Medical record and LGPD art. 11

Short answer

Under Brazil’s LGPD (Law No. 13,709/2018), processing personal data in medical records requires a valid legal basis under Article 11—most commonly consent (Art. 7) or the necessity for healthcare provision (Art. 11, §2, III). The Federal Council of Medicine (CFM) reinforces this via Resolution No. 2.295/2021, mandating strict confidentiality, purpose limitation, and data minimization in clinical documentation.

TL;DR

• LGPD Art. 11 lists 10 lawful bases for processing sensitive personal data—including health data—where consent is not always required.
• For medical records, Art. 11, §2, III permits processing “for the prevention, diagnosis, or treatment of diseases, including by health professionals or entities bound by professional secrecy.”
• CFM Resolution No. 2.295/2021 (effective 2021) explicitly aligns physician obligations with LGPD, requiring documented justification for each processing activity involving patient data.
• Consent remains mandatory for non-clinical uses of health data (e.g., marketing, research without ethics approval, or third-party sharing beyond care coordination).
• Electronic medical records (EMRs) must implement technical safeguards per LGPD Art. 46–48—and CFM mandates audit trails and access logs (Res. 2.295/2021, Art. 12).
• Breaches involving medical records trigger mandatory notification to ANPD and affected data subjects within 72 hours (LGPD Art. 48).

Quando o tratamento de prontuário médico dispensa consentimento sob a LGPD?

Article 11, §2, III of the LGPD expressly exempts consent when processing health data is necessary for “prevention, diagnosis, or treatment of diseases,” provided it is carried out by qualified health professionals or entities subject to professional secrecy. This covers routine clinical documentation, referrals, lab result sharing among care teams, and telehealth consultations—so long as processing is strictly limited to the therapeutic purpose. Consent is not waived for secondary uses: anonymized research requires ethics committee approval (CNS Resolution 510/2016); insurance disclosures require separate authorization; and commercial reuse (e.g., AI training on identifiable records) remains prohibited without explicit, informed, revocable consent.

Quem é responsável pelo tratamento em prontuários médicos?

Both the physician (as controller) and healthcare institutions (as joint controllers or processors) bear responsibility. Under LGPD Art. 42, the controller determines purposes and means of processing—typically the attending physician or clinic owner. CFM Resolution 2.295/2021 (Art. 5) confirms physicians’ direct accountability for data integrity, accuracy, and retention periods. When EMR systems are outsourced, the vendor acts as processor and must sign a data processing agreement (DPA) compliant with LGPD Art. 37.

Quais são as obrigações específicas do CFM?

CFM does not enforce the LGPD—but its resolutions interpret professional conduct in light of it. Resolution 2.295/2021 binds all registered physicians, requiring: (i) clear privacy notices at first contact; (ii) secure digital storage meeting ISO/IEC 27001 or equivalent standards; (iii) prohibition of storing patient data on personal devices; and (iv) mandatory staff training on LGPD and confidentiality every 24 months (Art. 15). Violations may trigger CFM disciplinary proceedings in addition to ANPD sanctions.

FAQ

• Q: Does LGPD Art. 11 replace medical confidentiality duties under the Medical Ethics Code?
• A: No—LGPD complements them. CFM’s Code of Medical Ethics (Art. 107) and Resolution 2.295/2021 maintain stricter, profession-specific confidentiality rules that remain fully in force alongside LGPD obligations.

• Q: Can a hospital process medical records for internal quality improvement without consent?
• A: Yes—if data is anonymized and processing is necessary for clinical governance, per LGPD Art. 11, §2, III + CFM Art. 12. Pseudonymized or identifiable data still requires documented legal basis and DPIA.

• Q: Is verbal consent sufficient for medical record processing?
• A: No. LGPD Art. 8 requires consent to be “free, informed, and unambiguous.” CFM Resolution 2.295/2021 (Art. 7) mandates written or electronic records of consent—including scope, duration, and withdrawal mechanism.

• Q: What happens if a patient revokes consent for data processing?
• A: Revocation applies only to consent-based processing (e.g., research participation). Core clinical documentation continues under Art. 11, §2, III—no revocation possible for treatment-related processing, per LGPD Art. 8, §5.

Key facts

• LGPD Art. 11, §2, III is the primary legal basis for processing health data without consent in clinical contexts.
• CFM Resolution No. 2.295/2021 entered into force on 1 March 2021 and is binding on all licensed physicians in Brazil.
• ANPD’s Normative Decision No. 01/2022 defines “health data” as any information related to physical or mental health, including genetic and biometric data.
• Medical records must be retained for minimum periods: 20 years for adults, 30 years after minority ends (CFM Res. 2.295/2021, Art. 13), exceeding LGPD’s general accountability requirements.

Sources

• Lei Geral de Proteção de Dados Pessoais (LGPD), Lei No. 13.709/2018 — https://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/L13709.htm
• Conselho Federal de Medicina (CFM), Resolução No. 2.295/2021 — https://cdn.cfm.org.br/Resolucoes/2021/RESOLUCAO-CFM-2295-2021.pdf
• ANPD, Normative Decision No. 01/2022 (Definition of Sensitive Data) — https://www.anpd.gov.br/wp-content/uploads/2022/07/Decisao-normativa-ANPD-n.-1-de-2022.pdf
• RAGJur, Jurisprudência sobre LGPD e saúde — https://www.ragjur.com/busca?q=LGPD+art+11+saude

Saiba mais em https://g.cloud