This week E-Health Europe reports on what may prove a landmark ruling by the European Court of Human Rights with potentially far-reaching implications for the development of electronic patient records, data security and privacy. The judgment is important because it links security of personal data to the human rights framework.

The court fined the Finnish government for failing to adequately secure and protect a patients confidentiality. The ruling, based on Article 8 of the European Convention on Human Rights, says the confidentiality of medical records is a vital component of a private life, explicitly linking data security and human rights. As a result, the case has significance for all countries that have signed the European Convention on Human Rights.

At a minimum, the case looks certain to require authorities to look again at whether their electronic patient record access and security mechanisms are robust enough to prevent the possibility of unauthorised data access occurring. The ruling makes clear that retrospectively auditing and tracking unwarranted or unauthorised access is not sufficient.

But the greatest significance is likely to be the explicit link created between personal data security and European Human Rights law. Although this will undoubtedly create formidable technical challenges for all involved in e-health it may prove a vital step in providing far greater public clarity and confidence in the handling of confidential electronic data.