Medical data privacy in Hungary: what the law says

What the law says

How Hungary treats your health data.

The law: GDPR, with the Info Act (Act CXII of 2011) and the Health Data Act (Act XLVII of 1997)[S76][S114][S115]
The regulator: National Authority for Data Protection and Freedom of Information (NAIH)[S114]
Health data: Health data is a special category under Article 9 of the GDPR. It may be processed only on a listed ground, such as your explicit consent or care by health professionals bound by secrecy.[S76]
Sending it abroad: Data moves freely within the European Economic Area. Leaving it needs an adequacy decision for the destination or other safeguards (GDPR Chapter V).[S76]
Medical records: Medical records are kept for at least 30 years.[S115]
EU adequacy: Not needed: as an EU member, the GDPR applies directly.[S76]
If there is a breach: Within 72 hours to the national authority where feasible, and to the people affected without undue delay when the risk to them is high (Articles 33 and 34).[S76]
Fines: Up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher (Article 83).[S76]

Sending your records

The law protects the clinic’s copy. How it gets there is up to you.

Email and messaging apps leave a readable copy on every server they pass through, in Hungary and at home. The safest file is the one that stays encrypted on your own phone, shown to the doctor in the room or sent by a link that expires by itself.

Try the free privacy check

Questions

Hungary: common questions.

Is it safe to email medical records to a clinic in Hungary?

Email is protected between mail servers only when both providers support TLS, and it stays readable on each server afterwards. Once your records reach a clinic in Hungary, local law applies: health data is a special category under Article 9 of the GDPR. It may be processed only on a listed ground, such as your explicit consent or care by health professionals bound by secrecy. For a full history, use a channel where you hold the key, such as a link that expires by itself.

How does Hungary protect health data?

Health data is a special category under Article 9 of the GDPR. It may be processed only on a listed ground, such as your explicit consent or care by health professionals bound by secrecy. Breaches must be reported within 72 hours to the national authority where feasible, and to the people affected without undue delay when the risk to them is high (Articles 33 and 34). The regulator is the National Authority for Data Protection and Freedom of Information (NAIH).

Can a clinic in Hungary send my medical records abroad?

Data moves freely within the European Economic Area. Leaving it needs an adequacy decision for the destination or other safeguards (GDPR Chapter V). Medical records are kept for at least 30 years.

Keep reading

More on Hungary, and elsewhere.

Sources are numbered in the text and listed in full in the reference list.

Medical data privacy in Hungary.