Medical Data Confidentiality: The Georgian Regime
The Georgian special regime for the confidentiality of medical data is written into the Law on Medical Practice: it contains the core confidentiality duty, the rules of access to and correction of documentation, the specificity of telemedicine, and the conditions for producing records. The categories of the United States HIPAA and of European Union data-protection law — protected health information, special-category data — are non-Georgian concepts: the page is carried by the Georgian law, with the Georgian Law on Personal Data Protection adding the general background.
Article 48 of the law sets the core duty: the subject of independent medical activity must, save for cases provided by legislation, keep confidential the information about the patient's state of health and private life — both while conducting the activity and after its cessation, both during the patient's life and after death. These two "afters" set the severity of the regime: the duty is not lifted either by closing the practice or by the patient's death.
The Permissible Cases of Disclosure
The law itself supplies the list of disclosures. The subject may disclose confidential information where: the patient gives the right to disclose; non-disclosure threatens the health or life of a third person whose identity is known; a substantiated suspicion of a disease subject to mandatory registration exists; the information is supplied to other medical personnel participating in the service; disclosure is necessary for a forensic medical examination; law-enforcement bodies demand it under a court decision; the information concerns a possible fact of violence against women or domestic violence and a risk of repetition exists — in which case it is communicated only to the relevant state body; the information is supplied to state bodies for establishing social benefits — where the patient's consent is required; and, for teaching and scientific purposes, the data are presented so that identification is impossible.
This list is a working instrument: every disclosure must rest on one of its items, and when responsibility is at issue it is the subject who shows which item covers the act. Outside it, disclosure is a violation — though the patient's grant of the right to disclose and the protection of a third person are the most frequent grounds.