Regulations, 2022

L.N. 253 of 2022

HEALTH ACT

(CAP. 528)

Access to Data (Exemption from the Payment of Health Care Fees)

Regulations, 2022

IN EXERCISE of the powers conferred by article 30 of the

Health Act, the Minister responsible for health has made the following

regulations:-

(1) The title of these regulations is the Access to Data Citation and

(Exemption from the Payment of Health Care Fees) Regulations, 2022. scope.

(2) The scope of these regulations is to establish the legislative

basis for access to data by the Health Care Funding Directorate to

establish whether the data subject is exempt from payment of

healthcare fees.

In these regulations, unless the context otherwise requires

Interpretation.

"applicant" means a person who accesses healthcare

services;

"Directorate" means the Health Care Funding Directorate

within the Department for Policy in Health within the Ministry

for Health;

"urgent necessary care" means benefits in kind which

become necessary on medical grounds.

The functions of the Directorate shall include

Controller and

his functions.

(a) the processing of entitlement documents in

accordance with Regulation (EC) No 883/2004 of the European

Parliament and of the Council of 29 April 2004 on the

coordination of social security systems and Regulation (EC) No

987/2009 of the European Parliament and of the Council of 16

September 2009 laying down the procedure for implementing

Regulation (EC) No 883/2004 on the coordination of social

security systems;

(b) ensuring that citizens entitled for healthcare in Malta

are covered for urgent necessary care whilst on a temporary stay

in another European Union Member State;

(c) ensuring the right for planned health care in another

European Union Member State in accordance with Regulation

(EC) No 883/2004 and Implementing Regulation (EC) No 987/

2009;

(d) the implementation of Regulation (EC) No 883/2004

of the European Parliament and of the Council of 29 April 2004

on the coordination of social security systems and Regulation

(EC) No 987/2009 of the European Parliament and of the

Council of 16 September 2009 laying down the procedure for

implementing Regulation (EC) No 883/2004 on the coordination

of social security systems, including

(i) ensuring healthcare entitlement for pensioners

from a European Union Member State who transfer their

residence to Malta or citizens receiving a Maltese pension

who transfer their residence to another European Union

Member State;

(ii) reporting as required in accordance with

European Union legislation and Maltese legislation;

(iii) processing and issuing of claims for health care

services provided by Maltese public hospitals to European

Union or EEA citizens;

(e) preparation of all necessary documentation for the

provision of healthcare coverage to workers insured in Malta and

posted in another European Union Member State or European

Union workers posted in Malta;

(f) the management of queries related to entitlement of

healthcare services in other European Union Member States or in

Malta;

(g) the verification of payment claims for health care

services or health care expenses incurred outside Malta provided

by other EU or EEA Member States to citizens covered for

health care in Malta.

(1) Nothing in these regulations shall prejudice in any

way the applicability of Regulation No 2016/679 and the Data

Protection Act and the fundamental rights and freedoms of the

applicants.

(2) The Directorate, while acting in its capacity of a controller

in accordance with Article 4(7) of Regulation No 2016/679, shall

perform the relevant data processing operations that are strictly

necessary for establishing whether the applicant is entitled to an

exemption from payment of health care fees, as may be established by

law, from time to time.

(3) The personal data processed by the Directorate shall be

processed in compliance with the principles relating to processing of

personal data in accordance with Article 5 of Regulation No 2016/679.

(1) In the performance of its functions, the Directorate Personal data

shall be entitled to request and, or receive from the entities listed in the processed

other entities.

Schedule, personal data pertaining to the applicant, which is limited to

the extent needed for the purposes of these regulations, and to what is

necessary and proportionate to the objectives pursued by the

Directorate

Provided that the Minister may by regulations, after

consultation with the Information and Data Protection Commissioner,

amend the Schedule.

(2) When the personal data transferred by the entities listed in

the Schedule, includes data other than that required for the purposes of

these regulations, the Directorate shall delete this data immediately

and permanently upon receipt of said data.

(3) The personal data processed by the Directorate, including

the results obtained from the other entities, shall not be further

processed in a manner that is incompatible with the purposes of these

regulations.

(1) As a result of the processing operations undertaken Findings.

by the Directorate for the purposes of these regulations, the Directorate

shall communicate the findings as to whether the applicant is entitled

to an exemption from payment from healthcare fees, or otherwise, to

the healthcare service provider or the applicant, as the case may be.

(2) The Directorate shall not retain the findings as to whether

the applicant is entitled to an exemption from payment from healthcare

fees or otherwise.

The Directorate shall take into account the nature, Appropriate

(1)

scope, context and purposes of processing as well as the risks of safeguards.

varying likelihood and severity for the rights and freedoms of the

concerned applicants, both at the time of the determination of the

means for processing and at the time of the processing itself, and it

shall implement appropriate technical and organisational measures, in

an effective manner and to integrate the necessary safeguards into the

processing, and this in order to protect the rights of the concerned

individuals and to ensure a level of security appropriate to the risk.

(2) The data protection officer appointed by the Directorate in

accordance with Article 37 of Regulation No 2016/679 shall be

involved and consulted in a timely manner on all issues in relation to

the protection of personal data processed for the purposes of these

regulations.

(3) For the purpose of ensuring and to be able to demonstrate

that the processing of data is performed in accordance with Regulation

No 2016/679, the Directorate shall implement the appropriate data

protection policies, which policies shall be periodically reviewed and

updated where necessary.

In respect of all processing of personal data in accordance

with these regulations, every applicant shall have the right of access,

rectification, erasure and restriction, including the right to file a

complaint with the Information and Data Protection Commissioner,

the right to compensation and judicial action as laid down in the Data

Protection Act and Regulation No 2016/679.

Schedule

(Regulation 5)

1. Jobsplus

2. Identity Malta Agency

3. International Protection Agency

€0.36