Pseudonymization

Pseudonymization is highly recommended as a security measure for the processing of personal data and security of confidential information, in any type of business, especially if sensitive data is processed.

It is true that the health sector is one of the sectors most in need of security when processing personal data, since the data processed correspond to the so-called special category and the security measures for such data must be strict.

What does the GDPR say about pseudonymization?

Both Article 9 of the RGPD and Article 9 of the LOPD-GDD establish as a general rule that the processing of special category data, among which are the data of the following categories health-related is prohibited. However, exceptions apply to any prohibition, such as when the treatment is necessary for medical diagnosis, for purposes of preventive or occupational medicine, evaluation of the worker’s capacity to work, provision of health or social care or treatment, or management of health and social care systems and services, etc.

Well, the health sector needs to process personal data of their patients for the sole purpose of providing the healthcare services they need, but ensuring that such personal data will be confidential and protected against theft, loss or alteration of these either by internal or external issues.

To this end, hospitals, health centers, clinics, or any health center that treats patients’ personal data, must have implemented the necessary and sufficient technical and organizational security measures, so as to minimize the possibility of being subject to a security breach.

Pseudonymization as a solution

The European Union Agency for Cybersecurity(ENISA) published in March 2022 a document called, where it analyzes the technique of pseudonymization of data in the specific case of the healthcare sector, as a good option to ensure data security.

Recall that Article 4(5) GDPR defines pseudonymization as: “the processing of personal data in such a way that they can no longer be attributed to a natural person without the use of additional information, provided that such additional information is separately identified and subject to technical and organizational measures designed to ensure that the personal data are not attributed to that natural person“.

What are the most effective pseudonymization techniques?

ENISA points out three specifically:

Deterministic pseudonymization:

Always use the same pseudonym for the same data.

Random pseudonymization of the document:

Using the same pseudonym for the same data only within a consistent scope.

Completely random pseudonymization:

Always using a different pseudonym for the same data.

It is up to the healthcare organization (the data controller) to choose which pseudonymization technique it considers the most appropriate, and if it has data processors, it must share with them the option it has applied to the processing of the data, if necessary.

In the case of the health sector, it is common for information to be exchanged between different entities, where pseudonymization can play a key role in guaranteeing the confidentiality of the information shared.

For example, when different clinics, hospitals, etc., treat the same patient and need to perform specialized medical tests, or clinical trials where the aim is to find patterns of reaction to certain drugs or medical treatments in different people.

In addition to the above examples, pseudonymization can be applied to patient-oriented monitoring of health data, such as certain applications downloaded to mobile devices, where vital signs, for example, can be recorded, and the application can be viewed by the patient and the physician, when authorized to do so.

Business Adapter® at your service

If you have a clinic or you are a health professional and want to know how to apply pseudonymization in your business, as well as fully comply with European and Spanish data protection regulations (RGPD + LOPD) to which any company or professional is obliged, contact us by email: info@businessadapter.es, you can also call 96 131 88 04, or leave your message in this form:

[su_button url=”https://businessadapter.es/contacto” target=”blank” background=”#f6f903″ color=”#181818″ size=”7″ center=”yes” icon_color=”#000000″]Contact us, we will be pleased to help you.[/su_button]