1. Medical workers have an obligation to keep the facts secret concerning the state of health of sick persons, the method of infection and other circumstances. This obligation can be found in the Public Health Act and the Act of the Professional Organizations of Physicians and Dentists.The Code of Professional Ethics also contains the obligation of medical secrecy.
   The object of the obligation to keep secret are facts and circumstances which are of interest to the patient or his/her relatives not to be made public. The physician is obliged not to disclose confidential information concerning a patient which he learns in the process of the diagnosis and the treatment. Also facts that have immediate connection with the health of the patient should be kept secret if this is of interest for the patient. The patient and his/her relatives can specify what these facts and circumstances can be. For that reason there is a breaking of medical secrecy if the medical workers make certain information public, although they were expressly notified by the patient or his/her relatives that they must not make public facts and circumstances concerning the patient. The notification can be oral or written. But it must be clearly and plainly expressed.
   The physician’s medical secrecy covers data and circumstances known to the patient as well as facts which he does not know about – for instance, when the physician knows the results of the examination of the patient but has not yet informed him/her of them yet.
2. The cases where medical information of a patient may be provided to third parties are explicitly enumerated in article 28 of the Health Act.
3. The right to privacy is expressly protected by the Bulgarian Constitution. According to article 32 (1) the privacy of citizens is inviolable. Everyone is entitled to protection against any illegal interference in his/her private or family affairs and against encroachments on his/her honor, dignity, and reputation.The Code of Professional Ethics expressly provides that the physician recognizes and protects the rights of patients as they are declared in the Declaration of the World Medical Association and is obligated to respect human dignity.
4. In principle according to article 5 (1), 3 of the Personal Data Protection Act, it is forbidden to process personal data which refer to health. This prohibition does not apply where the individual to whom such data relates, has given his or her consent to the processing of such data, except where otherwise provided by a special law. Another exception to this rule occurs when processing is necessary to protect the life and health of the individual to whom such data relate, or of another person, and the physical condition of such individual renders him/her incapable of giving his or her consent, or there are legal impediments to doing so.
   A last exception is the case when the processing of data is required for the purposes of preventive medicine, medical diagnostics, the provision or management of health-care services provided that such data are processed by a medical professional who is bound by law to professional secrecy, or by another person under a similar obligation of secrecy.
   In relation to health data, the personal data commissioner must file an application for registration, according to article 17 (1) of the Personal Data Protection Act.
5. According to article 26 of the Personal Data Protection Act “any individual shall be entitled to access to personal data related to him or her. In cases when the right of access granted to an individual may lead to disclosure of personal data of third parties as well, administrators shall provide the relevant individual with access to that part of the data that relates to himself or herself”.
   Except where prohibited by law, the individual concerned may request a copy of the processed personal data to be provided on a preferred medium or by electronic means.
6. According to article 28a of the Personal Data Protection Act “an individual shall be entitled to require, at any time, from the personal data administrator:
   1. to remove, rectify or block his or her personal data the processing of which does not comply with the provisions of this Act;
   2. notify any third parties to whom his or her personal data have been disclosed of any removal, rectification, or blocking carried out in compliance with paragraph (1), unless this is impossible or involves a disproportionate effort.”

Top