) persons who have been assigned the equivalent of an Electronic Health Record in a third country who travel to, and may require care and treatment in, the State, | ||
enter into a reciprocal arrangement or other agreement with a third country health services provider for the purpose of sharing relevant information included in an Electronic Health Record or its equivalent with the third country health services provider concerned. | ||
(2) An arrangement or agreement entered into under this section shall— | ||
(a) permit secure access by a third country health services provider to the information contained in an Electronic Health Record, and | ||
(b) permit secure access by a health services provider in the State to the information contained in the equivalent of an Electronic Health Record in a third country. | ||
(3) The Executive shall not enter into an arrangement or agreement under this section except after consultation with the Data Protection Commission. | ||
(4) An arrangement or agreement under this section shall specify rules in relation to governance and confidentiality. | ||
(5) In this section— | ||
“third country” means a country or territory other than the State or another Member State; | ||
“third country health services provider” means a body in a third country that performs functions equivalent, or similar, to the functions performed by the Executive. | ||
|
Request to provide personal health data for purposes of Electronic Health Record | ||
|
19. (1) The Executive shall, for the purposes of this Part, identify such health services providers that it considers hold personal health data specified in section 11 . | ||
(2) The Executive may, from time to time, whenever it considers it appropriate, request a health services provider identified under subsection (1) to provide the Executive with such class or classes of personal health data in respect of such class or classes of patient as the Executive considers appropriate and specifies in the request. | ||
(3) A request under subsection (2) shall be in writing and shall specify the following: | ||
(a) the reason for the request; | ||
(b) the period within which the request shall be complied with including, where information is to be updated, the period within which updates are to be made; | ||
(c) that the request should be complied with in a digital format, utilising the standards and interoperability requirements specified in the request; | ||
(d) that, if a health services provider fails to comply in whole or in part with the request within the period specified in paragraph (b) the Executive may, in accordance with section 20 , apply to the Circuit Court for an order directing the health services provider to comply with the request. | ||
(4) A health services provider shall comply with a request under subsection (2). | ||
(5) In this section, “health services provider” does not include the Executive. | ||
|
Non-compliance with a request under section 19(2) | ||
|
20. (1) Where a health services provider fails to comply, in whole or in part, with a request under section 19 (2) the Executive may issue a notice to the health services provider concerned requesting him or her to comply with the request within such period (being not less than one month from the date of the notice) as is specified in the notice. | ||
(2) Where, having received a notice under subsection (1), the health services provider fails to comply, in whole or in part, with the request under section 19 within the period specified in the notice the Executive may make an application to the Circuit Court. | ||
(3) Where, on application to the Circuit Court by the Executive, the Court is satisfied that— | ||
(a) the request was properly made by the Executive in accordance with section 19 , and | ||
(b) the health services provider to which a request was made under section 19 has failed to comply, in whole or in part, with the request, | ||
the court may by order direct the health services provider concerned to comply with the request. | ||
(4) An application under subsection (2) shall be by way of motion, and the Circuit Court when considering the matter may make such interim or interlocutory order (if any) as it considers appropriate and the order by which an application under this section is determined may contain such terms and conditions (if any) as to the payment of costs as the Court considers appropriate. | ||
(5) The jurisdiction conferred on the Circuit Court by this section may be exercised by a judge of that Court assigned to the circuit in which the health services provider concerned carries on his or her practice. | ||
|
Guidelines | ||
|
21. (1) The Executive shall, from time to time, with the consent of the Minister and following consultation with health practitioners, patient representative groups, the Health Information and Quality Authority, the Data Protection Commission, the National Disability Authority and such other persons as the Executive considers appropriate, prepare guidelines for the purposes of this Act. | ||
(2) Notwithstanding the generality of subsection (1), guidelines under this section may specify— | ||
(a) the digital format, and the standards and interoperability requirements required for the purposes of section 7 (2)(a), | ||
(b) the periods within which personal health data shall be forwarded in accordance with section 7 (2)(b), | ||
(c) a class or classes of person who may act on behalf of a patient for the purpose of section 8 , | ||
(d) measures to be taken by a health services provider in accordance with section 9 , | ||
(e) measures to enable health services providers to access Electronic Health Records of their patients, | ||
(f) measures to enable a patient to access his or her Electronic Health Record, | ||
(g) notwithstanding the generality of paragraph (f), where the patient is a person with a disability within the meaning of the Disability Act 2005 , additional targeted measures to enable the patient to access his or her Electronic Health Record, | ||
(h) such other matters that the Executive considers appropriate for the purposes of this Act. | ||
(3) Guidelines under this section shall be published on a website maintained by or on behalf of the Executive. | ||
|
PART 4 Provision of Health Information to Executive | ||
|
Provision of health information to Executive | ||
|
22. (1) Subject to this section, and without prejudice to any other obligation or power to provide or request information under any other enactment or rule of law, the Executive may request a relevant person to provide the Executive with such class or classes of health information as it specifies in the request. | ||
(2) The Executive may make a request under subsection (1) where it considers that such a request is necessary for— | ||
(a) a public interest purpose in the area of public and occupational health, including activities for the protection against serious cross-border threats to health and public health surveillance or activities ensuring high levels of quality and safety of health services, including patient safety, and of medicinal products or medical devices, | ||
(b) the development of policy and regulatory activities in order to improve, promote and protect the health and welfare of the public, including integrated service planning, performance management and the efficient and effective use of resources in the area of health, or | ||
(c) the purpose of statistics, including national, multi-national and EU level official statistics within the meaning of Regulation (EC) No. 223/2009 of the European Parliament and of the Council of 11 March 20095 , related to health or care sectors. | ||
(3) A request under subsection (1)— | ||
(a) shall request only such information as is relevant, necessary and proportionate for the purpose in relation to which the request was made, and | ||
(b) may request such information to be provided on a recurring or periodic basis. | ||
(4) Where a request under subsection (1) relates, in whole or in part, to personal data, the Executive may not make the request unless— | ||
(a) it has decided, following consideration, that the purpose of the request could not be met by anonymised or other data (not being personal data), and | ||
(b) it has carried out an assessment of the data protection implications of the request and, where the assessment indicates a high risk to the rights and freedoms of individuals, the Executive has carried out a data protection impact assessment. | ||
(5) (a) Where a request under subsection (1) relates, in whole or in part, to special categories of personal data, the Executive shall adopt suitable and specific measures to protect the data, which may include: | ||
(i) limitations on access to the data undergoing processing within the Executive in order to prevent unauthorised consultation, alteration, disclosure or erasure of the data; | ||
(ii) strict time limits for the erasure of the data and mechanisms to ensure that such time limits are observed; | ||
(iii) specific targeted training for those involved in processing operations; | ||
(iv) technical and organisational measures to ensure respect for the principle of data minimisation, including pseudonymisation provided that the purposes of the data processing can be fulfilled in that manner. | ||
(b) The Executive shall consult the Data Protection Commission on the suitable and specific measures it proposes to adopt under paragraph (a). | ||
(6) A request under subsection (1) shall be in writing and shall specify the following: | ||
(a) the date of, and the reason for, the request and the purpose for which the information is to be processed; | ||
(b) the legal basis for making the request and the requirement to comply with it; | ||
(c) the structured collection of health information to be provided; | ||
(d) the period within which the request shall be complied with including, where information is to be updated, the period within which updates are to be made; | ||
(e) the digital format in which the information shall be provided; | ||
(f) that, if a relevant person fails to comply in whole or in part with the request within the period specified in paragraph (d) the Executive may, in accordance with section 23 , apply to the Circuit Court for an order directing the relevant person to comply with the request. | ||
(7) A relevant person shall comply with a request under subsection (1). | ||
(8) A notice in relation to every request made under subsection (1) shall be published on a website maintained by or on behalf of the Executive and shall specify the following— | ||
(a) the purpose referred to in subsection (2) for which the health information was requested, | ||
(b) a description of the class or classes of health information requested, | ||
(c) the relevant person or category of relevant persons to whom the request was made, | ||
(d) where a data protection impact assessment has been carried out, a summary of the findings of the assessment. | ||
|
Non-compliance with a request under section 22 | ||
|
23. (1) Where a relevant person fails to comply, in whole or in part, with a request under section 22 , the Executive may issue a notice in writing to the relevant person concerned requesting him or her to comply with the request within such period (being not less than one month from the date of the notice) as is specified in the notice. | ||
(2) Where, having received a notice under subsection (1), the relevant person fails to comply, in whole or in part, with the request under section 22 within the period specified in the notice the Executive may make an application to the Circuit Court. | ||
(3) Where, on application to the Circuit Court in that behalf by the Executive, the Court is satisfied that— | ||
(a) the request was made by the Executive in accordance with section 22 , and | ||
(b) the relevant person to which the request was made has failed to comply, in whole or in part, with the request, | ||
the court shall, unless there is good and sufficient reason not to do so, make an order directing the relevant person to comply with the request. | ||
(4) In considering an application under subsection (2), the Circuit Court shall have regard to— | ||
(a) the public interest nature of the request and, in particular, the purpose for which the health information was requested under subsection (2) of section 22 , and | ||
(b) whether or not the health information requested under that subsection is necessary and proportionate for that purpose. | ||
(5) An application under subsection (2) shall be by way of motion, and the Circuit Court when considering the matter may make such interim or interlocutory order (if any) as it considers appropriate and the order by which an application under this section is determined may contain such terms and conditions (if any) as to the payment of costs as the Court considers appropriate. | ||
(6) The jurisdiction conferred on the Circuit Court by this section may be exercised by a judge of that Court assigned to the circuit in which the relevant person concerned carries on his or her practice. | ||
|
Use of health information obtained by Executive under section 22 | ||
|
24. (1) The Executive shall use the health information provided under section 22 — | ||
(a) on the basis of, and in accordance with, the purposes specified in the request, and | ||
(b) on its own or in association with other health information held by the Executive, including other health information obtained by the Executive under section 22 . | ||
(2) The Executive shall not re-identify or seek to re-identify patients in relation to whom the health information which it obtained based on the request under section 22 relates. | ||
(3) The Executive shall retain the health information provided under section 22 only for such period as it considers necessary to do so and shall publish on its website the period in relation to which the health information concerned was retained and the reasons determining such period of retention. | ||
(4) The Executive shall, not less than once every 18 months, publish on a website maintained by or on behalf of the Executive a report containing a summary of the outputs of use of the information obtained in accordance with this Part. | ||
|
PART 5 Amendment of Patient Safety (Notifiable Incidents and Open Disclosure) Act 2023 | ||
|
Amendment of section 68 of Patient Safety (Notifiable Incidents and Open Disclosure) Act 2023 | ||
|
25. (1) Section 68 of the Act of 2023 is amended, insofar as that section inserts section 41A(10) in the Health Act 2007 , in the definition of “relevant designated centre”, by the substitution of “paragraph (a)(iii) or (c)” for “paragraph (c)”. | ||
(2) The amendment effected by subsection (1) shall come into operation on the date on which section 68 of the Act of 2023 comes into operation. | ||
(3) In this section, “Act of 2023” means the Patient Safety (Notifiable Incidents and Open Disclosure) Act 2023 . | ||
