Bulgaria's e-health record system faces EU court challenge over privacy compliance

Bulgaria's rules on access to electronic health records are facing scrutiny at the Court of Justice of the European Union (CJEU) after rights lawyers challenged what they describe as excessively broad access to sensitive personal data.

The case, now before the CJEU in Luxembourg, could have significant implications for how EU member states balance digital healthcare services with privacy protections.

Background of the Case

More than two years ago, representatives of a medical centre challenged Bulgaria's rules on the storage and management of health data before the country's Supreme Administrative Court. Their lawyers, human rights advocates Mihail Ekimdzhiev and Milena Dokova, requested that the dispute be referred to the CJEU for clarification under EU law.

After lengthy proceedings, Bulgaria's Supreme Administrative Court ruled in July 2026 that there are grounds to question whether the country's framework for protecting health data—among the most sensitive categories of personal information—complies with EU standards. The court decided to submit a preliminary reference to the CJEU concerning the operation of Bulgaria's electronic health record system.

Questionable Data Protection

Under current rules, the state may collect and retain information on every medical procedure performed in the country for up to 50 years after a patient's death. The records may contain information relating to highly intimate aspects of an individual's private life.

The central concern is that the electronic system grants broad access to medical records to healthcare professionals across the system.

Five Bulgarian supreme court judges said they harbour serious doubts as to whether the existing regulatory framework meets the higher level of personal data protection required under EU law. The judges stressed that health information requires enhanced safeguards and questioned whether Bulgaria's current arrangements provide adequate protection.

In its ruling, the court noted that access to health records is granted to a wide range of actors, including insurance companies.

"There are insufficiently clear safeguards regarding the need for prior, explicit and informed consent from the individuals concerned, as well as regarding the obligation to inform them about the scope of access, the purposes of processing and who will use the data," the Bulgarian court said.

Among the questions referred to the EU court is whether patients should be asked to consent before healthcare professionals are granted access to all of their medical records. The Bulgarian judges also want clarification on whether unrestricted access to the entirety of a patient's electronic health file should be subject to additional limitations or filtering mechanisms.

A Post-Totalitarian Approach

"The case illustrates the approach of a post-totalitarian state which seeks to facilitate communication between doctors and patients, but fails to exercise sufficient care in protecting personal data," rights lawyers Mihail Ekimdzhiev and Milena Dokova, who initiated the legal challenge, told Euractiv.

According to the lawyers, the core problem lies in the collection of an exceptionally broad range of personal information that can be accessed by numerous individuals and private entities without sufficiently reliable guarantees that the data will remain secure. The records include highly sensitive information concerning medical conditions, genetic diseases and pregnancy-related procedures.

"We recognise that this health information system serves an important public interest and protects certain rights. At the same time, however, it neglects and inadequately safeguards personal data. This inability to strike a proper balance is characteristic of immature states lacking strong legal traditions and culture," they said.

The lawyers argue that access is not limited to doctors. Insurers may also obtain access, while prosecutors can gain access through procedures that are, in some cases, automatic.

"The circle of persons entitled to access this information and the procedures governing such access are not regulated with sufficient precision, despite the fact that health records belong to the most intimate sphere of an individual's private life," they said.

Cosmetic Procedures in the Spotlight

The case was brought by the owner of a clinic specialising primarily in plastic surgery and aesthetic procedures.

"When procedures such as breast and penis enlargement or labiaplasty are performed, they become part of the patient's health record. Why should so many people have access to that information?" the lawyers asked.

"It is true that complications could theoretically arise from any of these procedures and may require future medical intervention. However, there is a lack of balance, given that patients undergo such treatments with an expectation of confidentiality."