"Fakty" TVN reporter reveals that patients' prescription history was available to all doctors

In his report for "Fakty" TVN, Marek Nowicki showed how any person having access to the gabinet.gov.pl website, and knowing anyone's PESEL number, could find information regarding all medicines ever prescribed to a given person. The system was meant to allow doctors to see their patients' history and only with their consent. In practice, any doctor could check any patient without their consent.

The Ministry of Health said on social media on Tuesday evening it had decided to temporarily switch off this function in the system. The ministry added that it would only switch it back once the patients have been granted access to see who and when viewed their medical history.

TVN24 asked Poland's Minister of Digital Affairs Janusz Cieszyński about Marek Nowicki's findings. "First of all, it would be good to say that the e-Zdrowie system has been constructed in a way that each action involving our data is recorded, and all actions related to getting access to a patient's information strictly require their consent," he said.

"I've yesterday's report in "Fakty" TVN, in which a doctor, the chief of the Supreme Medical Chamber in this case, after receiving a patient's consent, could twice access their information stored in the system. And it is the patient's consent that is the fundamental issue in this case, as the majority of things in the health care happen exactly after we, as patients, have given our consent," the minister added.

He also said that doctors viewing patients' prescription history without their consent are committing a crime because, in such case, a doctor provides a false information regarding a patient's consent to grant access to their medical history.

Minister Cieszyński added that the electronic system has special options allowing to find out who and when was checking information about a patient. To prove his point, he used the mObywatel application as an example.

"You can check when crucial activities were taking place, that is the time when you logged in, the time you generated a mObywatel document," he told a reporter, who then pointed out that, in the case of the e-Zdrowie system, the patients should be receiving notifications whenever a doctor logs in to check their information.

"Such a solution can be introduce, of course. I think it is a natural cycle in the development of e-Zdrowie to such solutions being introduced," Cieszyński replied. "We should remember that electronic systems, unlike paper documentation, are systems which exactly guarantee accountability, that is the option to check if information in the system was viewed by anyone. Therefore, such a possibility exists and will continue to exist," he added.

Asked about situations in which a doctor enters a patient's profile without their consent, Cieszyński said that "it's a natural order of things when it comes to the development of e-Zdrowie systems, that a growing scope of information about what's happening in the system is made available to the users".

Marek Nowicki commented on the minister's words in TVN24. "Ladies and gentlemen, this minister is responsible for our digital security. Why the minister isn't speaking straightforwardly?" - he asked.

"In yesterday's report we showed cases in which we enter the PESEL number into the system, into gabinet.gov.pl, and we enter and see patients' information. Of course, we had the consent of those two patients, those PESEL holders. But it was a verbal consent. Nowhere in the system could the doctor see that consent," the reporter explained.

Asked how such a consent is marked in the system, Nowicki said that "a doctor ticks a patient's consent box".

"Minister Cieszyński says there's criminal liability - if a doctor doesn't have the consent and clicks that he has, then they have violated the law. But the fact a doctor has broken the law is know to minister Cieszyński and to e-Zdrowie clerks, but not to us, the citizens. And so a question to minister Cieszyński: how many such law violations we've had? This system has been functioning since 2019. From what the minister is saying, it appears this is not a system error from recent weeks, but that it's been functioning this way since 2019. Why haven't we been informed that it's functioning like this?" - the reporter asked.

Nowicki also noted that paper prescriptions have almost gone out of use. "How awfully convoluted is the minister's explanation that back in the day it was easier to violate the physician–patient privilege, that someone could open a cabinet and browse through papers," he said.

"What is the scale of this phenomenon? This is absolutely incomparable. It probably did happen so that someone was looking through paper data. But this was a violation in the scale of a clinic or a hospital. And yet here we have a nationwide system which involves nearly 40 million citizens," Nowicki said. "It should be under control. It's not enough that minister Cieszyński knows who enters our accounts and checks. We expect a following report: how many people do check and violate these regulations."

He argued that the system should be based on patients' right to know who enters their accounts and views their medical data, including prescription history.

"Let's keep things in proportion. The e-prescription system is a very good system. It's great that this system operates, and it's great because the healthcare system work better thanks to it. But we need to be aware and certain that we are safe in this system," he said. "I don't feel safe after hearing the minister," the reporter added.

Nowicki also told TVN24 about his findings. "I was informed about by doctors who had been experiencing troubles with issuing prescriptions and had tried to somehow issue them in this system, which works disastrously. It turns out that if you click on an additional function under the PESEL number, you can check information of every patient, no matter if you are their doctor or not, the PESEL number is all you need. This is horrifying," he explained.

He added that "the system creators say there has to be such an option because in life-threatening situations you might need to check someone's data quick, immediately". "Not only when it's my patient, but also when someone is taken to a hospital and is treated by a doctor who has never seen that person before. These are extraordinary situations in which such access has to be available," the reporter said.

"Now the crux of the matter is that we, as citizens, should know that someone was accesing our accounts and checked our information, that someone viewed our medication history and was interested in our medical conditions," Nowicki stressed.

He added that email services or social media immediately inform users whenever something wrong or irregular happens.

"And yet here the situation involves such sensitive data and we don't get any information in that regard. It's a scandal," he said.

The reporter also underscored that the history of entries into our accounts by doctors should be recorded. "Especially given that this system, this could, the E-Zdrowie Center has information on who accesses our data, who is checking us. But only the officials know about it, and we, the citizens to whom it pertains, do not. We should be notified about it and then we would have social control," Marek Nowicki added.

gf