Health data in patient transport: Art. 9 GDPR

A transport operation processes more sensitive data than most businesses realise. Even the simple information "Mr M. goes to dialysis on Tuesdays" reveals a diagnosis. A destination like "oncology centre" does too. And the Muster 4 prescription contains medical details in plain text. All of this falls under Article 9 of the GDPR — the special categories of personal data. Stricter rules apply to this data than to name and address. Anyone who doesn't know them risks fines: Art. 83 (5) GDPR provides for up to 20 million euros or 4 percent of annual turnover for breaches of Art. 9, whichever is higher.

Why ride data is health data

Article 9(1) GDPR initially prohibits the processing of "data concerning health" — and only allows it under certain exceptions. The crux for transport operators: health data is not just the diagnosis itself, but any information that allows a conclusion about someone's state of health.

• The regular ride to dialysis reveals kidney failure.
• The destination "psychiatric day clinic" reveals a mental illness.
• The note "with wheelchair" or "lying down" reveals a mobility impairment.

So it isn't enough to omit the diagnosis. The context itself already deserves protection.

The legal basis you actually need

For transport operators, two exceptions from Article 9(2) are mainly relevant in practice:

1. Point (h) — processing for the provision of health care. Since medical transport is part of health care, this exception covers carrying out the ride.
2. Point (a) — explicit consent of the data subject. It is needed wherever processing goes beyond merely carrying out the ride.

Important: the legal basis must be documented. When in doubt, the supervisory authority won't ask whether you worked carefully — but whether you can prove it.

The elephant in the room: WhatsApp and private chat groups

Many operations coordinate rides via WhatsApp groups. That's convenient but highly problematic under data protection law. Several points are critical:

• Third-country transfer: some operator data sits outside the EU. For the USA there has been the adequacy decision on the EU-US Data Privacy Framework since 2023; whether a provider takes part in it and whether health data may be transferred that way is something you have to check and document.
• No data processing agreement: you don't conclude a DPA under Article 28 GDPR with a consumer messenger.
• No access control: everyone in the group sees every message — including the driver who isn't even performing the ride in question.
• No deletion policy: messages remain on every participant's device, practically indefinitely.

This isn't a theoretical risk: the upper fine bracket applies to exactly these breaches (Art. 83 (5) (a) GDPR).

What applies instead: four measures

Art. 32 GDPR requires technical and organisational measures appropriate to the risk, and with health data the risk is high. In practice, anyone who wants to process ride data under Art. 9 needs four things:

1. Access on a need-to-know basis

A driver sees their own rides, and only those. The dispatcher sees the overall picture, but no more detail than necessary. Role-based access control is one of the obvious measures under Art. 32; the supervisory authority asks about the risk, not about the word.

2. Encryption in transit and at rest

Encryption is the measure Art. 32 (1) names explicitly: on the transport path (TLS) and at rest (database encryption). An unencrypted Excel attachment by email doesn't meet that.

3. A data processing agreement with every provider

As soon as an external provider — such as software — processes health data on your behalf, you need a DPA under Article 28. Reputable providers conclude it with the customer in text form before they process any personal data on its behalf; at MitaBase it is being finalised with a lawyer.

4. Deletion policy and logging

You must define when which data is deleted, and be able to show in an audit who had access when.

The pragmatic path

Data protection in patient transport is no black art, but it tolerates no makeshift solutions built from chat groups and spreadsheets. A system that brings access rights, encryption and logging out of the box takes a large part of the work off your hands. That is MitaBase's approach: data protection not as an afterthought, but as the default. What we have and what we do not is on the security page, including the data processing agreement, which is being finalised with a lawyer.

The best first step is an honest look at your own workflows: where does health data leave the building today without anyone in control of it? Every WhatsApp group, every email attachment, every note in the glove box is a candidate. Close these paths and you've already eliminated most of the risk.

Read on: security and data protection at MitaBase and Art. 9 GDPR in one sentence.