skip to Main Content
Data: Another Misstep By Sicily Region? Health Services Not Paid To Patients Who Do Not Give Their Data To The RIAP

Data: Another misstep by Sicily Region? Health services not paid to patients who do not give their data to the RIAP

This post is also available in: Italiano Español Français

The provision of data to the RIAP (Italian Register of Arthroplasty – Registro Italiano ArtroProtesi) is optional on the part of the patient, which is why the Istituto Superiore di Sanità, which manages the register, correctly asks the persons concerned for their consent to the processing of their data. However, in Sicily, a decree has established that if patients fail to provide their data, health services will not be paid to accredited health structures. Is this yet another misinterpretation of the right to personal data protection on the part of the Sicilian regional authorities, following the recent warning issued by the Authority on 22 July?

Background – Surveillance systems and registers are set up to ensure an active system of systematic collection of personal, health and epidemiological data to record and characterise all cases of health risk, a particular disease and its treatment and outcome or a relevant health condition in a defined population. These are fundamentally important tools.

RIPI and RIAP, acronyms of Italian Register of Implantable Prostheses and Italian Register of Arthroplasty respectively, are part of the surveillance systems of national and regional relevance, established by Law Decree no. 179 of 18 October 2012. The National Register of Implantable Prostheses (RIPI) established by the Prime Ministerial Decree of 3 March 2017 is not yet active, pending the publication of the regulations (referred to in Article 6 of the aforementioned Prime Ministerial Decree).

The RIAP constitutes a part of the RIPI and has as its legal basis for data collection the written and informed consent of the patient.

A brief history of the issue may be useful:

1. Inclusion of RIPI/RIAP among the surveillance systems established by Decree-Law no. 179 of 18 October 2012;
2. Issuance of the DPCM of 3 March 2017 Identification of surveillance systems and registers of mortality, cancer and other diseases;
3. On 01 March 2021, the Region of Sicily essentially makes it compulsory to communicate data in addition to the SDO (hospital discharge form) to the RIAP, under penalty of not receiving the contribution charged to the Regional Health Service.

As reported by the Working Group established at the Istituto Superiore Sanità, the objective of the Registry is to perform an epidemiological analysis and a mapping at the national level of joint replacement operations, proposing an information flow model develop and test the proposed model, based on the use of the Hospital Discharge Cards (SDO), supplemented by a minimum set of additional information related to the patient, the intervention and the device start a progressive enrolment of the regions and examine, limited to some specific contexts, the possibility of evaluating the outcome of the intervention through the use of Patient Reported Outcome measures.

The data flow – The data are pseudonymised at source (Regional Reference Centres) and the modalities of transmission of the personal data flow between the Regional Registries and the National one are agreed upon between the ISS and the Regional and Provincial Referents, also determining their constant updating in the light of the growing technological innovations and the relative security measures, which must maintain an uninterrupted adequacy.

This flow is inspired by the principle of data minimisation (relevance and non-excessiveness), taking into account the purposes pursued by the RIAP, the aforementioned principle is complied with right from the first phase of data migration, from the Regional Registers to the national one, with the identification of the minimum data set.

As reported by the RIAP Working Group, assisted by the DPO, of the Istituto Superiore di Sanità, the flow can be described as follows.

The healthcare facilities (A) collect the data relating to interventions and implanted devices (Minimum Data Set – MDS) and transmit them to the Regional Reference Centre (B), which links them to the relevant hospital discharge forms (SDO) and transmits the linked data to the Istituto Superiore di Sanità (ISS) (C) for subsequent processing and for the presentation of the data in aggregate form (Report).

In particular:

(a) Prior to the transmission of the linked data from B to C, B shall pseudonymise the patient identification code according to a specific algorithm (in accordance with what is defined in Law no. 262, paragraph 5.1 published in the Official Gazette 7/12/2016) and standardise the encryption of the data in accordance with the national data so that the pseudonym is securely assigned in compliance with the regulations;

b) The data are collected by the hospitals and facilities participating in the project following the indications provided at the local level by each participating region. For those regions that have not already implemented their own data collection flow, the ISS has made available an IT support (RaDaR platform, Raccolta Dati Ricoveri) useful for collecting the MDS;

c) The data on implanted medical devices are acquired by selecting the relevant product code from the RIAP-DM Dictionary, a database that currently contains over 90,000 product codes, constantly fed by the manufacturing companies and accessible by the operator directly from the RaDaR platform. For the regions that do not use RaDaR, ISS has provided specific webservices that allow the interfacing of local systems with the RIAP-DM Dictionary. The RIAP Working Group verifies the quality of the data loaded in the RIAP-DM Dictionary through a comparison with the homologous information present in the National Database of Medical Devices of the Ministry of Health. After selecting the device from the RIAP-DM Dictionary, the operator enters on the platform the data related to the production lot, information available on the adhesive labels present in the device box;

d) The ISS collects all the data in the RIAP database and assesses their quality through the application of a series of syntactic and semantic verification checks. Processing is then carried out on the data that have passed the quality check.

The Sicily Region’s Councillor’s Decree – One wonders about the legitimacy and compatibility with the national and European Union regulatory framework of the Sicily Region’s provision on the (substantial) obligation to provide such data, failing which the SSR contribution would not be recognised, with the fatal consequence of a possible obstacle to access to health care on the part of those who decide not to provide such data to the RIAP.

In fact, the decree states that ‘all orthopaedic operations involving implantable hip, knee, shoulder and ankle prostheses that are not registered in the RIAP will not be remunerated’.

The right to the protection of personal data as a non-absolute fundamental right is a precondition for the exercise of other fundamental – and in this case absolute and unconditional – rights, such as the right to health.

It is not a tyrant right, but neither can it be restricted in such a way as to cancel itself out, wiping out all protection and guarantees. Either the RIAP/RIPI is included among the registers of national and regional relevance, which it is compulsory for healthcare facilities to maintain, by publishing the relevant Regulations, following the opinion of the Privacy Authority, or, pending the publication of the aforementioned Regulations, the provision according to which the remuneration of the service is subject to the consent given by the patient is eliminated.

In addition to the technical aspects that we have tried to highlight in the briefest of terms, this provision also poses significant operational difficulties: how, for example, are we to manage any withdrawal of consent by the user after the healthcare service has been provided? What are the effects on the reporting of services by healthcare facilities?

The decisive intervention, during the consultative phase, of the Authority for the protection of personal data is directly required by the normative dictate for the issuing of a Regulation that will have to deal, among other things, with the definition of a coding system that does not allow the direct identification of the interested party, for the institution of the RIPI, to identify the subjects who can have access to the registers and the data they can know, as well as the measures for the custody and security of the data.

In the meantime, an intervention by the Authority is highly desirable to solve the Gordian knot of a consent for scientific purposes expressed by the person concerned as a precondition for access to health care under agreement with the Regional Health Service.


Back To Top