12 February 2025
roadmap
croatia
Patients and privacy in Croatia
In 2011, Croatia made a significant leap in healthcare digitalisation by introducing the Central Health Information System (CEZIH), which serves as the primary platform for storing and standardising health data. The CEZIH integrates data management across various healthcare services, including general practitioners, dental care, specialist clinics, pharmacies and hospitals, while also linking these services with key stakeholders like the Croatian Health Insurance Fund (HZZO).
Although the CEZIH was designed to securely transmit and store patient health records electronically, it often encounters technical issues, frequently becoming inaccessible or crashing. Even when it functions correctly, there are persistent concerns about data privacy, as a broad range of healthcare workers have mostly unrestricted access to sensitive patient information, highlighting the need for stricter controls to ensure data security.
In recent years, this has led to several cases of unauthorised access to patient records without consent or medical necessity, with the information being improperly shared. Additionally, there have been allegations of data breaches involving hospital staff disclosing patient injury details to certain attorneys, particularly in cases where claims against insurance companies could be pursued.
These patterns expose the healthcare system to significant risks of GDPR non-compliance, potential fines and patient lawsuits. To date, healthcare institutions have largely avoided facing these consequences on a significant scale. While there is hope that the Croatian healthcare system will evolve in a more secure and positive direction, the full impact of these data breaches remains to be seen.
author: Petra Majher Lonča
Petra
Majher Lončar*
Associate | Vlahov Buhin i Šourek d.o.o. in coop. with Schoenherr
croatia