Health data is personal data relating to the physical or mental health of a person which reveals information about their health status.
What does it include?
Health data includes, for example, diagnoses, medical findings, medication, information on disabilities, periods of sick leave and information about healthcare services received. Data from fitness apps can also be health data if it allows conclusions to be drawn about a person's state of health.
Requirements for processing
Health data belongs to the special categories of personal data. Its processing is only permitted if an exception under Art. 9(2) GDPR applies, for example for the purposes of healthcare, occupational medicine or where explicit consent has been given.
Employers may only process health data within narrow limits, for example in connection with continued pay during sickness. For professionals bound by confidentiality, the duty of professional secrecy applies in addition.
Legal provisions
- Art. 4(15) GDPR
- Definition of data concerning health.
- Art. 9 GDPR
- Prohibition of processing and exceptions for special categories.
- Section 22 BDSG
- National grounds for permitted processing, for example for preventive healthcare.
Related terms.
Biometric data Biometric data is data resulting from specific technical processing relating to physical, physiological or behavioural characteristics which allows or confirms the unique identification of a person. Art. 4(14) GDPR Employee data protection Employee data protection comprises the rules governing the processing of personal data of job applicants, employees and former employees. Art. 88 GDPR 