The Center for Health and Welfare Information Systems (TEHIK) found that an emergency card was issued to the Police and Border Guard Board (PPA) without sufficient legal basis. TEHIK apologizes for the mistake and initiates additional checks.
Margus Arm, director of TEHIK, said this was an isolated error. He added that the health data of Estonian people is protected. TEHIK will also inform the person whose data was mistakenly disclosed.
The error was discovered during inquiries regarding the disclosure of health data to PPA and KaPo. The law permits the disclosure of health data in criminal proceedings. TEHIK checked data disclosures from January 1, 2025, to October 14, 2026. During this period, TEHIK issued health data to PPA based on 760 inquiries. Only in one case was the inquiry related to supervisory proceedings. No data was disclosed to KaPo.
Margus Arm stated that this is a highly regrettable incident. He apologized and said that work procedures must help prevent such errors. TEHIK will conduct an internal audit to identify shortcomings and ensure such cases do not occur again.
TEHIK plans to involve a representative from the Ministry of Social Affairs' internal audit. This will help obtain an external assessment. Arm added that all healthcare institutions should review how they process health data requests. People's health data must remain protected, regardless of who requests it.
The emergency card was issued to PPA in September 2025. The police requested it to assess whether there were restrictions on the validity of a firearm permit for a person who had been under the influence of narcotics. During a follow-up review, TEHIK and PPA found that this provision did not provide sufficient grounds for disclosing health data without consent.
The police analyzed the legality of using health data in the firearms permit process. The police said this inquiry was not reflected in the official oversight. It was an inquiry made during a firearms permit review. The processor should have contacted a healthcare institution and requested a medical assessment.
The police have the right to request medical assessments from healthcare institutions during the validity period of a firearm permit. After the Lihula incident, the police began implementing a more systematic firearms owners' monitoring system. Such situations are rare. If a firearm owner has drug-related incidents or mental health issues, the police request a medical assessment. This helps prevent situations where a firearm owner has a health condition that could pose a danger.
The law allows the disclosure of data from health information systems without personal consent in criminal or court proceedings. Supervisory proceedings alone do not grant such rights. The Riigikogu is processing a government bill that would allow the police to collect and use health data in criminal proceedings with the person's consent. Without consent, a court order would be required.