Health data is special-category personal data under the GDPR – the most protected kind. Good news: a well-built group health insurance programme works without the employer ever needing to handle such data. Here is the setup.
What does the employer handle?
The company needs administrative data: who is insured, on which tier, from when. Master data suffices (name, date of birth, employment status) – health data is not needed and must not flow to the company. There is no health declaration at entry, so the question does not even arise.
What do the insurer and coordinator handle?
Everything related to care – complaints, examinations, results – stays between the colleague, the care coordinator, the clinic and the insurer, on their own legal bases. The employer sees none of it and may not ask: neither who saw a doctor and when, nor why.
The red lines in practice
- Participation statistics: the aggregate „how many used it" may be requested – „who used it" may not.
- Screening campaigns: participation can be organised; results are strictly private.
- HR should never collect medical justifications for package use – attendance matters belong to labour law, not to the benefit.
What should the company do for good order?
The privacy notice should reflect the data transfer that comes with the benefit (master data to the insurer, on contract-preparation and performance grounds); the roster-change process should be documented; and data should go directly to the insurer – no detours, no side spreadsheets. That is how our monthly routine is built: we provide the template, data travels straight from HR to the insurer.
Informational content, not legal advice – have your data-protection documents reviewed by a specialist.
A question about your own team? Book a free 20-minute consultation →
