Under Art. 5 of the Act of June 16, 2023, amending the Act on Patient Rights and the Commissioner for Patients’ Rights and certain other acts, the Polish legislator has significantly expanded the catalog of rooms (in entities performing medical activities[1]) that may be covered by video monitoring.

From September 6, 2023 (under the amended Article 23a of the Act of April 5, 2011, on medical activities (hereinafter referred to as “UDL”)), it is possible to use video monitoring (without sound recording) in every room of:

• a hospital,
• care and treatment facility,
• nursing and care facility,
• medical rehabilitation facility,
• a hospice

where health services are provided.

Vague and evaluative criteria for the use of video monitoring in rooms where health services are provided

The legislator amending Art. 23a of the UDL defined the criteria enabling the use of video monitoring in rooms where health services are provided, but he did so in a very enigmatic and imprecise manner.

The analyzed provision states that it will be possible to cover a room with video monitoring only when necessary:

• in the process of treating patients or
• to ensure their safety.

The amended provision imposes an obligation to consider:

• the duty to respect the patient’s privacy and dignity, including transmitting monitoring images in a way that does not allow showing intimate physiological activities,
• the need to use monitoring in each room,
• the need to protect personal data.

The method of carrying out the monitoring process in the above-mentioned rooms is to be determined by the director of the entity performing medical activities according to the organizational rules. Therefore, the legislator does not allow for any other internal basis for monitoring. Hence, it cannot be introduced by a separate order or official order.[2]

No need to obtain patient consent

The use of monitoring undoubtedly constitutes an interference with the right to privacy, which in the case of patients is protected under Art. 20 section 1 of the Act of November 6, 2008, on patient rights and the Commissioner for Patients’ Rights (hereinafter referred to as “UPP”).

It is worth emphasizing that the application of the above-mentioned monitoring, shall take place without the patient’s consent. The processing of patient personal data will be based on the legitimate interest of the medical facility (Article 6(1)(f) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons in connection with the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as “GDPR”). However, the patient will be able to object to this matter (under Article 21 of the GDPR), which in turn will justify turning off the camera.

What is crucial, however, is, that to object the patient must know that the room in which he is located or in which services will be provided to him is monitored. For this reason, it is particularly important that the rooms subject to monitoring are properly marked and that patients (during preparation for the procedure) are informed that the room in which the procedure will be performed is monitored.

Purpose and period of storage of image recordings

In Art. 23a section 2 of the UDL, it is indicated that image recordings obtained because of monitoring (containing personal data) are processed by the entity performing medical activities only for the purposes for which they were collected and stored for a period not longer than 3 months from the date of recording. After the indicated period, image recordings containing personal data obtained because of monitoring are destroyed, unless separate provisions provide otherwise.

Responsibility will rest with the director of the entity performing medical activities

Amendments to Art. 23a of the Medical Act provide that the responsibility for the lawful use of video monitoring will rest with the director of the entity performing medical activities.

Practitioners’ position

In the opinion of experts from the Jabłoński Koźmiński law firm, this type of (laconic) regulation creates room for numerous over-interpretations, in particular complete freedom in the use of video monitoring. The lack of detailed criteria for the use of video monitoring in rooms where health services are provided may result in medical facilities deciding to cover individual rooms with video monitoring as a precautionary measure. The above-mentioned may harm both the director of the entity performing medical activities (by imposition of an administrative fine by the President of the Personal Data Protection Office for violating the provisions of the GDPR) and the patients whose personal data (including sensitive data) may be unlawfully used.

Extending the possibility of subjecting patients to video monitoring to include rooms where health services are provided (without specifying at the same time the criteria enabling the use of monitoring in this type of rooms) may violate the right to respect for the patient’s dignity and privacy when providing health services (Article 20 section 1 UPP), as well as may violate the right to image protection (Article 23 of The Civil Code of April 23, 1964).

Finally, the regulation in question raises serious constitutional doubts, especially in the context of the following provisions: Art. 47 of the Constitution (protection of privacy and personal life), Art. 31 section 1 and section 3 (protection of individual freedom and the requirement of proportionality of its restrictions), and even Art. 30 (the principle of the inherent and inalienable dignity of every human being).

According to lawyers from the Jabłoński Koźmiński law firm, before introducing video monitoring in rooms where health services are provided, it should be carefully analyzed whether the introduction of such monitoring is necessary in the process of treating patients or to ensure their safety. In other words, it should be considered whether it is possible to achieve the abovementioned purposes differently, to interfere less with the patient’s privacy/intimacy. Finally, it is crucial to conduct a thorough risk analysis (before introducing monitoring), primarily considering the patient’s rights to respect/protection of privacy (intimacy) and dignity.

[1] Pursuant to Art. 2 section 1 point 5 of the UDL, the entity performing medical activities is the medical entity referred to in Art. 4 (i.e., for example: entrepreneurs, independent public health care facilities, research institutes, foundations and associations whose statutory purpose is to perform tasks in the field of health care and whose statute allows for conducting medical activities, – own note), and doctors, nurses, physiotherapists or laboratory diagnostician practicing as part of medical activities as a professional practice referred to in Art. 5.

[2]   J. Ciechorski, Ustawa o działalności leczniczej. Komentarz do wybranych przepisów (Act on medical activities. Commentary on selected provisions), LEX.