TEHIK sent police health data without sufficient legal basis

The Centre for Health and Welfare Information Systems (TEHIK) sent Estonia’s Police and Border Guard Board (PPA) a person’s ambulance record without sufficient legal basis in one case, ERR reported. TEHIK apologised and said it would carry out further internal checks.

TEHIK director Margus Arm called the disclosure an isolated human error and said people’s health data remained protected. The centre will notify the person whose record was released and plans to involve a representative of the Ministry of Social Affairs’ internal audit team in its review.

The case came to light during a review of requests for health data made by the PPA and the Estonian Internal Security Service (Kapo) in supervisory proceedings. From January 1, 2025, to October 14, 2026, TEHIK provided health data to the PPA in response to 760 requests. Only one request related to a supervisory proceeding. TEHIK provided no data to Kapo for supervisory purposes during that period.

The ambulance record was sent to the PPA in September 2025. Police had requested it to assess whether a person who had been under the influence of drugs might face legal restrictions on holding a firearms licence. In a subsequent review, both TEHIK and the PPA concluded that the relevant legal provision did not allow the person’s health data to be disclosed without their consent.

Liis Valk, head of the PPA’s Identity and Status Bureau, said the request was not covered by the police’s own internal review because it had been made earlier. She said that, during a follow-up check of a firearms licence, the officer should instead have contacted a healthcare provider and asked a doctor to assess whether there were grounds to prevent the person from holding a licence.

Valk said police may ask a healthcare provider for an assessment when warning signs emerge during the validity of a firearms licence. She said that after the Lihula tragedy, in which the shooter had a valid licence despite serious mental health problems and taking strong medication, police began more systematic follow-up checks of firearms owners. When incidents involving drugs or calls suggesting mental health problems arise, police may seek a new medical assessment in addition to checking a valid health certificate.

Current law allows health data to be disclosed from the health information system without a person’s consent in proceedings concerning an offence or in court proceedings to establish the truth. A supervisory proceeding alone does not provide that authority. A government bill currently before parliament would allow police to collect and use a person’s health data with their consent in criminal proceedings.

Tags: Estonia, health data, police