Contents
- 1. Health data is a special category
- 2. Legal bases for processing health data
- 3. DPO requirement — who must appoint one?
- 4. Electronic health record (NHIS)
- 5. Medical data retention periods
- 6. Video surveillance in healthcare facilities
- 7. Health data breaches — notifying the CPDP and patients
- 8. Data sharing between healthcare facilities
- 9. Telemedicine and remote consultations
- Frequently asked questions
1. Health data is a special category
Under Article 4, point 15 of the GDPR, “data concerning health” means personal data related to the physical or mental health of a natural person, including the provision of healthcare services, which reveal information about their health status.
Article 9, paragraph 1 of the GDPR generally prohibits the processing of health data. It falls within the “special categories of personal data”, alongside genetic data, biometric data, racial origin and others.
What does health data include?
The scope is broader than it may initially appear:
Diseases and diagnoses
Past and current diseases, diagnostic codes (ICD-10), chronic conditions.
Test results
Laboratory results, diagnostic imaging, histopathology findings, functional tests.
Medical history
Patient history, previous hospitalisations, surgical procedures, allergies, vaccinations.
Prescriptions and treatment
Prescribed medicines, dosages, treatment plans, physiotherapy procedures.
Health insurance data
Personal identification number (EGN, as an identifier in the healthcare system), health insurance number, National Health Insurance Fund (NHIF) data.
Medical device data
Data from blood glucose monitors, pacemakers, fitness trackers (when used for treatment), monitoring equipment.
Important: even “indirect” health information is protected
Under Recital 35 of the GDPR, health data also includes a number, symbol or particular assigned to a natural person for healthcare purposes. This means that even the fact that a person is a patient of a particular specialist (e.g. an oncologist or psychiatrist) may constitute health information. Information about disabilities, decisions of Territorial Expert Medical Commissions (TELK) and data from sick leave certificates also constitute health data.
2. Legal bases for processing health data
Since processing health data is generally prohibited (Article 9(1) GDPR), an exception under Article 9(2) is required in combination with a legal basis under Article 6(1).
Primary basis: medical purposes (Article 9(2)(h))
For direct medical care, the primary legal basis is NOT the patient's consent. Under Article 9, paragraph 2, point (h) of the GDPR, processing is permitted where necessary for the purposes of preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services.
This is also expressly confirmed in Recital 53 of the GDPR, which indicates that processing health data for healthcare purposes should not require the data subject's consent.
Why is consent NOT the basis for direct medical care?
Consent under the GDPR must be freely given (Article 7, Recital 43). In the doctor–patient relationship, it is difficult to guarantee that consent is “freely given” — the patient depends on the doctor and may feel compelled. Furthermore, if the patient withdraws consent, the doctor would be required to stop processing — which could jeopardise the patient's health. Therefore, Article 9(2)(h) is the appropriate basis.
When is consent required?
| Activity | Legal basis | Consent? |
|---|---|---|
| Examination, diagnosis, treatment | Article 9(2)(h) — medical purposes | NO |
| Issuing a prescription | Article 9(2)(h) — medical purposes | NO |
| Recording a medical activity in the NHIS | Article 9(2)(h) + Health Act | NO |
| Patient access to their electronic health record in the NHIS | Article 28д, paragraph 2 of the Health Act | YES — explicit, written |
| Marketing healthcare services | Article 9(2)(a) — consent | YES — explicit |
| Sharing with non-medical parties (insurers, employers) | Article 9(2)(a) — consent | YES — explicit |
| Participation in scientific research | Article 9(2)(j) — scientific purposes + consent | YES (usually) |
| Publishing photos/videos of treatment | Article 9(2)(a) — consent | YES — explicit |
| Additional (non-treatment) services | Article 9(2)(a) — consent | YES |
Warning: informed medical consent ≠ GDPR consent
“Informed consent” under Articles 87–89 of the Health Act (for medical procedures) is different from consent to personal data processing under the GDPR. They have different legal bases, different forms and different consequences upon withdrawal. Do not combine them in a single form.
3. DPO requirement — who must appoint one?
Under Article 37, paragraph 1, point (c) of the GDPR, a data protection officer (DPO) is mandatory where the controller's core activities consist of large-scale processing of special categories of data. Health data is a special category.
The key question is: what constitutes “large-scale”? According to the EDPB Guidelines WP243 (revised), the factors include the number of individuals concerned, the volume of data, the duration of processing and the geographical scope.
| Type of facility | DPO requirement | Rationale |
|---|---|---|
| Hospital (general hospital, university general hospital) | MANDATORY | Large-scale processing of health data — thousands of patients, multiple departments |
| Specialist hospital | MANDATORY | Large-scale processing, sensitive data (oncology, psychiatry, etc.) |
| Group practice / Medical centre | VERY LIKELY | Multiple specialists, a significant number of patients — usually meets the “large-scale” threshold |
| Laboratory (medical diagnostic laboratory, medical diagnostic activity) | LIKELY | High volume of tests, many patients referred by different doctors |
| Pharmacy (chain) | LIKELY | Processes prescriptions and health insurance data, high patient traffic |
| Independent pharmacy | Recommended | Smaller scale, but processes prescriptions and health data |
| Individual doctor / Dentist | NOT mandatory | The Article 29 Working Party's Guidelines WP243 (endorsed by the EDPB) cite individual doctors as an example where appointing a DPO is usually not mandatory — processing is not “large-scale” |
Practical advice: even when it is not mandatory
Even if you are not required to appoint a DPO, we strongly recommend designating a data protection contact person. Health data carries a high risk, and having a specialist significantly reduces the likelihood of breaches. Read more in our article on the DPO — data protection officer.
4. Electronic health record (NHIS)
The National Health Information System (NHIS) is a centralised system governed by Articles 28б–28д of the Health Act. It is Bulgaria's central e-health register and raises key GDPR questions.
Key features of the NHIS:
- Automatic creation — the electronic health record is created upon the individual's first medical entry
- Mandatory recording — all medical activities (examinations, tests, diagnoses, prescriptions, hospitalisations) must be recorded in the NHIS
- Retention period: 50 years — entries are retained for 50 years from their creation
- Controller: Ministry of Health — the Ministry of Health is the controller of the NHIS, and healthcare facilities act as personal data processors in this context
Patient access to the electronic health record
Under Article 28д, paragraph 2 of the Health Act, patient access to their own electronic health record requires explicit written consent. Ordinance Н-6 of 2022 provides for 5 valid methods of giving this consent:
- Using a qualified electronic signature (QES)
- Using a personal identification code (PIC) issued by the National Revenue Agency/National Social Security Institute
- Using an electronic identification means (eID)
- Submitting a written application on paper at a healthcare facility
- Through an authorised representative (with a notarised power of attorney)
European Health Data Space (EHDS)
Regulation (EU) 2025/327 (European Health Data Space) was adopted in 2025 and will significantly change the health data landscape in the EU:
Primary use (from March 2027) — patients will have the right to access their health data in electronic format and the right to portability between Member States. Healthcare professionals will have cross-border access to patient data.
Secondary use (from March 2029) — anonymised/pseudonymised health data may be used for scientific research, innovation and public health through specialised access bodies.
5. Medical data retention periods
The storage limitation principle (Article 5(1)(e) GDPR) requires data to be retained only for as long as necessary. In healthcare, however, there are numerous specific statutory requirements:
| Document / data type | Period | Legal basis |
|---|---|---|
| Medical history (inpatient) | 15 years | Ordinance No. 1 of 2017 on the conditions and procedures for maintaining medical documentation |
| Outpatient examination forms and records | 10 years | Ordinance 1/2014 |
| Laboratory results | 2–5 years | Depending on the type of test and internal rules |
| Prescriptions and prescription booklets | 5 years | Ordinance 4/2009 on the conditions and procedures for prescribing and dispensing medicines |
| Preventive care documentation | 3 years | Ordinance 1/2014 |
| Electronic health record (NHIS) | 50 years | Article 28г of the Health Act |
| NHIF data and reports | 5 years after insurance coverage ends | Health Insurance Act + National Framework Agreement |
| Processing consent records (GDPR) | 5 years after withdrawal or the last processing activity | GDPR Article 7(1) — evidence of consent + limitation period |
Right to erasure — limitations for medical data
The right to erasure under Article 17 GDPR does NOT apply where processing is necessary for preventive or occupational medicine purposes (Article 17(3)(c)). In practice, a patient cannot request erasure of medical records within the statutory retention periods. However, they have the right of access (Article 15) and rectification (Article 16) of inaccurate data.
6. Video surveillance in healthcare facilities
Many hospitals and clinics use video surveillance for security. In a healthcare facility, the stakes are higher — cameras may capture patients in a vulnerable condition.
Legal basis
Video surveillance in healthcare facilities is usually based on Article 6(1)(f) of the GDPR — legitimate interest (the security of patients, staff and property). A balancing assessment between the legitimate interest and data subjects' rights is required.
Strict prohibitions:
- Cameras in examination rooms and clinical procedure rooms
- Cameras in treatment and procedure rooms
- Cameras in areas where patients undress
- Cameras in toilets and bathrooms
- Cameras in staff break rooms
Mandatory measures:
Information signs
Visible signs at every entrance covered by cameras — who conducts the surveillance, for what purpose, and the controller's/DPO's contact details.
Data protection impact assessment (DPIA)
Video surveillance in healthcare facilities almost always requires a DPIA under Article 35 GDPR — systematic monitoring + vulnerable data subjects.
Limited retention period
Recordings are usually retained for between 7 and 30 days, depending on the purpose; the CPDP does not specify a fixed period but requires proportionality, unless there is a specific reason for longer retention (e.g. an incident).
Restricted access
Only designated individuals with a clear need should have access to recordings. Maintain an access log.
For details on GDPR requirements for video surveillance, see our dedicated article: Video Surveillance and GDPR.
7. Health data breaches — notifying the CPDP and patients
Health data breaches are among the most serious incidents under the GDPR. This data is sensitive, and the consequences are almost always severe — from discrimination to threats to life.
Health data = almost always a high-risk breach
According to the EDPB Guidelines on breach notification, a health data breach is classified as high-risk almost automatically. This means a dual obligation:
Article 33 GDPR — notify the CPDP within 72 hours of becoming aware of the breach.
Article 34 GDPR — notify affected patients without undue delay where the breach is likely to result in a high risk to their rights and freedoms.
Examples of serious incidents:
- A ransomware attack encrypting patient databases
- Unauthorised employee access to a public figure's medical records
- A lost laptop containing unencrypted patient data
- Sending medical results to the wrong email address
- A cyberattack against the healthcare facility's NHIS portal
Incident response steps:
Identification and containment
Stop the breach. Isolate the affected systems. Preserve evidence.
Risk assessment
Determine which data is affected, how many patients are involved and what the potential impact is.
Notify the CPDP
Submit a notification to the Commission for Personal Data Protection within 72 hours.
Notify patients
For health data — almost always necessary. Communicate clearly and specifically.
For a detailed step-by-step guide, read: Personal Data Breach — What to Do in the First 72 Hours.
8. Data sharing between healthcare facilities
In medical practice, healthcare facilities often need to exchange patient data. Article 28 of the Health Act governs the permitted cases:
| Purpose of sharing | Permitted? | Conditions |
|---|---|---|
| Continuation of treatment (referral to a specialist) | YES | Necessary for continuity of care. Data minimisation — relevant data only. |
| Threat to the patient's health or life | YES | Emergency situations — no consent required. |
| Identification of the individual | YES | When the patient cannot identify themselves (unconsciousness, dementia). |
| Public health (epidemics, surveillance) | YES | Article 9(2)(i) GDPR — public interest in the area of public health. |
| Medical expert assessment (TELK, NELK) | YES | Statutory basis for medical expert assessment of capacity for work. |
| Anonymised scientific research | YES | After full anonymisation, the GDPR no longer applies. For pseudonymisation — additional measures. |
| Marketing another facility | NO | Not a permissible legal basis for sharing health data. |
| Sharing with insurers without consent | NO | The patient's explicit consent is required. |
Data minimisation principle (Article 5(1)(c) GDPR)
Even where sharing is permitted, you must provide only the data necessary for the specific purpose. If you refer a patient to a cardiologist, you do not need to send their complete dental history. Use secure communication channels and maintain a register of disclosures.
9. Telemedicine and remote consultations
The 2024 amendments to the Health Act formally regulated remote medical activities in Bulgarian legislation. The draft Ordinance on Remote Medical Care underwent public consultation (concluded in July 2025) and is expected to enter into force.
GDPR requirements for telemedicine:
End-to-end encryption
All video/audio communication between doctor and patient must be encrypted. Standard consumer platforms (Viber, Messenger) are NOT suitable.
Recording in the NHIS
All remote medical activities must be recorded in the NHIS, just like in-person activities. This includes diagnoses, prescriptions and recommendations.
Patient authentication
Reliable patient identification is required — using a personal identification number (EGN), health insurance number or electronic identification.
Informed consent
The patient must be informed about the specific aspects of the remote consultation, including limitations and data processing risks.
Data security (Article 32 GDPR)
Appropriate technical measures: encryption at rest, access control, access logs, regular security testing.
DPIA for new technologies
Introducing a telemedicine platform constitutes a “new type of processing” — likely requiring a DPIA under Article 35 GDPR before launch.
Warning: telemedicine platforms
The telemedicine platform is a personal data processor within the meaning of Article 28 GDPR. A data processing agreement (DPA) is required. Check where the data is stored (EEA?), whether there are subprocessors outside the EU, whether the platform complies with ISO/IEC 27001:2022, ISO/IEC 27701:2019 (PIMS) and ISO 27799 (specific to the healthcare sector) or an equivalent standard, and whether recordings are encrypted at rest.
Frequently asked questions
Does my private medical practice need a DPO?
If you are an individual medical practitioner (e.g. a general practitioner or dentist), you are NOT required to appoint a DPO. EDPB (WP243) explicitly excludes individual doctors. However, if you operate a group practice or medical centre with multiple specialists, the requirement likely applies. Read more in our article on DPOs.
Can a patient request erasure of their medical data?
The right to erasure (Article 17 GDPR) does NOT apply where processing is necessary for preventive or occupational medicine purposes (Article 17(3)(c)). Medical records are retained for the statutory periods (e.g. 15 years for medical history). However, the patient has a full right of access (Article 15) and rectification of inaccurate data (Article 16).
What data is automatically recorded in the NHIS?
All medical activities are recorded in the NHIS: examinations, tests, diagnoses, treatments, referrals, prescriptions and hospitalisations. The electronic health record is created automatically upon the first medical entry and retained for 50 years (Article 28г of the Health Act). Patient access requires explicit written consent (Article 28д, paragraph 2).
Must I notify the CPDP of a patient data breach?
Yes, almost always. Health data is a special category under Article 9 GDPR, and a breach involving it is considered high-risk. You must notify the CPDP within 72 hours (Article 33) and affected patients without undue delay (Article 34). See our data breach guide.
Can I use telemedicine and process patient data remotely?
Yes. The 2024 amendments to the Health Act formally regulated remote medical activities. Requirements include end-to-end encrypted communication, recording in the NHIS, informed consent and GDPR compliance (Article 32). Avoid unencrypted consumer platforms such as Viber or Messenger.
