Spanish DPA Flags Data Protection Gaps in Health Sciences Student Patient Privacy Protocol

Key Takeaways

• The Spanish Data Protection Agency's legal office (Gabinete Jurídico) reviewed a draft protocol governing student and resident access to patient information and identified three data protection concerns.
• These were the unclear legal basis for patient refusal of student presence, overly vague limits on clinical record access, and missing file-creation requirements for a student register.
• Although the report applies the now-superseded LOPD (Organic Law 15/1999), it shows how regulators assess health data access, consent, and governance, which remains relevant for organizations handling sensitive data.

Deep Dive

The report (N/REF 311893/2016) is a legal opinion on a draft protocol for protecting patient privacy when health sciences students and residents take part in care. It is not a binding rule. The agency evaluated the protocol solely under data protection law, citing LOPD Articles 7.3, 7.6, and 8, Law 41/2002 on patient autonomy (Articles 15 and 16), and Article 104.1 of the General Health Law. Note that the metadata date (2026-09-03) conflicts with the 2016 file reference, and the LOPD has since been replaced by the GDPR and Organic Law 3/2018. Teams should treat this as historical guidance and verify its current applicability.

The agency raised three main points. First, the protocol lets patients refuse student presence through verbal consent (section 5.3) and restricts students to anonymized records unless the patient expressly consents (section 7.1.3). The agency said the protocol should state the legal basis for the patient's right to refuse, given that the General Health Law requires the health system to be available for teaching. Second, section 7.1.2 lets health center managers limit professionals' access to medical records based on "context of care" or local access policy. The agency considered this potentially contrary to LOPD Article 7.6 and Law 41/2002 Article 16, which guarantee access for professionals involved in diagnosis or treatment. It found the criteria vague and lacking specific justification, and said the phrase "no one can access them without authorization" in Annex II should be reviewed. Third, the "Register of students" in section 9.1 is a file under LOPD Article 3(b), yet the protocol does not mention file creation and maintenance requirements. The agency recommended stating that each responsible entity must comply with them.

No deadlines are specified. Compliance professionals should take the following actions: - Document the legal basis for every processing activity involving health data, including teaching and training uses. - Define access-control rules for clinical records on clear, justified criteria tied to care roles rather than broad discretionary policies. - Check that consent mechanisms for sensitive data are properly documented, since verbal consent may be hard to evidence. - Map registers of trainees or staff to current obligations, including records of processing, notices, and registration or governance duties. - Review confidentiality undertakings for wording that conflicts with legitimate care-related access.

The risk impact is moderate. Vague legal bases, poorly justified access restrictions, and undocumented consent can lead to regulatory findings, patient complaints, and weaker defensibility in an inquiry. Under the GDPR, special category health data carries heightened exposure, including administrative fines. Financial institutions with health data, such as insurers, benefits providers, and occupational health programs, can use this report as a benchmark for access governance and legal-basis documentation.

Source: Spanish Data Protection Agency (Agencia Española de Protección de Datos)