Medical Confidentiality and Personal Data Protection
Medical confidentiality protects health information and the fact of seeking care. Personal data law adds a security and lawful-processing layer. Health data are a special category in Kazakhstan's personal data legislation.
Rules
- Disclose only with valid consent or a legal exception: reporting infectious disease, protecting life and health, court-ordered disclosure, minor's representatives, or emergency.
- Collect only what is needed; tell the patient the purpose; secure paper and electronic records; limit staff access.
- For photographs, case reports and teaching, de-identification is preferred; if the patient is identifiable, obtain specific consent and explain the audience and duration.
Worked example
A dentist wants to post a before-and-after photo on Instagram. The image shows a distinctive tattoo and a rare tooth anomaly. Even with a signed general treatment consent, this is a separate use. The dentist should obtain specific consent for publication, or crop and anonymize so the patient cannot be identified.
Traps
Discussing a case in a crowded waiting room; sharing records with an employer or insurer without consent; assuming death removes protection; treating a name removed as always anonymous; forgetting that appointment reminders reveal health data.