3. november 2026

TEHIK väljastas PPA-le terviseandmeid piisava õigusliku aluseta

TEHIK issued health data to PPA without sufficient legal basis

(TEHIK) tuvastas, et politsei- ja piirivalveametile (PPA) väljastati inimese kiirabikaart . TEHIK palub eksimuse pärast vabandust ja alustab täiendavat kontrolli.

TEHIK-u direktor Margus Arm ütles, et . Ta lisas, et Eesti inimeste . TEHIK , kelle andmed ekslikult väljastati.

Viga avastati päringute ajal, mis puudutasid terviseandmete väljastamist PPA-le ja kapole. Seadus lubab terviseandmete väljastamist süüteomenetluses. TEHIK kontrollis andmete väljastamist ajavahemikul 1. jaanuarist 2025 kuni 14. oktoobrini 2026. Sel ajal väljastas TEHIK PPA-le terviseandmeid 760 päringu alusel. Vaid ühel juhul oli päring järelevalvemenetluses. Kapole andmeid ei väljastatud.

Margus Arm ütles, et see on . Ta palus vabandust ja ütles, et selliseid vigu vältida. TEHIK , et leida puudused ja veenduda, et selliseid juhtumeid rohkem ei ole.

TEHIK soovib siseauditi esindaja. See aitab saada . Arm lisas, et kõik tervishoiuasutused peaksid üle vaatama, kuidas nad terviseandmete päringuid käsitlevad. Inimeste terviseandmed peavad olema kaitstud, olenemata sellest, kes neid küsib.

Kiirabikaart väljastati PPA-le 2025. aasta septembris. Politsei küsis seda, et hinnata, kas narkojoobes olnud inimese . Järelkontrolli käigus leidsid TEHIK ja PPA, et see säte ei andnud piisavat alust terviseandmete väljastamiseks ilma nõusolekuta.

Politsei analüüsis relvaloa menetluses terviseandmete kasutamise õiguspärasust. Politsei ütles, et see päring ei kajastunud teenistuslikus kontrollis. Tegemist oli relvaloa järelkontrollis tehtud päringuga. Menetleja oleks pidanud pöörduma tervishoiuasutusse ja küsima arsti hinnangut.

Politseil on õigus relvaloa kehtivuse perioodil küsida tervishoiuasutuselt hinnangut. Pärast Lihula juhtumit hakkas politsei tegelema süsteemsema relvaomanike järelkontrolliga. Sellised olukorrad on haruldased. Kui relvaomanikul on narkootikumidega seotud juhtumid või vaimse tervise probleemid, küsib politsei arsti hinnangut. See aitab vältida olukordi, kus relvaomanikul on tervisehäire, mis võib ohtlikuks osutuda.

Seadus lubab tervise infosüsteemist inimese süüteo- või kohtumenetluses. Järelevalvemenetlus üksi sellist õigust ei anna. Riigikogus on menetluses valitsuse eelnõu, mis lubab politseil kriminaalmenetluses inimese nõusolekul terviseandmeid koguda ja kasutada. Ilma nõusolekuta oleks vaja kohtu luba.

The Center for Health and Welfare Information Systems (TEHIK) found that an emergency card was issued to the Police and Border Guard Board (PPA) without sufficient legal basis. TEHIK apologizes for the mistake and initiates additional checks.

Margus Arm, director of TEHIK, said this was an isolated error. He added that the health data of Estonian people is protected. TEHIK will also inform the person whose data was mistakenly disclosed.

The error was discovered during inquiries regarding the disclosure of health data to PPA and KaPo. The law permits the disclosure of health data in criminal proceedings. TEHIK checked data disclosures from January 1, 2025, to October 14, 2026. During this period, TEHIK issued health data to PPA based on 760 inquiries. Only in one case was the inquiry related to supervisory proceedings. No data was disclosed to KaPo.

Margus Arm stated that this is a highly regrettable incident. He apologized and said that work procedures must help prevent such errors. TEHIK will conduct an internal audit to identify shortcomings and ensure such cases do not occur again.

TEHIK plans to involve a representative from the Ministry of Social Affairs' internal audit. This will help obtain an external assessment. Arm added that all healthcare institutions should review how they process health data requests. People's health data must remain protected, regardless of who requests it.

The emergency card was issued to PPA in September 2025. The police requested it to assess whether there were restrictions on the validity of a firearm permit for a person who had been under the influence of narcotics. During a follow-up review, TEHIK and PPA found that this provision did not provide sufficient grounds for disclosing health data without consent.

The police analyzed the legality of using health data in the firearms permit process. The police said this inquiry was not reflected in the official oversight. It was an inquiry made during a firearms permit review. The processor should have contacted a healthcare institution and requested a medical assessment.

The police have the right to request medical assessments from healthcare institutions during the validity period of a firearm permit. After the Lihula incident, the police began implementing a more systematic firearms owners' monitoring system. Such situations are rare. If a firearm owner has drug-related incidents or mental health issues, the police request a medical assessment. This helps prevent situations where a firearm owner has a health condition that could pose a danger.

The law allows the disclosure of data from health information systems without personal consent in criminal or court proceedings. Supervisory proceedings alone do not grant such rights. The Riigikogu is processing a government bill that would allow the police to collect and use health data in criminal proceedings with the person's consent. Without consent, a court order would be required.