New Regulation on the Processing of Health Data

Law Amending the Social Security and General Health Insurance Law and Certain Laws (Law) is published in the Official Gazette dated 15.01.2025 and numbered 32783. The Law adds Additional Article 19 to the Foundation Law on Health Services dated 07.05.1987 and numbered 3359, which regulates the processing of health data by health institutions and the Ministry of Health (Ministry) within the scope of health services.

Additional Article 19 stipulates that the personal data of those who apply to public or private healthcare institutions and healthcare professionals to receive healthcare services may be processed within the scope of healthcare services and that the Ministry may access such data to provide healthcare services, protect public health, preventive medicine, medical diagnosis, treatment and care services, planning healthcare services and calculating costs. On the other hand, it is stated that health data cannot be transferred except under the conditions stipulated by the Personal Data Protection Law No. 6698 (PDPL).

The amendment also obligates public institutions and organizations, private legal entities, and natural persons employing health personnel to notify the Ministry of the personnel they employ and their movements. The Ministry will take the necessary measures to ensure the security of the personal health data obtained by PDPL. A security system will be established to allow monitoring of which staff member uses the registered information in the system and for what purpose.