Below is the background of the case of I v Finland, in which an individual, “I”, sued the Finish government in the ECHR for failing to protect her medical records.
Background of the Case:
The claimant “I” was a nurse who worked in Finland. Between 1989 and 1994 she worked on fixed terms contracts in a state/public hospital (i.e working for Finland). From 1987 onwards “I” had become a patient at the same hospital she worked at, as she had been diagnosed with HIV.
In early 1992 “I” began to suspect that her colleagues were aware that she had HIV. In the early 1990’s staff had free access to the patient lists and who was being treated by who, so it was entirely possible that they would find out.
In the summer of 1992 I confided her suspicions to her doctor in summer 1992, the hospital’s register was amended so that only the treating clinic’s personnel had access to its patients’ records. i.e a person in the Oncology unit could not see who was being treated in the HIV unit. In addition to this the applicant was re-registered under a false name, to try and hide her identity. Apparently, to further try and hide her illness she later had her identity was changed and she was given a new social security number.
In 1995 the “I” lost her job as her temporary contract was not renewed. She believed that this was because of access to her medical records 3 years earlier.
On 25 November 1996, the applicant complained to the County Administrative Board (lääninhallitus, länsstyrelsen) in Finland, requesting it to examine who had accessed her confidential patient record. F
ollowing this request, the director in charge of the hospital’s archives provided a formal statement with the County Administrative Board. The statement said that is was not possible to find out who, if anyone, had accessed the applicant’s patient record as the data system revealed only the five most recent consultations – and this was by department and not a named individual. And even this scant information was deleted when the records were returned to the archives.
Following this investigation the Finnish County Administrative Board decided, on 20 October 1997, that there e should be privacy for the individual, but the records are not detailed and therefore Board concluded that it could not further rule on whether information had been viewed inappropriately.
However, it did advise the records should be changed so that access to the files is recorded in the future.
As a result of this decision by the board the hospital’s register was amended, in March 1998, so that it became possible retrospectively to identify any person who had accessed a patient record.
In 15 May 2000, the applicant “I” instituted civil proceedings against the District Health Authority (sairaanhoitopiirin kuntayhtymä, samkommunen för sjukvårdsdistriktet), which was responsible for the hospital’s patient register at the time of the incident, claiming non-pecuniary and pecuniary damage for the alleged failure to keep her patient record confidential.
On 10 April 2001, the District Court (käräjäoikeus, tingsrätten) rejected the action. The applicant then appealed to the Court of Appeal (hovioikeus, hovrätten), maintaining her claim that the hospital had not complied with the domestic law, in breach of her right to respect for her private life
On 7 March 2002, the Court of Appeal, found against the applicant and ordered her to pay costs for the respondents legal expenses for both the district court and appeals court – 2,000 and 3271 euros respectively.
Following this “I”, then applied to the Finish Supreme Court (korkein oikeus), claiming that there been a violation of her right to respect for her private life. On 23rd Decemeber 2002 the Supreme Court refused leave to appeal.
Still pursuing the case “I” applied to the ECHR and requested that her name was with held. On 20th June 2003 the president of the Chamber (Nicolas Bratza) agreed to this. On 19th January 2006 the ECHR decided that there was a case to hear.
On 17th July 2008 the court decided in favour of “I” and against Finland