Vertraulichkeit der Kundendaten

Vertraulichkeit der Kundendaten is the duty to keep what a pharmacy learns about a person inside the pharmacy. It is older than data protection law and in some ways stricter, because the pharmaceutical Schweigepflicht is a professional secret protected by criminal law and binds everyone on the premises, the trainee and the delivery driver included. Health data is also the most sensitive category the DSGVO recognises, and a blood draw or a measurement produces precisely that.

The secret is wider than the result, because all of the following belong to it as well:

• That a person made an appointment at all is part of the secret.
• The reason the person gave for that appointment is covered too.
• The answers written on the Anamnese form stay inside the pharmacy.
• A sample tube with a name on it belongs to the secret.
• A note in the appointment diary counts in the same way.

Agreeing to the service is not agreeing to circulation, so the Aufklärung und Einwilligung conversation is where the pharmacy says plainly who will see what.

Inside the pharmacy, access follows need. The person carrying out the service and the pharmacist responsible for it need the record, whereas colleagues who are curious or who merely share the counter do not, and the folder does not circulate through the back room. Workstations are locked when they are left, appointment lists are turned face down instead of being displayed, and the names of the day are not readable by the next person in the queue.

Handover has its own rules inside the pharmacy:

• A result is discussed where it cannot be overheard, which in practice means the Beratungsraum instead of the counter.
• It goes to the person it concerns, in a closed envelope if it leaves the room.
• A spouse, an adult child or a driver receives it only where that person has said so.
• On the telephone a voice cannot be verified, so the workable practice is a callback to a number the person gave.
• No result goes to whoever happens to answer, and an answering machine gets nothing beyond a request to call back.
• A result never waits on the counter for collection and is never carried in a bag with a name on the outside.

The failures here are rarely dramatic, because they are a printout left face up, a name spoken across the shop, or a report handed to the second customer of that surname. The consequence is a complaint to the supervisory authority, a question of Haftung and, more immediately, a customer who does not return and explains why to others.

Storage is governed separately and set out under Aufbewahrungsfristen, but the working principle is short, because nothing is kept longer than it is needed and nothing is kept where it can be read in passing.