Patient data breaches rising sharply, Finnish watchdog reports

The number of reported cases involving unauthorized access to patient records in Finland continues to climb, according to the Office of the Data Protection Ombudsman.

Deputy Data Protection Ombudsman Anniina Hautala told Yle that while the office lacks precise statistics, it receives “at least dozens” of such cases annually from the social and healthcare sector. She noted the increase may reflect improved detection rather than a surge in violations.

Two-thirds of the criminal investigation requests submitted to the ombudsman’s office are believed to involve unauthorized data access, though the exact share tied to healthcare remains unclear.

A recent case highlighted the issue: a young woman’s doctor accessed her medical records without authorization and exploited the information. The woman filed a police report years later, but the investigation in Sweden—where part of the offense occurred—was dropped because the Finnish violation had already exceeded the two-year statute of limitations.

Legal experts criticize the short timeframe. “Two years is clearly too brief for processing these cases, given how long police investigations and prosecution decisions take,” said Tomi Voutilainen, a public law professor at the University of Eastern Finland.

Voutilainen also called for automated monitoring in patient record systems to flag suspicious access attempts, ensuring faster intervention by administrators or data protection officers.