
The Law on Amending the Law on Social Insurances and General Health Insurance and Certain Other Laws “(Law)” was published in the Official Gazette on January 15, 2025 and entered into force on the date of publication. Article 2 of the Law introduces “Authority for Information Collection, Processing, and Sharing” as Additional Article 19 to the Fundamental Law on Health Services numbered 3359, while Article 6 amends certain provisions of the Law on the Social Security Institution numbered 5502.
These regulations bring significant changes regarding the processing of health data of individuals receiving healthcare services and personal data processed by the Social Security Institution “(SSI)”.
Fundamental Law on Health Services: "Authority for Information Collection, Processing, and Sharing"
Article 2 of the Law introduces Additional Article 19, titled “Authority for Information Collection, Processing, and Sharing,” to the Fundamental Law on Health Services numbered 3359.
Under this provision, personal health data provided by individuals seeking healthcare services at public or private health institutions may be processed under specific conditions. The Ministry of Health may use this data for purposes such as planning healthcare services, cost calculation, medical diagnosis, treatment, and preventive medicine. However, this data may only be shared with third parties in accordance with the rules outlined in the Personal Data Protection Law “(PDPL)”.
The key points of the new regulation are as follows:
Authority for Data Collection and Processing: Personal data of individuals seeking healthcare services can be processed only for the effective delivery of these services. Necessary security measures will be taken in compliance with PDPD.
Data Sharing and Access: The Ministry of Health will use personal health data in delivering healthcare services and establish a system enabling individuals or their authorized third parties to access this data. Specific monitoring mechanisms will be implemented to ensure access and data security.
Data Security Standards: The Ministry will take necessary precautions to ensure the security of collected data. The systems used in this process must comply with the standards set by the Personal Data Protection Authority.
Notification of Healthcare Personnel: Public and private healthcare institutions are required to report information regarding their healthcare personnel to the Ministry of Health.
Regulatory Provisions: The Ministry of Health will issue a regulation detailing the processing and security of personal health data. This regulation aims to manage all processes related to health data processing transparently and securely.
The justification of this provision emphasizes compliance with the personal data protection principle in Article 20 of the Constitution, ensuring that the Ministry of Health acts as the data controller during the processing of personal health data. The amendment addresses the legal void arising from the annulment of Article 378 of the Presidential Decree on the Presidential Organization No. 1 by the Constitutional Court on October 26, 2023 (E. 2018/118, K. 2023/180). The purpose of the change is to provide a legal basis for the secure collection, processing, and sharing of personal health data, increasing the effectiveness and transparency of healthcare services.
SSI and Personal Data Sharing: New Regulations and Legal Developments
Article 6 of the Law amends certain phrases in the sixth paragraph of Article 35 of the Law on the Social Security Institution numbered 5502. These changes bring significant updates on how personal data is shared between SGK and other institutions.
Previously, the amendment to Article 35 of Law No. 5502 prohibited the sharing of personal data processed by SGK and data classified as trade secrets with real or legal persons without the notarized consent of the data owner or their consent verified through the e-Government system. However, the Constitutional Court, in its decision dated December 7, 2023 (E. 2018/117, K. 2023/212), ruled certain provisions of this regulation unconstitutional, deciding that the annulment would take effect on June 4, 2025. The amendment introduced by Article 6 aims to fill the legal gap created by the annulment and address issues arising from the inability to share data without a legal basis.
In this context, the purpose of the change introduced by the law is to establish a stronger legal framework for the protection of personal data by determining the duties of SSI through laws and Presidential decrees. It is emphasized that, in accordance with the provisions in our Constitution, a legal basis for the processing of personal data must be provided under the law.
Additionally, the regulation resolves deficiencies in data sharing between SSI and social insurance funds established under Law No. 506. Removing obstacles to data sharing between SSI and these funds will expedite processes and prevent erroneous payments.
These legal changes aim to create a faster and more reliable process in the social security system while implementing necessary precautions to safeguard personal data.
Conclusion
The amendments introduced by the Law will enable more secure processing of personal health data and enhance the planning of healthcare services. These changes should be closely monitored by all stakeholders in the healthcare sector, and necessary precautions should be taken during implementation.