Regulations concerning the collection and processing of health data in the Cancer Registry (Cancer Registry Regulations)


Date FOR-2001-12-21-1477


Ministry of Health and Care Services


Published in 2001 Booklet 16


Commencement 01.01.2002

Edited

FOR-2014-12-19-1734 from 01.01.2015

Changes


For
Norway

Legal

LOV-2001-05-18-24-§8, LOV-2001-05-18-24-§9, LOV-2001-05-18-24-§16 LOV-2001-05-18- 24 §17, LOV-2001-05-18-24-§22, LOV-2001-05-18-24-§27 cf. LOV-2014-06-20-42-§33 cf. LOV-2014-06- 20-43-§33, LOV-1999-07-02-64-§37, LAW-1967-02-10-§13d

Promulgated
21/12/2001

Short Title
Cancer Registry Directive

Chapter Overview:

Chapter 1 General provisions (§§ 1-1 - 1-11)
Chapter 2. Records of health information to the Cancer Registry, quality control, etc. (§§ 2-1 - 2-4)
Chapter 3. Treatment of health data in the Cancer Registry (§§ 3-1 - 3-8)
Chapter 4. Confidentiality, data security, internal (§§ 4-1 - 4-4)
Chapter 5. the right to information and access (§§ 5-1 - 5-3)
Chapter 6. Storing personal health data in the Cancer Registry (6-1)
Chapter 7. Penalties (§7-1)
Chapter 8. Final provisions (section 8-1)

Adopted by Royal Decree. December 21, 2001 pursuant to the Law of 18 May 2001. 24 on health records and processing of health data (Health Register Act) § 8 subsection Ref. Subsection, § 9, second paragraph, § 16 subsection § 17 subsection § 22 fifth paragraph, § 27, second paragraph and the Act of 2 July 1999 no. 64 relating to health personnel (health) § 37. Promoted by health and Social Affairs (now the Ministry of health).
Added basis: Law of 10 February 1967 relating to procedure in administrative matters (Public Administration) § 13d subsection.
Changes: Amended by regulations 20 June 2003 no. 741, September 2, 2005 No.. 1010, 7 Dec 2007 no. 1389, 26 June 2009 No.. 868, 16 Dec 2011 No.. 1250 16 Dec 2011 No.. 1396, January 17, 2013 No.. 61, 19 Dec 2014 No.. 1734

Chapter 1 General provisions

§ 1-1. (Establishment of the Cancer Registry) This regulation establishes a nationwide Cancer Registry. The regulations provide for the collection and processing of health information in the registry.
The collection and processing of health data in the Cancer Registry can be done manually and by electronic means.

§ 1-2. (Cancer Registry Content) Cancer Registry will contain health information on all persons in Norway who have or have had cancer. Cancer Registry will contain health information on precancerous lesions and benign tumors of the central nervous system.
Cancer Registry may also contain information on medical matters concerned relatives of people in Norway as evidenced predisposed or have a hereditary cancer that may be subject to outreach activities, if the affected relative, after receiving information about how such data is processed in cancer Registry, not oppose it.
Cancer Registry may further contain health information about persons who have participated in the survey program for the early detection and control of cancer. For negative findings can be directly identifiable personal information recorded permanently unless the data subject opposes it. For individuals who have opposed such registration can directly identifiable personal information stored temporarily so that the information can be quality assured.

§ 1-3. (Cancer Registry purpose) The purpose of the Cancer Registry is to:

1.
Collect and within regulation limits processing data on cancer cases and cancer research in Norway to map the distribution of cancer in the country and describe changes over time,

2.
Operate, promote and provide the basis for research to develop new knowledge of the causes, diagnosis, natural history and treatment effects for promoting and developing the quality of preventive measures and treatment offered or provided to combat cancer, up of individual patients and patient groups ,

3.
Provide advice and guidance on health care to combat cancer,

4.
Provide advice and information to other government and public about measures that can prevent the development of cancer.

Data in the Cancer Registry can besides the purposes mentioned in subsection processed for the management, planning and quality assurance of health and care services and health care management, preparation of statistics and research.

§ 1-4. (Prohibition of use) The data in the Cancer Registry can not be used for purposes that are incompatible with the purposes stated in § 1-3.
Information on individuals is obtained by processing of health information under the Regulations, can not be used for insurance purposes even if the data agree.


§ 1-5. (Data controller) Cancer Registry is the data controller for the collection and processing of health data in the Cancer Registry.

§ 1-6. (Data Processing) Cancer Registry may enter into a written agreement with a data processor on the collection and processing of health data in the Cancer Registry, including the monitoring and research, cf. § 1-3, operation and quality assurance of the registry, and disclosure of data to users.

§ 1-7. (For information about cancer cases in the Cancer Registry) Cancer Registry may without consent contain the following information relating to persons who have or have had cancer, precancerous, or benign tumors of the central nervous system to the extent necessary to achieve the purpose of the registry:

1.
Personal data:

1.1.
Name and number,

1.2.
Address and municipality,

1.3.
Marital status,

2.
Administrative information:

2.1.
Institution / business / department where health care is delivered and rendered,

2.2.
Treatment responsible doctor, name and address, or contact doctor,

2.3.
Residential care, hospitalization date, discharge date, or outpatient,

3.
Medical information:

3.1.
About cause of health and care services is sought, time and course of symptoms, diagnosis, treatment, control, and possibly relapse

3.2.
About cancer:

3.2.1. cancer while starting or headwaters,
3.2.2. disease category,
3.2.3. morphological diagnosis,
3.2.4. propagation at the time of diagnosis,
3.2.5. metastases,
3.2.6. relapse,

3.3.
About diagnosis basis:

3.3.1. clinic,
3.3.2. imaging,
3.3.3. histological examination,
3.3.4. cytological material
3.3.5. Another type of investigation,

3.4.
Cancer treatment the data subject has received, indications and contraindications for treatment, treatment and any complications or side effects,

3.5.
About any residual tumor after treatment.

Cancer Registry may, if the data does not oppose it, after receiving information about how such information is treated in the Cancer Registry, contain information about the data

1.
Work conditions

2.
Smoking habits,

3.
Any other known risk factors for cancer.

§ 1-8. (Details of the affected relatives of people who have hereditary cancer) Cancer Registry can under the conditions mentioned in § 1-2, contain the following information about the affected relatives of people in Norway as evidenced predisposed or have a hereditary cancer, which can be made to subject of outreach:

1.
Personal data:

1.1.
Name and number,

1.2.
Address and municipality,

1.3.
Marital status,

2.
Administrative information:

2.1.
Business / department, or residential care,

2.2.
Time control (date and year)

2.3.
Date for a planned follow-up,

3.
Relevant medical information:

3.1.
Diagnosis basis,

3.2.
Diagnosis

4.
Background investigation.

§ 1-9. (Data on persons who have participated in the program for early diagnosis or control of specific cancers) Cancer Registry can with the exceptions set out in subsection include the following information about persons who have participated in the survey program for the early detection and control of cancer:

1.
Personal data:

1.1.
Name and number,

1.2.
Address and municipality,

1.3.
Marital status,

2.
Administrative information:

2.1.
Business / department, or residential care,

2.2.
Time control (date and year)

2.3.
Date for a planned follow-up,

3.
Relevant medical information:

3.1.
Diagnosis basis,

3.2.
Diagnosis

4.
Background for the survey:

4.1.
Exploration program

4.2.
Different background.

For negative findings should be personal data as mentioned in the first paragraph. 1, deleted after the information is quality assured and no later than six months after collection of the data if the data reject that information is recorded permanently. This also applies to previously collected data. If the registered requests, shall Cancer Registry recording information about name, date of birth and address in a separate reservation register.

§ 1-10. (Information on the cause of death) Cancer Registry may contain health information on cause of death, autopsy, death, time, month and year on all registered in the register.


§ 1-11. (Coding and classification of information in the Cancer Registry, documentation requirements) The data controller for the Cancer Registry shall at every registration in the registry could document the classifications or coding scheme used.
Ministry may issue further provisions on which national or international codes and classifications to be used when recording data in the Cancer Registry.

Chapter 2. Records of health information to the Cancer Registry, quality control, etc.

§ 2-1. (Health professionals documentation and notification) Clinicians, pathologists, radiologists and other laboratory physicians providing health care by cancer, will without regard to confidentiality report information as listed in § 1-7 first paragraph to the Cancer Registry. Information on work conditions, smoking habits, etc.. as mentioned in § 1-7 second paragraph shall be notified if the data does not oppose it.
Clinicians, pathologists, radiologists and other laboratory physicians who examine for possible cancer, ref. § 1-2 third paragraph, shall by negative findings report information as listed in § 1-9 first paragraph to the Cancer Registry without regard to confidentiality. It shall be stated in the message information about the person's identity to be registered or permanently deleted after the information is quality assured.
Message mentioned in the first and second paragraphs shall be submitted on an ongoing basis and not later than two months after the information is documented according to the Health § 39 and § 40

§ 2-2. (Reporting form requirements etc.) Notification of information as mentioned in § 2-1, first and second paragraphs shall be made on forms or otherwise stipulated by the Ministry.
Ministry may order the use of specific classification and coding systems for the registration of the data and issue orders on the use of standardized message formats for the transmission of information.

§ 2-3. (The organization's duties) Health institutions, polyclinic, health center, pathology laboratory, radiology laboratory, clinical chemistry laboratory or other activities that are responsible for the registration of information to be reported to the Cancer Registry, cf. § 1-7 and § 1-9, are responsible for their duties as mentioned in § 2-1 and § 2-2 are met, and shall ensure that there are procedures to ensure this, cf. Regulations § 4-2 and § 4-3.

§ 2-4. (Recipient's responsibility for quality control) The data controller for the Cancer Registry shall ensure that health information is collected and treated in the Cancer Registry is accurate, relevant and necessary for the purposes for which it is collected, cf. § 1-3. As part of quality control can be done routinely aligned with data the Central Population Register and the Cause of Death Register and the Norwegian Patient Register.
If notification form is incomplete, the sender must be notified, ref. Filing Systems Act § 9 second sentence. If this situation continues completing Form shall Fylkesmannen notified.

Chapter 3. Treatment of health data in the Cancer Registry

§ 3-1. (Compilation of data for the production of statistics) Data in the Cancer Registry can be assembled (connected) with information at the Medical Birth, Death Registry, for Communicable Diseases, the Central Tuberculosis Register, System for Vaccination Control, NorPD, Defence Filing Systems, Norwegian Patient Register and Cardiovascular karregisteret , if it is done by the data controller for one of the said registers or a business decided by the Ministry, and the result of the assembly appears in anonymous form.
The data controller shall normally execute requests for statistical information from the public sector and researchers within 60 days from the day the order was received. If special circumstances make it impossible to execute the request within the deadline may be postponed until it is possible to fulfill it. The data controller shall then give a provisional reply stating the inquiry can be effected, the reason for delay and probable date for effectuation of the order.
Health data received for the production of statistics by the first paragraph shall be deleted as soon as the production of statistics is satisfactorily completed.

§ 3-2. (Alignment of data from the Cancer Registry with data from other registers for research, etc.). The data controller for the Cancer Registry can compile information in the Cancer Registry with information in health records as mentioned in § 3-1, first paragraph, except Defence Filing Systems, for explicitly stated purposes, Currently Registers purposes, cf. Regulations § 1-3, if it is unobjectionable ethical considerations and data processor (researcher) must only process de-identified data.

Aligned health data can not be stored until name, birthday and social security number is deleted or encrypted. Directly identifiable personal information (name and number) which are received for processing should be deleted as soon as the alignment () is satisfactorily completed.
All information that is processed by the first and second paragraph shall be deleted at project completion.

§ 3-3. (Disclosure of aligned data files for research etc..) De-identified information as mentioned in § 3-2, first paragraph, shall be made available and disclosed to research, or otherwise expressly stated purpose within Register, ref. Regulations § 1-3, if

-
Receiver must only process de-identified data,

-
Processing of the data is unobjectionable ethical considerations and

-
Assembly and preparation of the data done by the data controller for one of the registers whose data are processed, or in a business Ministry.

§ 3-2 second paragraph applies correspondingly.
A decision on extradition as described in the first paragraph for medical and health research, registry, in cases where, according to the Registry's assessment is doubt about the data processing is unobjectionable on ethical grounds, submit the question of extradition shall be made for a regional committee for medical and health research for decision. Decisions made by the regional committee for medical and health research ethics may be appealed to the National Research Ethics Committee for Medical and Health Sciences.
Application for disclosure of information as described in the first paragraph for medical and health research should include information about research and project manager, cf. Health Research Act § 6
The data controller shall disclose or transmit necessary and relevant data to the person responsible for the the project within 60 days from the day the application was received. The legal basis for the data processing application must state, cf. Subsection.
If special circumstances make it impossible to execute the application within the specified deadline may be postponed until it is possible to fulfill it. The data controller shall then give a provisional reply stating the inquiry can be effected, the reason for the delay and probable date for application may be processed.
All information that is processed in accordance with this section shall be erased or reset completion of the project.

§ 3-4. (Duty to disclose non-aligned data for research etc.). The data controller for the Cancer Registry shall upon request from the public administration and researchers disclose statistical data from the Cancer Registry within 30 days from the date the request was received.
The data controller for the Cancer Registry shall, upon application, disclose de-identified data from the Cancer Registry if

-
Information used in one expressly stated purpose of the Register purpose

-
Receiver must only process de-identified data and

-
Processing of the data is unobjectionable on ethical grounds.

A decision on extradition as described in the second paragraph for medical and health research, registry, in cases where, according to the Registry's assessment is doubt about the data processing is unobjectionable on ethical grounds, submit the question of extradition shall be made for a regional committee for medical and health research for decision. Decisions made by the regional committee for medical and health research ethics may be appealed to the National Research Ethics Committee for Medical and Health Sciences.
Application for disclosure of information as described in the first paragraph for medical and health research should include information about research and project manager, cf. Health Research Act § 6
The data controller shall disclose or transmit necessary and relevant data to the person responsible for the the project within 30 days from the day the application was received. The legal basis for the processing of data must be stated in the application.
§ 3-3 sixth and seventh paragraphs apply correspondingly.

§ 3-5. (Disclosure and other processing of data in the Cancer Registry) personally identifiable information in the Cancer Registry may, unless otherwise provided by this regulation, only processed (aligned, disclosed, etc.) permission from the Inspectorate and in accordance with the normal rules of confidentiality.

For dispensing of personally identifiable information for medical and health research replaced licensing obligations and requirements for exemption from the secrecy of pre-approval from a regional committee for medical and health research, cf. Health Research Act § 33 and § 9
Health Directorate shall respond to requests on disclosure of personally identifiable information for use in explicitly stated research projects within 30 days from the date the request was received. If special circumstances make it impossible to respond to the request within the specified time limit, the answer may be postponed until it is possible to reply. Health Directorate shall then give a provisional reply stating the reason for the delay and likely when a reply can be given.

§ 3-6. (Information strategy targeting user) To promote the use of data from the Cancer Registry and to build information and knowledge, cf. Regulations § 1-3, the data controller for the Cancer Registry have an active information strategy and plan targeting the public health administration, health - care services and other public administration bodies, such as scientists in medical research, health care services research and social research.

§ 3-7. (Costs) The data controller for the Cancer Registry may require payment for treatment and correction of information under § 3-1 to § 3-5. The payment can not exceed the actual costs of such processing and preparation of the data.

§ 3-8. (Record of disclosures) The data controller for the Cancer Registry shall keep records of who receives data from the Cancer Registry and the legal basis for the disclosures. Records shall be stored for at least five years after extradition has taken place.

Chapter 4. Confidentiality, data security, internal

§ 4-1. (Confidentiality) Anyone who processes personal health data under these regulations bound to confidentiality under § 13 to § 13e and Healthcare Personnel Act.
The duty of confidentiality under subsection applies to the patient's place of birth, social security numbers, pseudonyms, nationality, marital status, occupation, place of residence and place of employment.
Information to other agencies under the Public Administration § 13b no. 5 and 6 may be granted only when it is necessary to facilitate the fulfillment of tasks under these regulations, or to prevent significant risk to life or serious injury to a person's health.

§ 4-2. (Information) The data controller for the Cancer Registry and the data processor shall, through planned and systematic measures ensure satisfactory information with regard to confidentiality, integrity, quality and availability, processing of health information under the Regulations, cf. Filing Systems Act § 16 et seq.
When the processing of health data takes place wholly or partly by electronic means, the provisions on data in the personal Data Regulations § 2-1 to § 2-16.

§ 4-3. (Obligation internal) The data controller for the Cancer Registry shall establish internal controls in accordance with the Health Register Act § 17. The systematic measures shall be adapted to the nature, activities and size to the extent necessary to comply with requirements laid down in or pursuant to the Health Register Act, with particular emphasis on provisions issued pursuant to the health Register Act § 16.
Data processors who process health information on behalf of the data controller, will process data in accordance with procedures data controller has lined up.

§ 4-4. (Inter control content) Internal control means that the data controller should have knowledge of current rules regarding the processing of health data, adequate and updated documentation for the execution of routines, and that this documentation is available for all those concerned. The internal audit shall include:

1.
Overview of how the business is organized,

2.
Overview of responsibility and authority,

3.
Overview of the requirements and pursuant to the Health Register Act applicable to business,

4.
Procedures followed by the enterprise to ensure compliance, including procedures for:

4.1.
Fulfillment of requirements that personally identifiable information is only processed when this is necessary to promote the purpose of the data processing, and in accordance with applicable confidentiality provisions, cf. Filing Systems Act § 11 and § 15

4.2.
Documentation and quality of health data, ref. Regulations § 1-11 and § 2-4,

4.3.
Fulfillment of requests for information and access, ref. Filing Systems Act § 21 to § 25, and Regulations § 5-1

4.4.

How the business complies with the provisions on access to health records, cf. § 3-1, § 3-3, § 3-4 and § 3-5

4.5.
Fulfillment of the rules regarding notification to the Inspectorate, ref. Filing Systems Act § 29,

5.
Routines business consequences if deviations occur and information about who is responsible,

6.
Procedures followed by the enterprise to prevent recurrence of deviations and information about who is responsible,

7.
Procedures for how the business systematically and regularly review their internal controls to make sure the activities and results of those matches the system business has been established, and if it means fulfillment of health registry legislation

8.
Procedures for how the business will ensure that all current and only current procedures are used, and

9.
Procedures for how the business ensures that employees have sufficient expertise to comply with the regulations.

Written documentation shall include at least the documentation of procedures as mentioned in the first paragraph. 1 to 8. The supervisory authorities may order written documentation beyond this if deemed necessary. The supervisory authorities may grant exemptions from all or part of this chapter when special circumstances exist.

Chapter 5. The right to information and access

§ 5-1. (The right to information and access) Data subjects have the right to information about the Cancer Registry and access to the processing of health data about themselves in accordance with the Health Register Act § 22 to § 25
Access to health information concerning him, see. Filing Systems Act § 22 the second paragraph shall preferably be provided through the data last attending physician and health institution. Information shall be provided in a comprehensible form.

§ 5-2. (Information and access when the data is a minor) parents or others with parental responsibility have right of access according to rules similar to those in the patient and user Rights Act § 3-4.

§ 5-3. (The deadline for responding to requests for access) Requests for access under § 5.1 shall be answered without undue delay and within 30 days from the day the request is received, see. Filing Systems Act § 19.
If special circumstances make it impossible to respond to the inquiry within 30 days, may be postponed until it is possible to provide answers. The data controller shall then give a provisional reply stating the reason for the delay and likely when a reply can be given.

Chapter 6. Storing personal health data in the Cancer Registry

§ 6-1. (Storing personal health data) Data in the Cancer Registry should be kept indefinitely, unless otherwise provided by these regulations or Filing Systems Act § 26 or § 28

Chapter 7. Penalties

§ 7-1. (Penalties) Any person who willfully or through gross negligence contravenes provisions laid down in Regulations § 2-1, § 2-3 and § 4-2 to § 4-4, punishable by fines or imprisonment not exceeding one year or both.
Complicity is punishable in the same way.

Chapter 8. Final provisions

§ 8-1. (Commencement) regulations come into force on 1 January 2002.