Why Healthcare and Government Have Special Rules

In clinics, practices, health insurance funds, public authorities, and public offices, highly sensitive information is regularly exchanged over the phone: diagnoses, social security data, status of procedures, personal emergencies. Anyone who records such conversations operates in a doubly regulated space — GDPR data protection and the criminally protected professional and official secrecy. The general rules on call recording continue to apply here, but are supplemented by stricter requirements.

Art. 9 GDPR: Special Categories and Explicit Consent

Health data belongs to the special categories of personal data under Art. 9 GDPR. Its processing is generally prohibited and only permitted under narrow exceptions. For a pure service or quality recording in healthcare, explicit consent (Art. 9 para. 2 lit. a GDPR) is generally the only option for patients. "Explicit" means: the consent must recognizably refer to the sensitive data. A general "I agree to data processing" is not sufficient — the specific data category (e.g., health data) and the purpose must be specified.

Section 203 of the German Criminal Code (StGB): Professional and Official Secrecy

In addition to data protection, criminal law applies: Section 203 of the German Criminal Code (StGB) protects secrets entrusted to professional secrecy holders — doctors, psychologists, members of other healthcare professions, but also public officials. The scope of protection is very broad: even the fact that someone has contacted such an office can belong to the protected secret. Unauthorized disclosure — including through a recording made accessible to third parties — is a punishable offense. For recordings in this environment, this means: you need a solid legal basis, strictly limited access, and you must not disclose the secret to unauthorized parties.

Public Authorities: Documentation Duty Meets Confidentiality

For public authorities and bodies, two requirements often clash: the obligation to document processes transparently and the protection of citizens' confidential information. Recordings can serve to preserve evidence and ensure quality, but are subject to the same principles as any processing: a clear legal basis (consent or statutory/sovereign task), transparency, purpose limitation, and tight access control. Where social or health data is affected, Art. 9 GDPR and area-specific regulations also apply.

Employee Consent and Co-determination

As with any call recording, Section 201 of the German Criminal Code (StGB) also protects the voices of employees. Therefore, in addition to the consent of the callers, the consent of the employees is required, and in Germany, the works council or staff council co-determination must be respected. Particularly in the public service and healthcare sectors, the early involvement of the staff representation is crucial.

Retention, Deletion, and Access Protection

Even with a valid legal basis, purpose limitation and storage limitation apply: recordings may only be kept for as long as required by the respective purpose or a statutory retention period, and must be deleted thereafter. Because of the sensitivity, particularly strict technical and organizational measures are required: encryption, audit-proof storage, tightly restricted and logged access on a need-to-know basis, and the reliable fulfillment of information and deletion requests.

Implementation in Practice

For legally compliant operations, a clear process is recommended: first, determine the legal basis for each use case and properly obtain explicit consent for sensitive data. Then, strictly limit and log access, store the recording in an encrypted and audit-proof manner, automate retention periods, and transparently involve employees, works councils, and data subjects. This keeps confidentiality, accountability, and service quality compatible.

How onsoft Supports You

onsoft provides legally compliant call and screen recording for sensitive environments with encrypted, audit-proof storage, granular, logged access, automated retention periods, and targeted recovery. Consent and announcement processes can be mapped cleanly, access documented gaplessly, and deletion periods enforced — so that data protection verification, professional secrecy, and service quality come together in one system.

Frequently Asked Questions (FAQ)

Are call recordings allowed in healthcare?

Yes, but only with a solid legal basis. Since health data falls under special categories under Art. 9 GDPR, explicit consent that specifies the data category and purpose is generally required from patients.

What does "explicit" consent under Art. 9 GDPR mean?

The consent must recognizably refer to the sensitive data. A general "I agree" is not enough — the specific data category (e.g., health data) and the purpose of processing must be specified.

How does Section 203 of the German Criminal Code (StGB) affect recordings?

Section 203 StGB protects secrets entrusted to professional secrecy holders and public officials very extensively. Recordings must not disclose the secret to unauthorized parties; a legal basis, strictly limited access, and confidentiality are required.

Do the same rules apply to public authorities?

Public authorities must reconcile documentation obligations with confidentiality. The same GDPR principles apply; in the case of social or health data, Art. 9 GDPR and area-specific regulations also come into play.

How long can such recordings be stored?

Only for as long as required by the purpose or a statutory retention period. After that, they must be deleted; due to the sensitivity, encryption, logged access, and automated deletion periods are particularly important.