For matters relating to personal data processing and to exercise your rights under the Regulation, please contact the IRCCS ISMETT Data Protection Officer (DPO) at the following contact details:
Telephone: +39 331 1959745
Mobile: +39 333 6214003
Email: giorgiamasina@studiomasina.com
PEC: masina@pec.studiomasina.com
Dear Patient,
Below we provide you with information required under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (“Regulation”) regarding data processing at IRCCS ISMETT – Istituto Mediterraneo per i Trapianti e Terapie ad Alta Specializzazione (“IRCCS ISMETT”). Specific documents will be provided to you if you are involved in particular activities, such as, for example, participation in clinical trials involving medicinal products or the collection of genetic data.
IRCCS ISMETT is a center of excellence in the field of transplantation and highly specialized therapies, accredited by JCI (Joint Commission International), an international body that certifies excellence of health care organizations, and compliance with high standards of quality and safety recognized by the international scientific community.
IRCCS ISMETT was established through a partnership between the Sicilian Region and UPMC (University of Pittsburgh Medical Center, based in Pennsylvania, United States). This collaboration was created to provide state-of-the-art services leveraging the expertise and knowledge developed by UPMC and the hospitals within the UPMC network (“UPMC Group”), with which there is an ongoing exchange of information. To ensure effective collaboration with these internationally renowned institutions, management of IRCCS ISMETT has been entrusted to UPMC Italy (“UPMCI”), the Italian subsidiary of the UPMC Group.
IRCCS ISMETT will ask you or third parties (e.g., your family doctor) to provide your personal data (name, address, etc.), information on your health status (diseases, lab results, diagnostic tests, ongoing therapies) and, if required, on your sex life or social and psychological scope. In addition, images of you may be collected when necessary to obtain consultations from external professionals, including through telemedicine systems, and to assess your health during a treatment.
To verify your identity securely, you will be asked to wear a wristband containing identification information (first name, last name, date of birth, patient ID, and visit ID) using RFID (Radio-Frequency Identification) technology. This device makes it possible to securely link laboratory tests, specimen tubes, blood bags, and other information to you.
Your personal data will be collected and processed to provide you with the requested services (outpatient services, hospital admissions and, more generally, treatment, diagnosis, rehabilitation and prevention services), and for administrative and accounting purposes. In addition, if necessary, we will send you your treatment plans and instructions on how to prepare for the tests you are scheduled to undergo.
The legal basis for data processing is Article 6(1)(b) of the Regulation (“processing is necessary for the performance of a contract to which the data subject is party”) and Article 9(2)(h) of the Regulation (“processing is necessary for the purposes of medical diagnosis, the provision of health or social care or treatment pursuant to a contract with a health professional”).
For these purposes, it may be necessary to disclose your personal data to the following parties:
ISMETT is a government-approved research hospital (IRCCS) and therefore participates in numerous research projects aimed at improving its healthcare services and contributing to the overall advancement of medical knowledge. In particular, IRCCS ISMETT conducts research in the following areas, for which it has been officially recognized as a scientific research institution (known as “Current Research”): transplantation and end-stage organ failure; innovative surgical, radiological, and diagnostic and interventional endoscopic techniques; regenerative medicine; clinical immunology and immunotherapy; infectious diseases and molecular medicine; and Information & Communication Technology for healthcare. These research activities are funded by the Italian Ministry of Health under a three-year plan and are intended to develop and expand medical and biomedical knowledge in the interest of public health (Article 12-bis of Italian Legislative Decree 502 of December 30, 1992).
Patient consent is not required for the use of data within the scope of Current Research or research projects governed by other laws, since these activities are carried out in the public interest (Articles 6(1)(e) and 9(2)(j) of the Regulation, in conjunction with Articles 110 and 110-bis of Italian Legislative Decree 196/2003, as subsequently supplemented and amended).
Your consent is required to use your data in clinical studies not funded by the Italian Ministry of Health or provided for by law, but conducted by IRCCS ISMETT, either internally or in collaboration with other centers located within or outside the European Union, in the research areas described in greater detail at the following link: https://www.ismett.edu/ricerca/linee/). Because it is not currently possible to identify the specific clinical studies that IRCCS ISMETT may initiate, we ask you to indicate your willingness to contribute to the advancement of scientific knowledge by authorizing the Institute to retain your data for this purpose. If you provide your consent, your personal data, with the exception of genetic data, will be entered into a database in coded form, meaning that they will be identified solely by a code consisting of numbers and letters rather than by your first and last name, and retained for a maximum of 25 years. The legal basis for this processing is therefore consent (Articles 6(1)(a) and 9(2)(a) of the Regulation). The data contained in the database will be used to conduct future studies in anonymous form, meaning that it will no longer be possible to identify the patients. If the data cannot be anonymized, your specific consent will be obtained (Articles 6(1)(a) and 9(2)(a) of the Regulation).
These studies are conducted using information that has already been collected or that will be collected during the normal course of care, as part of previous clinical studies, or obtained from biological samples collected for patient care and stored in the IRCCS ISMETT’s laboratories or biobank. Participation in these research projects therefore has no effect on patients’ normal care and does not require them to undergo any additional tests or treatments. No genetic data will be collected as part of these studies. Genetic data means information relating to inherited or acquired genetic characteristics that provides unique information about a person’s physiology or health.
Furthermore, to protect patient confidentiality, information, health data, and biological samples are stripped of patient-identifying information and labeled with a code consisting of letters and numbers, as described above. The list that makes it possible to link this code to patients’ identifying information will be held exclusively by the study’s Principal Investigator (PI) and retained as confidential documentation. Data directly attributable to a patient may be accessed only when information is extracted from the original medical records, during any monitoring activities, meaning verification that the data used for research correspond to the data contained in the medical record, and whenever the research data need to be updated. When it is no longer necessary to identify the patient, anonymization techniques are also applied so that the data can no longer be linked to the patient. Encryption techniques are also used to store and transfer data, thereby preventing access by unauthorized parties. Data are retained for at least seven years after completion of the research project or for a longer period in accordance with applicable regulations or agreements among the participating centers. Research results are disclosed only in aggregate form or by other means that do not allow the data subjects to be identified.
A periodically updated list of ongoing studies, organized by research area, is available at the IRCCS ISMETT and on the “Research Areas” page of www.ismett.edu. The relevant privacy notices for Current Research studies and studies required by law are also published there. If you are interested, you may also meet with the Principal Investigators or the Data Processing Coordinator – Research Office to obtain additional information.
Please remember that you are free to provide or withhold your consent. You may withhold your consent or object at any time to the processing of your data and samples for research purposes, without this adversely affecting your care, by writing to the addresses provided in the section below entitled “HOW CAN I EXERCISE MY RIGHTS?” In this case, any biological sample that can still be linked to you will be destroyed, except where it must be retained solely for purposes of care.
IRCCS ISMETT intends to monitor and evaluate the effectiveness of the patient care provided, its appropriateness and quality, and health risk factors, in addition to the activities required by law. In particular, IRCCS ISMETT intends to assess and compare, across population groups or different healthcare facilities, the adequacy, appropriateness, effectiveness, and efficiency of the care provided, including with regard to specific diseases or health conditions. In order to use patients’ personal data for these purposes, patients must provide their consent, which constitutes the legal basis for the processing (Article 6(1)(a) of the Regulation and, with regard to the exemption from the prohibition on processing special categories of personal data, Article 9(2)(a) of the Regulation, “the data subject has given explicit consent to the processing”). If you wish to authorize IRCCS ISMETT to process your data, including data collected in the past, in order to conduct these important analyses, which may also provide information useful for your care, please provide your consent by checking the appropriate box at the bottom of this document. If you do not provide your consent, we will not be able to use your data for the analyses described above; however, you will still be able to receive care from IRCCS ISMETT. IRCCS ISMETT also intends to participate in legally mandated surveillance systems and registries that collect information on diseases and health risk factors. Patient consent is not required for the use of data in connection with these activities because they are required by law (Article 6(1)(b) of the Regulation, “processing is necessary for compliance with a legal obligation,” and, with regard to the exemption from the prohibition on processing special categories of personal data, Article 9(2)(i) of the Regulation, “processing is necessary for ensuring high standards of quality and safety of healthcare and of medicinal products or medical devices, as provided for by law”).
If you provide consent, we will send you information materials about projects or services launched by IRCCS ISMETT, as well as awareness and donation campaigns or fundraising initiatives (e.g., 5×1000 income tax contributions). The legal basis for processing for this purpose is therefore consent (Article 6(1)(a) of the Regulation and, with regard to the exemption from the prohibition on processing special categories of personal data, Article 9(2)(a) of the Regulation, “the data subject has given explicit consent to the processing”). The data will be retained for 24 months from the date of collection. If you do not provide your consent, we will not be able to send you the aforementioned materials.
IRCCS ISMETT uses an electronic record-keeping system, known as an electronic health record, which allows health care providers to access all documentation relating to services provided at IRCCS ISMETT, including those provided in the past. This system, which gives health care providers more complete information about your health status, medical history, thereby facilitating your patient care, may be activated only with your consent.
Therefore, only if you consent to the creation of your electronic health record, which constitutes the legal basis for processing pursuant to Article 6(1)(a) of the Regulation and, with regard to the exemption from the prohibition on processing special categories of personal data, Article 9(2)(a) of the Regulation, “the data subject has given explicit consent to the processing,” will health care providers at IRCCS ISMETT involved in your care be able to access information relating to the episodes of care you have received at IRCCS ISMETT, including at different times. You may freely decide that certain information should not be included in your electronic health record by asking the medical director to “restrict access” to it, either by writing to the address indicated below or by emailing direzionesanitariaprivacy@ismett.edu. Using the same methods, you may object at any time to any further additions to your electronic health record, while continuing to receive care from IRCCS ISMETT, and you may revoke your previous choices at any time. You will be asked to provide specific consent for the inclusion in your electronic health record of information subject to enhanced confidentiality protections (such as, for example, data on acts of sexual violence or pedophilia, voluntary termination of pregnancy, HIV infection or drug use, psychotropic substances and alcohol).
If you do not consent to the creation of your electronic health record, physicians and other health care providers will have access only to data relating to the specific episode of care. While you are free to consent to the creation of your electronic health record, please be aware that if the aforementioned professionals are unaware of certain tests or episodes of care, this could adversely affect the care provided to you, and they will not be held liable for any resulting consequences.
Lastly, please note that your electronic health record may be accessed without your consent if this is considered essential to protect the health of a third party or the public.
Data processing is performed using paper and electronic tools, adopting appropriate safety measures to guarantee data confidentiality and security.
Your personal data will be processed by the clinical and administrative staff of IRCCS ISMETT and UPMCI, who act on the basis of specific instructions regarding the purposes and methods of such processing and are required to comply with professional secrecy and confidentiality obligations. Clinical services may be provided in the presence of students for educational purposes. In such cases, appropriate measures will be taken to minimize any discomfort, while respecting any objection you may have.
In addition to the parties already indicated in Section 1, your data may be disclosed to third parties that, in their capacity as Data Processors or persons authorized to process data, provide services supporting the activities of IRCCS ISMETT, including:
food catering companies providing meals for inpatients
Your data may also be disclosed to independent data controllers in compliance with legal obligations or for the establishment, exercise, or defense of legal claims (for example, the NHS, public institutions, municipalities, social security and welfare agencies, the National and Regional Transplant Centers, disease registries, and insurance companies).
The updated list of UPMC Group hospitals, data processors, and independent data controllers who have access to the data is available from the Data Controller – Office of the Director of Health Care Activities or the DPO, that can be reached at the addresses listed below.
Information regarding your stay at IRCCS ISMETT and on your health status will only be provided to your relatives and friends, without prejudice to the provisions of law.&;
In addition to the provisions set forth above, your personal data will be retained in accordance with the requirements established by the Italian Ministry of Health Circular letter no. 61 of December 19, 1986. Specifically, data contained in medical records and reports, will be retained indefinitely, while radiological images will be retained for no less than ten (10) years. Further information may be obtained by contacting the Data Processing Coordinator – Data Controller – Office of the Director of Health Care Activities or the DPO, at the contact details provided below.
Articles 15 and following of the Regulation establish your right to obtain:
confirmation that the paper and electronic archives of IRCCS ISMETT do not contain personal data that concern you, to obtain a copy on paper or electronic media, and obtain information on data processing (purposes, categories of data, recipients, period of storage etc.); the rectification and completion of the data; the erasure of the data if consent is withdrawn and there is no other legal basis for the processing; where the applicable requirements are met, a copy of the personal data in a structured format;
Should this satisfy the assumptions, data subjects have the right to file a complaint to the Italian Data Protection Authority (“Garante” (https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/4535524)) in its capacity of supervisory authority, in accordance with the current policies. A template for exercising your rights, provided by the Italian Personal Data Protection Authority (“Garante”), is available at https://www.garanteprivacy.it/i-miei-diritti.
In addition:
These rights may be exercised with a request to the DPO at: dataprotectionofficer@ismett.edu or ISMETT S.r.l. – Discesa dei Giudici 4, 90133 Palermo, Italy, or contacting the Data controller – Office of the Director of Health Care Activities at direzionesanitariaprivacy@ismett.edu.
Similarly, with regard to data processed in the context of clinical studies and research, the aforementioned rights may be exercised by contacting the Data Controller – Research Office at the address of the joint controllers, or emailing dataprotectionofficer@ismett.edu.
Joint controllers are Istituto Mediterraneo per i Trapianti e Terapie ad Alta Specializzazione (ISMETT) and UPMC Italy, both headquartered in Via Discesa dei Giudici 4, 90133 Palermo, Italy.&;
