Patient in Teaching – Guidelines for Students

High-quality and constructively aligned teaching considers the legislation and guidelines pertaining to the use of patient data containing personal data (Act on Secondary Use of Health and Social Data 552/2019, Act on the Status and Rights of Patients 785/1992, Decree of the Ministry of Social Affairs and Health on Patient Documents 298/2009, Personal Data Act 1050/2018, and General Data Protection Regulation GDPR of the EU). Personal data pertaining to health constitute a special category of sensitive personal data.

In the teaching provided by the Faculty of Medicine, a patient’s data can be utilised with their consent according to paragraph 2, section 13 of the Act on the Status and Rights of Patients and a data permit as referred to in the Act on Secondary Use of Health and Social Data.

Identifying information (direct identifiers, such as names and personal identity codes, or strong indirect identifiers, such as rare professional titles or diseases) must be redacted from teaching materials at healthcare organisations before making the material available for teaching or an element of teaching material production.  In teaching, data can include identifiers if the teaching cannot be implemented with anonymised information because of the rarity of the case, the nature of teaching or other similar reasons. 

Teaching material can be utilised in all environments where teaching or training is implemented or provided (contact teaching, remote teaching, online teaching, independent reading, etc.).  Such use requires a data permit from the relevant care organisation. For using HUS patient data in teaching, data permits are requested by a designated coordinator in the degree programme or a person authorised by them (Appendix 2 Producing teaching material at HUS, in Finnish only).   

The guidelines on using patient data in teaching apply to all Faculty teachers, regardless of their job title. The guidelines comply with the national guidelines for medical education (Findata data permits for using personal data for the production and use of teaching material, THL/3379 /14.02/2020, in Finnish only). In addition, teachers must comply with the guidelines of the relevant care unit (Appendix 2 Producing teaching material at HUS). 

All Faculty students are required to sign a non-disclosure and information security pledge. The pledge is based on the Act on the Openness of Government Activities (621/1999, section 23 on non-disclosure obligation and prohibition of use) and the Act on the Status and Rights of Patients (785/1992, sections 13 and 14 on confidentiality and secrecy). Requests for investigation of suspected breaches of the secrecy obligation are submitted to the police, and such matters can also be assessed in disciplinary proceedings in accordance with section 45 of the Universities Act (558/2009). 

The Faculty’s goal is to implement the signing of the confidentiality and information security pledge through the Sisu system in the early stages of studies.

Teaching situations

The general principle is that students are under a secrecy obligation whenever patient data are used in teaching. Patients must always be referred to in a respectful manner. No attempts must be made to identify the patients in the teaching material.  

Teaching material must not be distributed, stored or recorded in any way if it contains material related to patients, unless the patient has given a separate consent for this (rules for remote teaching published by the MediPeda team, in Finnish only). Students always log in to remote teaching sessions under their own name. If the teaching material for remote teaching includes material related to patients, students accessing such material must ensure that the physical space in which they do so is one where confidential information cannot be passed on to outsiders. Also in the case of groupwork, students must ensure that outsiders cannot observe the groupwork or other related discussions. 

Content produced by students utilising patient data

All processing of patient data (e.g., video recording or other documentation) is carried out in accordance with valid legislation and the guidelines of the relevant care unit. The basic rule is that students do not record direct personal identifiers in their documents (e.g., patient records, case reports and research material drawn up by students). The IT equipment of the care organisation (e.g., HUS computers) are used to record personal data, unless another procedure has been agreed with the separate consent of the patient (Appendix 2 Producing teaching material at HUS). Under no circumstances must electronic material be stored on personal computers or cloud services. Students must consider whether the recording of personal data is necessary (the necessity of indicating, for example, place of treatment, exact age, gender, professional group or specific profession). 

Students are responsible for ensuring that they process patient data appropriately and that the material does not fall into the hands of external parties. Students must destroy or return any teaching material containing personal data in a secure manner so that the patient data remain secret for the duration of the transfer (in accordance with the guidelines of the care organisation) and erase the data. In situations where a separate permit for a video or similar recording related to the teaching situation has been requested from the patient, the data environment in which the patient data can be processed must be determined separately (Appendix 1 University of Helsinki information security rules). Students must ensure that the material is appropriately disposed of when it is no longer needed. Printed material must be shredded into a confidential waste bin. Electronic material must be securely erased. 

Social media and free time

Students are responsible for ensuring that they do not disseminate patient data or other confidential matters on social media or otherwise in their free time. When taking photos, you must ensure that no secret documents are visible in the background. Patient cases must not be discussed with outsiders or in public. For example, hospital corridors, lobbies and break rooms are considered public spaces. 

Suggested reading:

• Social media guidelines of the Finnish Medical Association (in Finnish only)
• Professional ethics principles of the Finnish Psychological Association (in Finnish only)
• Professional ethics principles of the Finnish Association of Speech Therapists (in Finnish and Swedish only)
• Ethics guidelines of the Finnish Dental Association (in Finnish only)

Teachers and students are obliged to report any potential information security issues they encounter.

Students report such issues to the course coordinator.

Teachers submit their reports to the degree programme director or the University’s IT Helpdesk. IT Helpdesk instructions on Flamma.