Frequently Asked Questions

Visiting persons from other EU/EEA countries or Switzerland are entitled to all treatment which becomes medically necessary during their stay.

Medically necessary treatment is treatment due to sudden illness or injury during a short-term visit, such as holiday, business trip, family visit or exchange studies, that can’t be postponed and that you must obtain in order to be prevented from being forced to return home before the end of the planned duration of your stay.

Under EU legislation, EU/EEA or Swiss citizens are entitled to enjoy assumption of costs for healthcare provided abroad on the basis of their social security insurance/entitlements to public health services back home. The most common route to enjoy assumption of costs is by presenting your European Health Insurance Card (EHIC) to the treating healthcare provider or hospital. With your European Health Insurance Card you will be entitled to medically necessary treatment under the Social Security Regulations (EC) 883/2004 and 987/2009. You will be treated as a domestic patient with public health insurance and will enjoy assumption of costs according to the same payment method and tariffs applied for domestic patients.

Please note that your European Health Insurance Card is only usable when you are treated in a hospital or by a healthcare provider who is contracted/affiliated to the social security scheme and is entitled to provide services covered under the social security legislation. The local statutory health insurance service or National Contact Point of the country of your visit can provide you with more information on which healthcare providers are registered under the social security scheme.

If you are treated without a valid European Health Insurance Card or you can’t use your card, for example because you are treated in a private hospital, you either pay for the treatment privately or you may be able to file for retrospective reimbursement with your statutory health insurance service upon return home under Directive 2011/24/EU. Under the Directive you will be entitled to assumption of costs as though the treatment was provided in your home country. As a result, the payment method and tariffs of your home country will apply.

For more information on your rights and entitlements to medically necessary treatment during your stay, please contact your statutory health insurance service or the National Contact Point in your home country. They will present you with all needed information on the European Health Insurance Card, such as where to apply for the card, for which treatment to use the card, assumption of costs, what to do when your card is not accepted, and so on.

For more information on accessing healthcare in Greece using your European Health Insurance Card, please follow: Healthcare in Greece using your EHIC

The National Contact Point of the country of your stay can provide you with more information on what to do and who to contact in case you get suddenly ill or injured during your stay abroad.

In case of emergency while staying in the EU or Switzerland, you may call the 112 helpline. The European emergency number 112 is available everywhere in the EU, is free of charge and gives direct access to police assistance, ambulance services or fire and rescue services.

Useful information on accessing health services in Greece for EU citizens is available here.

Your European Health Insurance Card also covers the situation when you suffer from chronic illness (such as diabetes, asthma, cancer or chronic kidney disease) or when you are pregnant, and you know in advance there is a possibility that you may need medical treatment during your stay. As long as the express purpose of your trip was not to access medical treatment, such as to give birth or to receive treatment regarding pregnancy or chronic illness, this will be considered as medically necessary treatment under the Social Security Regulations (EC) 883/2004 and 987/2009.

Be aware that for vital care requiring specialised equipment or staff, you should get a prior agreement from the hospital or health facility where you wish to obtain treatment. This way the foreign institution can ensure the availability and continuity of your treatment during your stay abroad. Examples of such treatments are kidney dialysis, oxygen therapy, special asthma treatment and chemotherapy.

When you are entitled to healthcare under the social security scheme of an EU/EEA country or Switzerland, you have the right to seek healthcare in any other EU/EEA country or Switzerland, also referred to as planned treatment abroad, and to enjoy assumption of costs by your home country.

You have the right to access healthcare, including:
• medical diagnosis
• medical treatment
• the prescription, dispensation and provision of medicines and medical devices

You are able to enjoy assumption of costs for planned treatment in another EU/EEA country under two different EU legal instruments: the Social Security Regulations (EC) 883/2004 & 987/2009 and Directive 2011/24/EU.

Both routes result in different consequences for patients regarding the legal basis, the scope of application, competent authorities, authorisation conditions, applicable reimbursement tariffs, payment procedure and formalities, as well as the level of the patient’s own contribution. Make sure you are always well-informed about any financial and other implications before travelling abroad.

Under the Social Security Regulations (EC) 883/2004 and 987/2009:

• You always need to obtain prior authorisation from your statutory health insurance service before travelling abroad
• You are entitled to assumption of costs as though you were insured under the social security system of the country of treatment
• The treatment concerned must be included in the range of sickness benefits covered under the social security scheme of the country of treatment 
• You enjoy the same payment method and tariffs as domestic patients with public health insurance.

Under Directive 2011/24/EU:

Normally prior authorisation from your statutory health insurance service is not required. However, for certain health services, such as hospital treatment or highly specialised and expensive treatment, prior authorisation might be required

• You are entitled to assumption of costs as though the treatment was provided in your home country.
• The treatment concerned must be included in the range of sickness benefits covered under the social security scheme of your home country (you are only entitled to assumption of costs when your costs would have been assumed were the treatment provided in your home country).
• You will first have to pay for the treatment privately. Retrospectively, you may file for reimbursement with your statutory health insurance service upon returning home. They will apply the same reimbursement tariffs as for treatment provided in your home country.

Before travelling abroad with the purpose of accessing healthcare, you are advised to consult first your statutory health insurance service at home. Besides, the National Contact Point located in your home country will provide you with all necessary information on your rights and entitlements to treatment abroad under both the Social Security Regulations (EC) 883/2004 and 987/2009 and Directive 2011/24/EU.

Useful link: Planned medical care abroad with prior authorization.

You are advised to consult your national contact point for cross-border healthcare in order  to receive customized information and avoid misunderstandings. You may have additional rights to access cross-border healthcare based on national legislation or International Social Security Agreements (bilateral or multilateral).

Under EU legislation, a frontier worker is defined as an employed or self-employed person who resides and works in two different EU/EEA Member States or Switzerland and who usually returns to his or her country of residence on a daily basis or at least once a week. Frontier workers are entitled to healthcare both in the country of employment and in the country of residence.

The frontier worker must file for a S1 form with the statutory health insurance service of the country where he or she is subject to social security legislation (the country of employment). The S1 form must be presented to the social security authority of the country of residence. This way the frontier worker and his or her family members will be entitled to healthcare in both countries, under the respective social security legislation and in each country with the same rights and entitlements as domestic patients with public health insurance.

For more information on your rights and entitlements as a frontier worker, you are advised to contact your statutory health insurance service.

Most of the time you will only be entitled to healthcare in the country of your residence, whether or not on behalf of another country under whose social security legislation you are insured. However, in some cases patients may remain entitled to healthcare in the country of their social security insurance or in the country of previous work:

(! Family Members of a frontier worker residing in a country listed in Annex III of Regulation 883/2004 are excluded from the special arrangements set out below)

• (Posted) workers, including frontier workers, residing in another country than the country of work activity and social security insurance are entitled to healthcare during a stay in the country of work at the own expense of that country and according to its own legislation, as though the person concerned resided in that country.
• Pensioners residing outside the country under whose social security insurance system they are insured, may be entitled to healthcare during a stay back in the country of their social security insurance at the own expense of that country and according to its own legislation, as though the person concerned resided in that country (only applicable when the country of social security insurance has opted for this arrangement and is included in Annex IV Regulation 883/2004)
• Retired frontier workers stay entitled to treatment in the country where they last pursued their work activity, in so far as this is a continuation of treatment which already started during activity. In some cases a retired frontier worker will remain entitled to healthcare in the country of previous work activity, regardless of continuation of treatment or not, at the own expense of that country and according to its own legislation, as though the person concerned resided in that country. This will be the case when s/he has worked for at least two years as a frontier worker in the last five years preceding the effective date of his/her pension and both the Member State of previous work activity as the country of social security insurance have opted for this and are listed in Annex V Regulation 883/2004. In this case the retired frontier worker must file for a S3 form with the national health service/health insurance provider of the country where he or she is subject to social security legislation. The S3 form must be presented to the social security authority of the country of previous work activity.

……..

When going on holiday…
When you suddenly get ill or injured during your stay abroad, you will have to present a valid European Health Insurance Card to the local healthcare provider or hospital. The European Health Insurance Card (EHIC) is a free card, issued by your statutory health insurance service as proof that you are covered under the social security scheme in your home country and thus entitled to public healthcare. The EHIC gives you access to assumption of costs for medically necessary treatment during a short-term stay in another EU/EEA country or Switzerland, such as holiday, business trip or exchange studies.

When travelling abroad with the explicit purpose of receiving treatment there…
When you travel abroad with the explicit purpose of accessing healthcare, prior authorisation from your statutory health insurance service back home may be required.

Whether you need prior authorisation before travelling abroad to seek treatment, depends on whether you exercise your right on cross-border healthcare under the Social Security Regulations or under Directive 2011/24/EU and on which type of healthcare you wish to receive. As a general rule, you probably will need prior authorisation when you plan to receive hospital treatment or in case of highly specialised and expensive treatment abroad.

If you wish to receive cross-border healthcare under the Social Security Regulations, prior authorisation from your statutory health insurance service is always required – both for inpatient and outpatient treatment. When your request for prior authorisation is granted, your statutory health insurance service will issue an S2 form which you will have to present to your treating healthcare provider abroad as proof of your social security coverage.

Generally, under Directive 2011/24/EU, prior authorisation from your statutory health insurance service is not required. However, for some treatments the EU legislator has given the Member States the possibility to establish a system of prior authorisation. In any case, prior authorisation may only be required in case of:

• healthcare involving an overnight hospital stay;
• healthcare involving highly specialised and cost-intensive medical infrastructure or equipment;
• healthcare presenting a risk for the patient’s own safety (patient safety risk) or that of the general population (general population safety risk);
• healthcare provided by a provider that, on a case-by-case basis, could give rise to serious and specific concerns relating to the quality  and safety of the care.

If you wish to receive more detailed information on which particular treatment requires prior authorisation, you are advised to contact your statutory health insurance service or National Contact Point  at home for more information. You may have additional rights for cross-border healthcare pursuant to your national legislation or bilateral social security agreements.

NOTE: When required, never receive treatment abroad without the prior authorisation of your statutory health insurance service. If you have received treatment abroad without the required prior authorisation from your statutory health insurance service, possibility exists that your claims for reimbursement will be declined. As a result, you may have to bear all medical costs incurred abroad yourself.

When you wish to receive treatment under the Social Security Regulations (EC) 883/2004 and 987/2009, the requirement of a referral will depend on whether or not a system of referral is in place in the country of treatment. When this is indeed the case, referral from a GP in the country of treatment may be needed in order to be able to access specialised healthcare in the country concerned.

When you, however, seek treatment abroad under Directive 2011/24/EU, the requirement of a referral will depend on whether or not a system of referral for accessing specialised treatment is in place in your home country. When such referral is not required to access healthcare in your home country it will also not be required to obtain a referral from your GP before accessing specialised treatment abroad.

Contact your statutory health insurance service and National Contact Point at home for more information. The National Contact Point of the country where you wish to receive treatment can provide you with more information on whether or not a system of referral is in place in that country.

The healthcare provider or hospital in the country where you wish to seek treatment can provide you with information on how long you will have to wait before receiving treatment and on any possible waiting lists that need to be respected.

Healthcare providers or hospitals can only restrict the admission of foreign patients where it is justified by overriding reasons of general interest, such as planning requirements relating to the aim of ensuring sufficient and permanent access to high-quality treatment for domestic patients within its territory. Such measure may for example prove necessary when the number of foreign patients appears to be so high that local hospitals become overwhelmed with too many patients and cannot cope with the demand, resulting in unsustainable waiting lists for domestic patients.

Any restrictions on the admission of foreign patients must be made publicly available in advance. Contact the National Contact Point of the country where you wish to receive treatment for more information on any possible restrictions to access healthcare abroad.

When treatment is provided in another language, make sure that you inform yourself on whether or not you will need to arrange for interpretation yourself during your contact with the treating healthcare provider(s) and other medical staff abroad.

If you wish to obtain information on healthcare providers and on how to contact them, the National Contact Point of the country where you wish to receive treatment will be able to provide you with more information.

Searching for a healthcare provider in Greece? You may click here.

Additional useful information on contacting or locating health providers per region is available here.

If you seek information on a specific healthcare provider, you should first directly contact the healthcare provider you wish to receive treatment from. They are obliged to provide you with the following information:
• the healthcare provider’s authorisation and registration status, that is proof of their license to practice medicine;
• the healthcare provider’s insurance cover for professional liability;
• the healthcare provider’s entitlement to provide health services covered under the social security scheme. 

This information can also be provided by the statutory health insurance service or the National Contact Point of the country where you wish to receive treatment.

The healthcare provider or hospital as well as the National Contact Point in the country where you wish to seek treatment can provide you with information on the accessibility of the hospital for patients with disabilities.

Under EU legislation, your costs incurred for medical treatment abroad may be assumed by your statutory health insurance service back home under two different schemes: the Social Security Regulations (EC) 883/2004 & 987/2009 and Directive 2011/24/EU.

• Under the Social Security Regulations (EC) 883/2004 & 987/2009 your costs will be assumed according to the amount envisaged in the rules and legislation of the country of treatment.
• Under Directive 2011/24/EU your costs will be assumed according to the amount envisaged in the rules and legislation of your home country.

Please note that the range of covered healthcare services, the conditions to access medical treatment as well as the financial implications will differ depending under which scheme you will enjoy treatment abroad.

As social security remains within the own competence of Member States, you may also be entitled to assumption of costs of cross-border healthcare derived from purely national legislation, as for example under national healthcare projects for border regions.

Inform yourself on all your different options with regard to accessing healthcare abroad with your statutory health insurance service.

More information on cost reimbursement for cross-border healthcare is available here.

Whether the costs of the treatment will be directly assumed by your statutory health insurance service (third-party payment) or whether you will have to pay all costs upfront yourself and ask for reimbursement afterwards, depends on whether you have received treatment abroad under the Social Security Regulations (EC) 883/2004 &987/2009 (S2 form) or under Directive 2011/24/EU.

Under the Social Security Regulations the payment method will depend on the system in place in the country of treatment. As you are treated as though you were insured under the social security system of the country of treatment, you will enjoy the same rights and entitlements regarding the method of payment as a domestic patient with public health insurance.

Two possibilities may occur:

• The treatment you need is free of charge (which may often be the case), sometimes combined with an amount of co-payment, in which case the costs will be directly settled between the healthcare provider and the social security authority of the country of treatment. The foreign authority will then automatically liaise with your own statutory health insurance service at home to obtain refund, without you having to do anything more.
• You have to pay all costs of the treatment yourself and have to file for reimbursement afterwards, either with the local social security authority while still being abroad, or with your own statutory health insurance service upon return home. Either way the reimbursement tariff of the country of treatment will apply.

Under Directive 2011/24/EU you will always have to initially bear all costs of the treatment yourself. You pay all invoices directly to the healthcare provider/hospital abroad. Upon your return home, you may file for reimbursement with your statutory health insurance service. The latter will apply the same tariffs of reimbursement as for domestic treatment provided in your home country.

When you enjoy treatment abroad under the Social Security Regulations (EC) 883/2004 & 987/2009 and you have to make an upfront payment, you are advised to file for reimbursement with your own statutory health insurance service upon return home.The reimbursement tariff of the country of treatment will apply.

Under Directive 2011/24/EU you always have to make an upfront payment. You are entitled to file for reimbursement with your own statutory health insurance service upon your return home. In this case the reimbursement tariff of your home country will apply.

Under Social Security Regulations 883/2004 & 987/2009 travel and accomodation expenses are not covered. However, there may be relevant provisions by national legistation or bilateral Social Security agreements. Make sure you contact the National Contact Point of your home country for further information.

Under Directive 2011/24/EU it is for the member state to decide to reimburse, or not, the accommodation and travel costs or the extra costs which persons with disabilities might incur due to one or more disabilities when receiving cross-border healthcare. In Greece, relevant costs are not reimbursed, in general. Only relevant claims of patients with disabilities seeking prior authorization are evaluated on a case-by-case basis.

As cross-border healthcare is provided in accordance with the legislation of the country of treatment, also the quality and safety standards of this country will apply. For more information on the quality and safety standards that are in place, you may contact directly the healthcare provider or the National Contact Point of the country of treatment.

The National Contact Point of the country of treatment can provide you with information on a specific healthcare provider’s right to practice medicine or any possible restrictions to this right.

If you wish information on healthcare providers who provide treatment regarding a specific chronic or rare disease, a local patient organisation may provide you with more information on a specific healthcare provider’s reputation. The National Contact Point of the country of treatment can inform you on the different patient organisations located in its country.

A prescription for medicine or medical devices prescribed in your country is valid in any EU/EEA country.

However, to ensure that your prescription is recognised and well-understood by the pharmacist abroad, inform your prescribing healthcare provider on planning to use the prescription abroad. They will prescribe the medication or medical devices according to the minimum information requirements for cross-border prescriptions (Implementing Directive 2012/52/EU) :

• Identification of the patient: surname(s); first name(s); date of birth;
• Authentication of the prescription: issue date;
• Identification of the prescribing healthcare provider: surname(s); first name(s); professional qualification; details for direct contact, such as email and telephone or fax; work address, including the name of the relevant Member State; written or digital signature;
• Identification of the prescribed product: common name (active substance), or in exceptional cases name; pharmaceutical formulation (tablet, solution, etc.); quantity; strength; dosage regime.

Please note that the medicine concerned may not be available or authorised for sale in the country abroad. If possible, always try to buy your prescription medicines in a pharmacy in the country where the prescription is issued.

A prescription issued in another EU/EEA country must be recognised by any pharmacy in your home country. This way proper follow-up and continuity of care upon your return home can be ensured.

However, to ensure that the prescription is recognised and well-understood by your pharmacist back home, inform your prescribing healthcare provider on planning to use the prescription in your home country. They will prescribe the medication or medical devices according to the minimum information requirements for cross-border prescriptions (Implementing Directive 2012/52/EU) :

• Identification of the patient: surname(s); first name(s); date of birth                                                                                         
• Authentication of the prescription: Issue date
• Identification of the prescribing healthcare provider: surname(s); first name(s); professional qualification; details for direct contact, such as email and telephone or fax; work address, including the name of the relevant Member State; written or digital signature
• Identification of the prescribed product: common name (active substance), or in exceptional cases name; pharmaceutical formulation (tablet,  solution, etc.); quantity; strength; dosage regime

Please note that the medicine concerned may not be available or authorised for sale in your home country. If possible always try to buy your prescription medicines in a pharmacy in the country where the prescription is issued.

In order to ensure continuity of care upon your return home, you are entitled to a written or electronic medical record of your treatment or medical intervention. The treating healthcare provider abroad should document data, assessments and information of any kind on your medical situation and clinical development throughout the process of care, such as information on diagnosis, examination results, treatment outcome, a list of administered medicines, post-operative results,…

Directive 2011/24/EU provides every patient in cross-border healthcare the right to at least one copy of their medical record. More specifically, you have the right to a copy of your medical records containing such information as diagnosis, examination results, assessments by treating healthcare providers and information on any treatment or interventions provided.

Transfer of your medical records to your treating healthcare provider at home may be important to ensure continuity of care and suitable follow-up treatment.

In case you disagree with the proposed treatment, you are by no means entitled to go through with it. The healthcare provider is obliged to obtain your informed consent before starting any treatment or medical intervention. You are entitled to change your mind and stop treatment at any time.

Nevertheless, it remains within the competence of the healthcare provider to decide which treatment is the most suitable based on medical grounds. You are not entitled to enforce any possible treatment you may desire. The healthcare provider must inform you on the treatment he or she proposes as well as on possible treatment alternatives.

Whether you agree with the treatment proposed or choose alternative treatment, your consent is needed for any medical act and for every step of the medical procedure. Ultimately, you choose yourself to agree or continue with treatment or medical intervention.

The national legislation of the state of treatment on complaints procedures and mechanisms in place for patients to seek remedies applies in case you suffer any harm as a result of the healthcare you receive.

You can also ask the healthcare provider for information on their insurance cover or other means of personal or collective protection with regard to professional liability.

In the unfortunate event that you find yourself in need of further relevant information, you are advised to contact the national contact point for cross-border healthcare of the state of treatment.

In Greece, patients who suffer harm from healthcare provided, may address the provider responsible or the provider’s professional association.  Public  hospitals have offices commissioned  with the protection of patients’ rights which shall provide information and mediate in case of complaints. The Ministry of Health has set up a supervisory authority, the independent Unit for the Protection of Patients’ Rights  which shall provide information to patients seeking remedies about the course of action on investigating, mediating or settlement while the patients reserve the right to judicial protection. The Unit for the Protection of Patients’ rights may be contacted at: rights@moh.gov.gr.

Directive 2011/24/EU obliges each EU/EEA country to ensure that a system of professional liability insurance or a guarantee or similar arrangement is in place for treatment provided on its territory.

The healthcare provider is obliged to provide you with information on his or her insurance cover for professional liability.

The consent of the patient (data subject) is simply one of the legal bases on which personal data can be processed and, as a rule, it does not have to be obtained in the healthcare sector.

In fact, the most appropriate (specific) legal bases on which the data of data subjects (usually, but not exclusively, patients) are processed are: (a) the provision of medical services in accordance with Article 9(2)(h) of the GDPR, regardless of whether the provision of such medical services is based specifically on provisions of law governing the provision of healthcare services by public-sector operators or on a contract for the provision of medical services by a private-sector operator; and (b) for reasons of public interest in the area of public health in accordance with Article 9(2)(i) of the GDPR, rather than based on the consent of the data subject (especially the patient).

The consent of the data subject is a necessary legal basis for the lawful processing of personal data in the healthcare sector only where it is expressly required under a provision of law, e.g. in order to participate in scientific research activities in clinical trials (see recital 161 of the GDPR). Where the consent of the data subject is expressly required in order to process sensitive personal data, it must also be given in writing.

What this means is that, if a data subject is required to sign a form notifying them that their personal data are to be processed, that signature means that they have ‘been informed’, i.e. they have been given the information required by law for the purpose of proper notification, not that they consent to the processing of their personal data, as it is the provision of medical services in accordance with Article 9(2)(h) of the GDPR that is the primary legal basis on which the personal data are processed.

Therefore, it is prohibited to refuse to provide healthcare services on the grounds that the data subject refused to consent to the processing of their personal data, as it is the provision of medical services in accordance with Article 9(2)(h) of the GDPR that is the primary legal basis on which the personal data are processed.

As a personal data subject, every patient is entitled to access their medical records and to take copies of it and, conversely, the healthcare service provider, as the controller, is obliged to satisfy that right in accordance with the provisions of Article 15 of the GDPR.

A patient who receives copies of their medical records has clearly exercised the right of access of the data subject in accordance with Article 15 of the GDPR (see also Article 14(8) of Law 3418/2005, ‘the Code of Medical Conduct’). See above on the right of access of the data subject.

First, the provisions of Article 14(4) of Law 3418/2005 (‘the Code of Medical Conduct’) apply: ‘4. The obligation to preserve medical files applies: a) to private surgeries and other private-sector primary healthcare units: for a period of 10 years from the patient’s last visit; and b) in all other cases: for a period of 20 years from the patient’s last visit’.

Therefore, as stated above, the data subject’s ‘right to be forgotten’ and right to erasure of data, as set out in the provisions of Article 17 of the GDPR do not apply to the processing of data in the healthcare sector (see paragraph 3 of that article).

The transfer of data to a third party by a healthcare service provider in its capacity as controller constitutes the processing of sensitive personal data relating in particular to the health of the data subject within the meaning of Articles 4 and 9(2) of the GDPR. Therefore, in order to be lawful, all the following conditions must be met first (as for any other processing of personal data): (a) there must be a lawful, specified and clear purpose to the processing; (b) at least one of the legal bases listed in Article 9(2) of the GDPR for the special categories of personal data (sensitive data) must apply; and (c) steps must be taken to ensure compliance with all the fundamental principles governing the processing of any personal data. Furthermore, the healthcare service provider, in its capacity as controller, must notify the data subject of the intended transfer and allow sufficient time for any objections to the transfer to be raised.

There are at least two legal bases for this type of processing (transfer) in Article 9(2) of the GDPR: (1) processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent (Article 9(2)(c) of the GDPR); and (2) processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity (Article 9(2)(f) of the GDPR).

Of course, provided the patient who is unable to collect the results of their examinations in person (e.g. due to illness) has duly authorised a relative to collect them on their behalf, the patient’s duly authorised relative is equivalent to the data subject and exercises the right of access on their behalf in accordance with Article 15 of the GDPR.

The transfer of data to a third party by a healthcare service provider in its capacity as controller constitutes the processing of sensitive personal data relating in particular to the health of the data subject within the meaning of Articles 4 and 9(2) of the GDPR. Therefore, in order to be lawful, all the following conditions must be met first (as for any other processing of personal data): (a) there must be a lawful, specified and clear purpose to the processing; (b) at least one of the legal bases listed in Article 9(2) of the GDPR for the special categories of personal data (sensitive data) must apply; and (c) steps must be taken to ensure compliance with all the fundamental principles governing the processing of any personal data.

Furthermore, the healthcare service provider, in its capacity as controller, must notify the data subject of the intended transfer and allow sufficient time for any objections to the transfer to be raised.

The Hellenic Data Protection Authority has repeatedly found that orders granted by public prosecutors are not binding on healthcare service providers in their capacity as controller for the purposes of transfer. As the controller, the healthcare service provider must always check that transfer to the requesting third party meets the above-mentioned requirements and is therefore lawful. If it identifies any reason why the personal data requested should not be transferred to the requesting third party, it must reject its request, stating its reasons, and notify that decision to the public prosecutor who granted the order.

Anyone duly authorised by the data subject is equivalent to the data subject and is entitled to exercise the right of access in accordance with Article 15 of the GDPR on the data subject’s behalf.

The explanations above apply also to the data subject’s lawyer with power of attorney, provided that the lawyer has been duly authorised by the data subject in a letter of attorney or written authorisation on which the data subject’s signature has been witnessed by a public authority. However, personal data (especially sensitive data) relating to the data subject cannot be given to a lawyer on the basis of the lawyer’s simple assurance that he has been given a lawful verbal instruction by the data subject in accordance with the relevant provisions of Law 4194/2013 (‘the Lawyers’ Code’).

No, information on a patient’s state of health should never be given over the telephone due to the risks which that harbours, especially for the patient, but also for the healthcare provider in its capacity as controller, primarily for the following reasons.

First, the rule set out in Article 12(1) of the GDPR is that information must be provided in writing, or by other means, including, where appropriate, by electronic means. Consequently, the rule is that information is provided to the data subject in writing, especially information regarded as sensitive personal data. Where sensitive data relating to the data subject are sent by electronic means (email), the data subject must have consented in advance in writing and the sensitive data in question must be sent in an encrypted format (and the decryption key must be sent separately).

Article 12(1) of the GDPR also states: ‘When requested by the data subject, the information may be provided orally, provided that the identity of the data subject is proven by other means’. The following requirements must be fulfilled in order to apply that provision: (1) the data subject must have requested in writing that information concerning them is to be provided to them orally and over the telephone; (2) the identity of the data subject must be established during the telephone conversation; and (3) it must be possible to prove (for the purposes of accountability) that the healthcare service provider did indeed inform the data subject fully and in due form. Obviously, it is hard to fulfil these last two requirements.

Therefore, information on a patient’s state of health should never be provided to the patient over the telephone which is all the more reason why information on the treatment or state of health of a patient should never be provided to a third party over the telephone.

(1) Where the patient has an insurance policy, the rule is that the patient exercises their right of access to obtain their key medical data from the healthcare service provider in its capacity as controller and then passes them to the insurance company for the purpose of the contract between them.

(2) The transfer of data to an insurance company (third party) by a healthcare service provider in its capacity as controller constitutes the processing of sensitive personal data relating in particular to the health of the data subject within the meaning of Articles 4 and 9(2) of the GDPR. Therefore, in order to be lawful, all the following conditions must be met first (as for any other processing of personal data): (a) there must a lawful, specified and clear purpose to the processing; (b) at least one of the legal bases listed in Article 9(2) of the GDPR for the special categories of personal data (sensitive data) must apply; and (c) steps must be taken to ensure compliance with all the fundamental principles governing the processing of any personal data. The usual legal basis for the transfer of sensitive personal data relating in particular to the health of the data subject to an insurance company (third party) by a healthcare service provider in its capacity as controller is Article 9(2)(f) of the GDPR: ‘processing [is] necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity’ (e.g. where the insurance company is in dispute with the patient insured with it and cites a particular legitimate interest for the transfer of the patient’s key data).

In order for transfer by a healthcare service provider in its capacity as controller to an insurance company (third party) to be lawful, the patient concerned (data subject) must be notified in advance and must be allowed sufficient time to raise any objections to the transfer.

(3) The patient may grant specific, express (written) and freely given authorisation to the healthcare service provider, in its capacity as controller, to transfer sensitive personal data relating in particular to the patient’s health to the insurance company, in which case the legal basis for the transfer of those sensitive data to the insurance company is consent given by the data subject (patient) in accordance with Article 9(2)(a) of the GDPR: ‘the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject’.

The patient may also grant the insurance company specific, express (written) and freely given authorisation to take receipt on the patient’s behalf of sensitive personal data relating in particular to their health from the healthcare service provider in its capacity as controller, in which case the legal basis for the receipt of those sensitive data by the insurance company on behalf of the patient is consent given by the data subject (patient) in accordance with Article 9(2)(a), read in combination with the provisions of Article 15 of the GDPR.

The terms and conditions of the data subject’s consent must also be complied with in such cases in accordance with Article 4(11) of the GDPR: ‘consent’ of the data subject means any freely given, specific, informed and unambiguous indicationof the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

A clause in an insurance policy allowing the insurance company (what would in fact be ‘carte blanche’) to collect sensitive data relating to the data subject (insured with it) from any hospital at any time for the purpose of processing the data subject’s claim does not qualify as specific, unambiguous (written), freely given consent by the data subject as defined above. An insurance company cannot cite any such clause to substantiate lawful collection by it of key sensitive data relating to the data subject based on the data subject’s consent, meaning that the data may only be transferred to the insurance company in accordance with (1) and (2) above.

If necessary, a hospital can, in its capacity as controller, send a patient’s medical examinations and results to other hospitals for a second opinion, provided that one of the legal bases listed in Article 9(2) of the GDPR can substantiate such processing (transfer). If processing is necessary for the specific purposes of preventive or occupational medicine or medical diagnosis, transfer may be substantiated on the basis of the provision of Article 9(2)(h) of the GDPR that is the primary legal basis on which the personal data are processed. In all cases, the first hospital, in its capacity as controller, must notify the patient in advance of the recipients of the data.

In terms of the method of transfer, all appropriate steps must be taken to comply with the principle of data integrity and confidentiality and to ensure that the data are processed in a manner that ensures security and confidentiality. If the data are transferred electronically, they must be pseudonymised and encrypted.

If the data are transferred using a courier service, similar steps must again be taken and, additionally, the courier company must not be able to access the patient’s data.

Conforming Directive 2011/24/EU, each Member State has established one or more National Contact Points for Cross-border Healthcare (NCPs). Member States are free to decide how to organise these NCPs. Some NCPs are aligned with the statutory health insurance service or the Ministry of Health, whereas other are independent bodies.

The main task of NCPs is to provide patients with clear and accessible information on all aspects of accessing medical treatment abroad. NCPs will provide patients with information on different topics depending on whether the patient is a domestic patient wanted to access healthcare abroad (outgoing patient) or a foreign patient wanted to access healthcare in the country concerned (incoming patient).

All NCPs have a designated website where the essential information on medical treatment abroad (cross-border healthcare) is provided. Besides, patients can consult NCPs directly for more information or personal inquiries about accessing healthcare abroad, such as through telephone, email or an online contact form. Many NCPs also serve patients in person at the NCP office. 

The contact details of National Contact Points of EU/EEA member states are available here.