Regulations concerning the collection and processing of health data in the Medical Birth Registry (MBRN Regulations)


Date FOR-2001-12-21-1483


Ministry of Health and Care Services


Published in 2001 Booklet 16


Commencement 01.01.2002

Edited

FOR-2015-12-18-1588 from 01/01/2016

Changes


For
Norway

Legal

LOV-2001-05-18-24-§8, LOV-2001-05-18-24-§9, LOV-2001-05-18-24-§16 LOV-2001-05-18- 24 §17, LOV-2001-05-18-24-§22, LOV-2001-05-18-24-§27 cf. LOV-2014-06-20-42-§33 cf. LOV-2014-06- 20-43-§33, LOV-1999-07-02-64-§35, cf. LOV-1999-07-02-64-§37, LAW-1967-02-10-§13d

Promulgated
21/12/2001

Short Title
MBRN Regulations

Chapter Overview:

Chapter 1 General provisions (§§ 1-1 - 1-13)
Chapter 2. Records of health information to the Medical Birth, quality control, etc. (§§ 2-1 - 2-4)
Chapter 3. Treatment of health data in the Medical Birth Registry (§§ 3-1 - 3-8)
Chapter 4. Confidentiality, data security and internal (§§ 4- 1 - 4-4)
Chapter 5. the right to information and access (§§ 5-1 - 5-3)
Chapter 6. Storing personal health data in the Medical Birth Registry (6-1) || | Chapter 7. Penalties (§7-1)
Chapter 8. Final provisions (section 8-1)

Adopted by Royal Decree. December 21, 2001 pursuant to the Law of 18 May 2001. 24 on health records and processing of health data (Health Register Act) § 8 subsection Ref. Subsection, § 9, second paragraph, § 16 subsection § 17 subsection § 22 fifth paragraph, § 27, second paragraph and the Act of 2 July 1999 no. 64 relating to health personnel (health) § 35, ref. § 37. Promoted by health and Social Affairs (now the Ministry of health).
Added basis: Law of 10 February 1967 relating to procedure in administrative matters (Public Administration) § 13d subsection.
Changes: Amended by regulations 20 June 2003 no. 741, September 2, 2005 No.. 1010, 7 Dec 2007 no. 1389, 26 June 2009 No.. 868, 16 Dec 2011 No.. 1250 16 Dec 2011 No.. 1396, June 22, 2012 no. 586, January 17, 2013 No.. 61, May 23, 2014 No.. 667 (as amended by regulation May 27, 2014 No.. 676), 18 Dec 2015 No.. 1588.

Chapter 1 General provisions

§ 1-1. (Establishment of Medical Birth) This regulation establishes a nationwide MBRN. The regulations provide for the collection and processing of health information in the registry.
The collection and processing of health data in the Medical Birth can be done manually and by electronic means.

§ 1-2. (The contents of the Medical Birth) MBRN contains personally identifying information about:

1.
All births in Norway and their parents. With births meant a all born after terminated pregnancies after 22 completed weeks of gestation, ie after 154 days,

2.
Women who have a miscarriage after 12 completed weeks of gestation, ie after 84 days

3.
Women where pregnancy is interrupted due to a high risk that the child may get severe illness as a result of hereditary characteristic, illness or harmful effects during pregnancy, cf. Act of 13 June 1975. 50 about abortion § 2, third subparagraph c

4.
Women where pregnancy is terminated because the pregnancy has resulted in imminent danger of the woman's life or health, cf. Act of 13 June 1975. 50 about abortion § 10.

Direct personally identifying information about the woman where the pregnancy is interrupted by the first paragraph. 3, can only be registered permanently, if the woman does not oppose it. Directly identifiable personal information may be stored temporarily so that the information can be quality assured, and possible multiple registrations of the same abortions can be uncovered.
MBRN shall also include de-identified data on women where pregnancy is interrupted by the Law of 13 June 1975. 50 about abortion § 2, subsection a, b, d and e. The second paragraph, second sentence shall apply accordingly.

§ 1-3. (Registry purpose) The purpose of the Medical Birth is

1.
Collect and within regulation limits process data on births and terminated pregnancies in Norway to monitor the incidence of and study the causal relationships of:

1.1.
Illness and death among women in connection with pregnancy, childbirth and the postnatal period,

1.2.
Maternity which is likely to mean that children may be particularly prone to develop physical or mental defects or disabilities

1.3.
Deviant birthweight, disorders, deformities and injuries among born and children under one year,

1.4.
Fetal death and death among children under one year,

2.

Operate, promote and provide the basis for research aimed at improving the quality in prenatal care, obstetric and newborn care by identifying and monitoring of quality indicators,

3.
Provide scientific basis for advice on medical assistance to combat fetal death and death among children under one year and other matters referred to in paragraph 1

4.
Provide scientific basis for advice and information to other public administration bodies and the population on measures to prevent the circumstances mentioned in point 1

MBRN will also contribute to knowledge about the causes of abortions after 12 completed weeks of gestation by developmental anomalies.
Data in the Medical Birth can besides the purposes mentioned in subsections, processed for the management, planning and quality assurance of health and care services and health care management, preparation of statistics and research.

§ 1-4. (Prohibition of use) The information contained in the Medical Birth can not be used for purposes that are incompatible with the purposes stated in § 1-3.
Information on individuals is obtained by processing of health information under the Regulations, can not be used for insurance purposes even if the data agree.

§ 1-5. (Data controller) Public Health is the data controller for the collection and processing of health data in the Medical Birth Registry.

§ 1-6. (Data Processing) The Institute may enter into a written agreement with a data processor on the collection and processing of health information in the Medical Birth Registry, including the monitoring and research, cf. § 1-3, operation and quality assurance of the registry, and disclosure of data to users.

§ 1-7. (Data in the Medical Birth Registry of the mother) MBRN may without consent contain the following information about the mother of the firstborn, and the women as mentioned in § 1-2, paragraph Nos. 2 and 4 to the extent necessary to achieve the purpose of register:

1.
Personal data:

1.1.
Name and number,

1.2.
Address and municipality,

1.3.
Marital status,

1.4.
Any kinship between the child's parents,

2.
Administrative information:

2.1.
Institution / business

2.2.
Admission and discharge dates,

2.3.
Other relevant administrative data,

3.
Medical information about:

3.1.
Previous pregnancies,

3.2.
Last menstrual first day of your period,

3.3.
Ultrasound and other prenatal diagnosis,

3.4.
Relevant findings on prenatal diagnosis,

3.5.
Use of supplements, drugs, any other medical or surgical treatment during pregnancy,

3.6.
Specific health conditions before pregnancy,

3.7.
Specific health conditions during pregnancy,

4.
Information about the birth:

4.1.
Type of birth, date of birth start

4.2.
Intervention and treatment during delivery,

4.3.
Aspects of amniotic fluid, umbilical cord and placenta,

4.4.
Any complications.

MBRN may, if the woman does not oppose it, after receiving information about how such information is treated in the Medical Birth Registry, contain information about the woman

1.
Work conditions

2.
Smoking habits,

3.
Use of alcohol and other drugs during pregnancy.

§ 1-8. (Special omkunstig fertilization) MBRN may, if the couple does not oppose it, after receiving information about how such information is treated in the Medical Birth Registry, contain the following information about artificial insemination to the extent necessary to achieve the purpose of the register: | ||
1.
Causes of infertility, with specification of the main reasons,

2.
How long the couple has been infertile,

3.
Treatment,

4.
Number of embryos inserted,

5.
Number of treatment attempts,

6.
Date of inauguration of the embryo and ultrasound in the first trimester,

7.
Status by ultrasound in the first trimester,

8.
Number of fetuses, of which with certain heart action.

§ 1-9. (Data in the Medical Birth of baby) Medical Birth may without consent contain the following information about births to the extent necessary to achieve the purpose of the registry:

1.
Personal information

1.1.
Name and ID number, date of birth,

1.2.
Gender,

1.3.
Address and municipality,

2.
Administrative information:

2.1.
Birthplace

2.2.
Other relevant administrative data,

3.
Information about health conditions:

3.1.
Gestational age,

3.2.
Born alive, stillborn, cause of death and any time


3.3.
Signs of asphyxia, Apgar scores at 1 and 5 min.,

3.4.
Length, weight and head circumference

3.5.
Single birth or multiple birth

3.6.
Screening or other studies in the neonatal period,

3.7.
Neonatal diagnosis,

3.8.
Signs of abnormalities or injuries,

3.9.
Treating the newborn received the methodology used and any complications or side effects of treatment.

About fetuses at the end of pregnancy as mentioned in § 1-2, first paragraph. 2 to 4, the Medical Birth contain administrative data and relevant information on health conditions.
MBRN may further contain the following information about the child in its first year for conditions that were present at birth:

1.
Administrative information:

1.1.
Hospital, department or outpatient clinic where the children have received health care

1.2.
Admittance and discharge dates,

2.
Medical information:

2.1.
Child primary diagnosis and secondary diagnosis,

2.2.
Treatment the child received, the method used and any complications or side effects of treatment.

§ 1-10. (Data in the Medical Birth about father) MBRN may without consent stating their name, date of birth and address of the father of the born. Medical Birth may also contain such information about the danger to fetuses when pregnancy is interrupted due to the circumstances mentioned in § 1-2, paragraph Nos. 2 and 4.
After consent MBRN also contain information about the father

1.
Work conditions

2.
Smoking habits.

§ 1-11. (Information on Board treated pregnancies fracture) MBRN may contain the following information about the woman where the pregnancy is interrupted by the Law of 13 June 1975. 50 about abortion § 2, third paragraph, with the exceptions set out in § 1-2, second and third paragraphs :

1.
Personal data:

1.1.
Name and number,

1.2.
Address and municipality,

1.3.
Marital status, employment and schooling,

2.
Administrative information:

2.1.
Admittance and discharge dates,

2.2.
Other relevant administrative data,

3.
Information about health conditions:

3.1.
Previous pregnancies,

3.2.
Previous diseases of importance

3.3.
Basis for abortion,

3.4.
Type abortions, encroachment and other treatment related to pregnancy interruption,

3.5.
Prenatal diagnosis and morbidity by the fetus.

By aborted pregnancies after the Law of 13 June 1975. 50 about abortion § 2, subsection a, b, d and e shall personal data mentioned in subsection numbers 1.1 and 1.2 are deleted after the information is quality assured and possible multiple registrations is revealed later than six months after collection of the data.

§ 1-12. (Information on the cause of death) MBRN may contain personally identifiable information about the cause of death and exact time of death of births registered in the registry, to the extent necessary to achieve the purpose of the register, cf. § 1-3.

§ 1-13. (Coding and classification of information in the Medical Birth Registry, documentation requirements) The Institute shall each registration in the registry could document the codes and classifications used.
Ministry may issue further provisions on which national or international codes and classifications to be used when recording data in the Medical Birth Registry.

Chapter 2. Records of health information to the Medical Birth, quality control, etc.

§ 2-1. (Health professionals documentation and notification) midwife, doctor and other health professionals who provide health care to women during pregnancy and childbirth, ref. § 1-2, first paragraph. 1, 2 and 4 shall be without regard to confidentiality report information as listed in Regulation § 1-7, first paragraph, § 1-9 first paragraph and § 1-10, first paragraph, the Medical Birth Registry. Information as mentioned in § 1-9 second paragraph shall be without regard to confidentiality notified by health professionals that offer and provide health care to the child. Information as mentioned in § 1-7 second paragraph shall only be reported if the mother does not oppose it. Information as mentioned in § 1-10 first paragraph shall only be reported if the paternity is acknowledged or determined. Information on as mentioned in § 1-10 second paragraph shall be notified by consent.
Professionals offering and providing artificial (assisted) fertilization must report information as mentioned in § 1-8 to MBRN if the couple does not oppose it.

Professionals offering and providing health care by a tribunal treated abortions must report information as referred to in § 11.1 of the Medical Birth Registry. By aborted pregnancies after the Law of 13 June 1975. 50 about abortion § 2, subsection c shall be indicated in the notification of information about the woman's identity to be registered or permanently deleted after the information is quality assured.

§ 2-2. (Reporting form requirements etc.) Notification of information as mentioned in § 2-1, second and third paragraphs shall be in form or otherwise stipulated by the Ministry.
Form for medical birth notification must accompany the child until discharge from hospital, maternity ward or maternity home, and sent MBRN later than one month after birth. Follow-up form with information from the children's ward should be sent MBRN later than one month after discharge.
Form artificial (assisted) fertilization should be sent MBRN consecutively and within one month after proven fetus.
Registration forms for aborted pregnancies should be sent MBRN consecutively and within one month after the health care is provided.
Ministry may order the use of specific classifications and coding systems for the registration of the data and issue orders on the use of standardized message formats for the transmission of information.

§ 2-3. (The organization's duties) Health institutions, health and other activities that are responsible for recording information to be reported to the Medical Birth Registry, cf. § 1-7 to § 1-11, are responsible for the obligations stated in § 2-1 and § 2-2 are met, and shall ensure that there are procedures to ensure this, cf. Regulations § 4-2 and § 4-3.

§ 2-4. (Recipient's responsibility for quality) The Institute shall ensure that health information is collected and processed in the Medical Birth Registry is accurate, relevant and necessary for the purposes for which it is collected, cf. § 1-3. As part of quality control can be done routinely aligned with data the Central Population Register, Cause of Death Registry, Norwegian patient register and the MSIS.
If notification form is incomplete, the sender must be notified, ref. Filing Systems Act § 9 second sentence. If this situation continues completing Form shall Fylkesmannen notified.

Chapter 3. Treatment of health data in the Medical Birth

§ 3-1. (Compilation of data for the production of statistics) Data in the Medical Birth can be assembled (connected) with data in the Cancer Registry, Cause of Death Registry, for Communicable Diseases, System for Vaccination Control, NorPD, Defence Filing Systems, Norwegian Patient Register and Cardiovascular karregisteret, if it is done of the data controller for one of the said registers or a business decided by the Ministry, and the result of the assembly appears in anonymous form.
The data controller shall normally execute requests for statistical information from the public sector and researchers within 60 days from the day the order was received. If special circumstances make it impossible to execute the request within the deadline may be postponed until it is possible to fulfill it. The data controller shall then give a provisional reply stating the inquiry can be effected, the reason for delay and probable date for effectuation of the order.
Health data received for the production of statistics by the first paragraph shall be deleted as soon as the production of statistics is satisfactorily completed.

§ 3-2. (Alignment of data in the Medical Birth Registry with data from other registers for research, etc.). The Institute can put together information in the registry with information in health records as mentioned in § 3-1, first paragraph, except Defence Filing Systems, for explicitly stated purposes, within the Registry purposes, cf. Regulations § 1-3, if it is unobjectionable ethical considerations and data processor (researcher) must only process de-identified data.
Aligned health data can not be stored until name, birthday and social security number is deleted or encrypted. Directly identifiable personal information (name and number) which are received for processing should be deleted as soon as the alignment () is satisfactorily completed.
All information that is processed by the first and second paragraph shall be deleted at project completion.


§ 3-3. (Disclosure of aligned data files for research etc..) De-identified information as mentioned in § 3-2, first paragraph, shall be made available and disclosed to research, or otherwise expressly stated purpose within Register, ref. Regulations § 1-3, if

-
Receiver must only process de-identified data,

-
Processing of the data is unobjectionable ethical considerations and

-
Assembly and preparation of the data done by the data controller for one of the registers whose data are processed, or in a business Ministry.

§ 3-2 second paragraph applies correspondingly.
A decision on extradition as described in the first paragraph for medical and health research, registry, in cases where, according to the Registry's assessment is doubt about the data processing is unobjectionable on ethical grounds, submit the question of extradition shall be made for a regional committee for medical and health research for decision. Decisions made by the regional committee for medical and health research ethics may be appealed to the National Research Ethics Committee for Medical and Health Sciences.
Application for disclosure of information as described in the first paragraph for medical and health research should include information about research and project manager, cf. Health Research Act § 6
The data controller shall disclose or transmit necessary and relevant data to the person responsible for the the project within 60 days from the day the application was received. The legal basis for the data processing application must state, cf. Subsection.
If special circumstances make it impossible to execute the application within the specified deadline may be postponed until it is possible to fulfill it. The data controller shall then give a provisional reply stating the inquiry can be effected, the reason for the delay and probable date for application may be processed.
All information that is processed in accordance with this section shall be erased or reset completion of the project.

§ 3-4. (Duty to disclose non-aligned data for research etc..) The Institute shall upon request from the public administration and researchers disclose statistical data from the Medical Birth Registry within 30 days from the date the request was received.
The Institute shall upon application disclose de-identified data from the Medical Birth if

-
Information used for an expressly stated purpose of the Register purpose

-
Receiver must only process de-identified data and

-
Processing of the data is unobjectionable on ethical grounds.

A decision on extradition as described in the second paragraph for medical and health research, registry, in cases where, according to the Registry's assessment is doubt about the data processing is unobjectionable on ethical grounds, submit the question of extradition shall be made for a regional committee for medical and health research for decision. Decisions made by the regional committee for medical and health research ethics may be appealed to the National Research Ethics Committee for Medical and Health Sciences.
Application for disclosure of information as described in the second paragraph for medical and health research should include information about research and project manager, cf. Health Research Act § 6
Public Health shall disclose or transmit necessary and relevant data to the data controller for the specified project within 30 days from the date the application is received. The legal basis for the processing of data must be stated in the application.
§ 3-3 sixth and seventh paragraphs apply correspondingly.

§ 3-5. (Disclosure and other processing of data in the Medical Birth) personally identifiable information from the Medical Birth Registry may, unless otherwise provided by this regulation, only processed (aligned, disclosed, etc.) permission from the Inspectorate and in accordance with the normal rules of confidentiality.
For dispensing of personally identifiable information for medical and health research replaced licensing obligations and requirements for exemption from the secrecy of pre-approval from a regional committee for medical and health research, cf. Health Research Act § 33 and § 9.

Health Directorate shall respond to requests for disclosure of personally identifiable information for use in explicitly stated research projects within 30 days from the date the request was received. If special circumstances make it impossible to respond to the request within the specified time limit, the answer may be postponed until it is possible to reply. Health Directorate shall then give a provisional reply stating the reason for the delay and likely when a reply can be given.

§ 3-6. (Information strategy targeting user) To promote the use of data from the Medical Birth Registry and to build information and knowledge, cf. Regulations § 1-3, the NIPH have an active information strategy and plan targeting both health and care services, healthcare management and general management, such as scientists in medical research, health care services research and social research.

§ 3-7. (Costs) The Institute may require payment for treatment and correction of information under § 3-1 to § 3-5. The payment can not exceed the actual costs of such processing and preparation of the data.

§ 3-8. (Record of disclosures) The Institute shall keep records of who receives data from the Medical Birth Registry and the legal basis for the disclosures. Records shall be stored for at least five years after extradition has taken place.

Chapter 4. Confidentiality, data security and internal

§ 4-1. (Confidentiality) Anyone who processes personal health data under these regulations bound to confidentiality under § 13 to § 13e and Healthcare Personnel Act.
The duty of confidentiality under subsection applies to the patient's place of birth, social security number, nationality, marital status, occupation, place of residence and place of employment.
Information to other agencies under the Public Administration § 13b no. 5 and 6 may be granted only when it is necessary to facilitate the fulfillment of tasks under these regulations, or to prevent significant risk to life or serious injury to a person's health.

§ 4-2. (Information Security) Institute of Public Health and the processor shall, through planned and systematic measures ensure satisfactory information with regard to confidentiality, integrity, quality and availability, processing of health information under the Regulations, cf. Filing Systems Act § 16 et seq.
When the processing of health data takes place wholly or partly by electronic means, the provisions on data on the personal Data Act § 2-1 to § 2-16.

§ 4-3. (Obligation internal) Public Health shall establish internal controls in accordance with the Health Register Act § 17. The systematic measures shall be adapted to the nature, activities and size to the extent necessary to comply with requirements laid down in or pursuant to the Health Register Act, with special emphasis on provisions issued pursuant to the health Register Act § 16.
Data processors who process health information on behalf of the data controller, will process data in accordance with procedures data controller has lined up.

§ 4-4. (Inter control content) internal control system means that the data controller should have knowledge of current rules regarding the processing of health data, adequate and updated documentation for the execution of routines, and that this documentation is available for all those concerned. The internal audit shall include:

1.
Overview of how the business is organized,

2.
Overview of responsibility and authority,

3.
Overview of the requirements and pursuant to the Health Register Act applicable to business,

4.
Procedures followed by the enterprise to ensure compliance, including, routines:

4.1.
Fulfillment of requirements that personally identifiable information is only processed when this is necessary to promote the purpose of the data processing, and in accordance with applicable confidentiality provisions, cf. Filing Systems Act § 11 and § 15 and Regulations § 1-11 | ||
4.2.
Quality control and documentation of health data, ref. Regulations § 1-13 and § 2-4,

4.3.
Fulfillment of requests for information and access, ref. Filing Systems Act § 21 to § 25, and Regulations § 5-1

4.4.
How business meets the provisions regarding access to health records, cf. § 3-1, § 3-3, § 3-4 and § 3-5

4.5.
Fulfillment of the rules regarding notification to the Inspectorate, ref. Filing Systems Act § 29,

5.
Routines business consequences if deviations occur and information about who is responsible,

6.
Procedures followed by the enterprise to prevent recurrence of deviations and information about who is responsible,

7.

Procedures for how the business systematically and regularly review their internal controls to make sure the activities and results of those matches the system business has been established, and if it means fulfillment of health registry legislation

8.
Procedures for how the business will ensure that all current and only current procedures are used, and

9.
Procedures for how the business ensures that employees have sufficient expertise to comply with the regulations.

Written documentation shall include at least the documentation of procedures as mentioned in the first paragraph. 1 to 8. The supervisory authorities may order written documentation beyond this if deemed necessary. The supervisory authorities may grant exemptions from all or part of this chapter when special circumstances exist.

Chapter 5. The right to information and access

§ 5-1. (The right to information and access) Data subjects have the right to information about the Medical Birth and transparency in the management of health information about themselves in accordance with the Health Register Act § 22 to § 25. The information shall be provided in a comprehensible form.

§ 5-2. Information and access when the data are underage parents or others with parental responsibility have right of access according to rules similar to those in the patient and user Rights Act § 3-4.

§ 5-3. (The deadline for responding to requests for access) Requests for access under § 5.1 shall be answered without undue delay and within 30 days from the day the request is received, see. Filing Systems Act § 19.
If special circumstances make it impossible to respond to the inquiry within 30 days, may be postponed until it is possible to provide answers. The data controller shall then give a provisional reply stating the reason for the delay and likely when a reply can be given.

Chapter 6. Storing personal health data in the Medical Birth

§ 6-1. (Storing personal health data) Data collected to MBRN be stored indefinitely, unless otherwise provided by these regulations or Filing Systems Act § 26 or § 28

Chapter 7. Penalties

§ 7-1. (Penalties) Any person who willfully or through gross negligence contravenes provisions laid down in Regulations § 2-1, § 2-3 and § 4-2 to § 4-4, punishable by fines or imprisonment not exceeding one year or both.
Complicity is punishable in the same way.

Chapter 8. Final provisions

§ 8-1. (Commencement) regulations come into force on 1 January 2002.