Information on data protection with regard to the cooperation laboratory - medical practice

According to the current legal assessment, both the laboratory and the medical practice are to be considered as independent controllers within the meaning of the new Federal Act on Data Protection, which came into force on 1 September 2023, for their respective fields of activity in the context of the external laboratory analytics. Both provide their specialist services free of instructions and under their own authority.

This assessment is also shared by the association FAMH The Medical Laboratories of Switzerland. In the present case, this means that both in the medical practice and in the laboratory, it must be ensured equally and independently that the respective data processings are lawful. Both are equally subject to the Federal Act on Data Protection.

The laboratories take appropriate technical and organisational measures to ensure the data security as well as the confidentiality, integrity and availability of the data. Reference is also made to the Privacy Policy.

For this reason, neither a data processing agreement nor a contract as joint controllers between the medical practice and the laboratory is necessary. Furthermore, since the laboratory is also subject to professional duty of confidentiality, the conclusion of a confidentiality agreement is also not required.

Note: This assessment only considers the classic “doctor – laboratory” constellation (i.e. doctor – analysis order – laboratory / laboratory – laboratory results – doctor). However, it is possible that the laboratory acts in the role of a processor in the case of other or additional services for medical practices (e.g. integration of the results of the practice laboratory into the results of the laboratory) or in the case of services for other service providers.