ACCESS TO DATA (EXEMPTION FROM THE PAYMENT OF HEALTH CARE FEES) REGULATIONS

OF HEALTH CARE FEES)

SUBSIDIARY LEGISLATION 528.11

ACCESS TO DATA (EXEMPTION FROM THE

PAYMENT OF HEALTH CARE FEES) REGULATIONS

14th October, 2022

LEGAL NOTICE 253 of 2022.

(1)

The title of these regulations is the Access to Data

(Exemption from the Payment of Health Care Fees) Regulations.

(2)

The scope of these regulations is to establish the

legislative basis for access to data by the Health Care Funding

Directorate to establish whether the data subject is exempt from

payment of healthcare fees.

In these regulations, unless the context otherwise

requires

"applicant" means a person who accesses healthcare

services;

"Directorate" means the Health Care Funding Directorate

within the Department for Policy in Health within the Ministry

for Health;

"urgent necessary care" means benefits in kind which

become necessary on medical grounds.

The functions of the Directorate shall include

(a)

the processing of entitlement documents in

accordance with Regulation (EC) No 883/2004 of the European

Parliament and of the Council of 29 April 2004 on the

coordination of social security systems and Regulation (EC) No

987/2009 of the European Parliament and of the Council of 16

September 2009 laying down the procedure for implementing

Regulation (EC) No 883/2004 on the coordination of social

security systems;

(b)

ensuring that citizens entitled for healthcare in

Malta are covered for urgent necessary care whilst on a

temporary stay in another European Union Member State;

(c)

ensuring the right for planned health care in

another European Union Member State in accordance with

Regulation (EC) No 883/2004 and Implementing Regulation

(EC) No 987/2009;

(d)

the implementation of Regulation (EC) No 883/

2004 of the European Parliament and of the Council of 29 April

OF HEALTH CARE FEES)

2004 on the coordination of social security systems and

Regulation (EC) No 987/2009 of the European Parliament and

of the Council of 16 September 2009 laying down the procedure

for implementing Regulation (EC) No 883/2004 on the

coordination of social security systems, including

(i)

ensuring

healthcare

entitlement

for

pensioners from a European Union Member State who

transfer their residence to Malta or citizens receiving a

Maltese pension who transfer their residence to another

European Union Member State;

(ii)

reporting as required in accordance with

European Union legislation and Maltese legislation;

(iii) processing and issuing of claims for health

care services provided by Maltese public hospitals to

European Union or EEA citizens;

(e)

preparation of all necessary documentation for the

provision of healthcare coverage to workers insured in Malta

and posted in another European Union Member State or

European Union workers posted in Malta;

(f)

the management of queries related to entitlement

of healthcare services in other European Union Member States

or in Malta;

(g) the verification of payment claims for health care

services or health care expenses incurred outside Malta provided

by other EU or EEA Member States to citizens covered for

health care in Malta.

(1)

Nothing in these regulations shall prejudice in any

way the applicability of Regulation No 2016/679 and the Data

Protection Act and the fundamental rights and freedoms of the

applicants.

(2)

The Directorate, while acting in its capacity of a

controller in accordance with Article 4(7) of Regulation No 2016/679,

shall perform the relevant data processing operations that are strictly

necessary for establishing whether the applicant is entitled to an

exemption from payment of health care fees, as may be established by

law, from time to time.

(3)

The personal data processed by the Directorate shall be

processed in compliance with the principles relating to processing of

personal data in accordance with Article 5 of Regulation No 2016/679.

OF HEALTH CARE FEES)

(1)

In the performance of its functions, the

Directorate shall be entitled to request and, or receive from the entities

listed in the Schedule, personal data pertaining to the applicant, which

is limited to the extent needed for the purposes of these regulations,

and to what is necessary and proportionate to the objectives pursued

by the Directorate

Provided that the Minister may by regulations, after

consultation with the Information and Data Protection Commissioner,

amend the Schedule.

(2)

When the personal data transferred by the entities listed

in the Schedule, includes data other than that required for the purposes

of these regulations, the Directorate shall delete this data immediately

and permanently upon receipt of said data.

(3)

The personal data processed by the Directorate,

including the results obtained from the other entities, shall not be

further processed in a manner that is incompatible with the purposes of

these regulations.

(1)

As a result of the processing operations

undertaken by the Directorate for the purposes of these regulations, the

Directorate shall communicate the findings as to whether the applicant

is entitled to an exemption from payment from healthcare fees, or

otherwise, to the healthcare service provider or the applicant, as the

case may be.

(2)

The Directorate shall not retain the findings as to

whether the applicant is entitled to an exemption from payment from

healthcare fees or otherwise.

(1)

The Directorate shall take into account the nature,

scope, context and purposes of processing as well as the risks of

varying likelihood and severity for the rights and freedoms of the

concerned applicants, both at the time of the determination of the

means for processing and at the time of the processing itself, and it

shall implement appropriate technical and organisational measures, in

an effective manner and to integrate the necessary safeguards into the

processing, and this in order to protect the rights of the concerned

individuals and to ensure a level of security appropriate to the risk.

(2)

The data protection officer appointed by the Directorate

in accordance with Article 37 of Regulation No 2016/679 shall be

involved and consulted in a timely manner on all issues in relation to

the protection of personal data processed for the purposes of these

regulations.

(3)

For the purpose of ensuring and to be able to demonstrate

that the processing of data is performed in accordance with Regulation

No 2016/679, the Directorate shall implement the appropriate data

OF HEALTH CARE FEES)

protection policies, which policies shall be periodically reviewed and

updated where necessary.

In respect of all processing of personal data in accordance

with these regulations, every applicant shall have the right of access,

rectification, erasure and restriction, including the right to file a

complaint with the Information and Data Protection Commissioner, the

right to compensation and judicial action as laid down in the Data

Protection Act and Regulation No 2016/679.

Schedule

(Regulation 5)

1. Jobsplus

2. Identity Malta Agency

3. International Protection Agency