Patient confidentiality disclosed: criminal liability under section 121 StGB

Section 121 StGB is headed violation of professional secrets. The basic offence concerns a secret about a person's health. The information must have been entrusted or become accessible solely because of the person's profession. Private knowledge, a rumour or a generally known fact therefore does not automatically qualify.

The protected access may arise from professional work in a regulated health profession. The provision also covers specified administrative work in a hospital or another health service provider and tasks in health, accident, life or social insurance. The exact professional function must be identified in each case.

The disclosure or use must be capable of harming a legitimate interest of the person who used the service or for whom it was used. The label patient confidentiality is therefore only the starting point. The content, recipients and possible consequences of the conduct form part of the assessment.

A sound assessment brings together four points: the health connection of the information, the professional situation in which it was obtained, the specific conduct and the possible harm to a legitimate interest. If one link is missing, the allegation may have to be classified differently. A data protection breach is therefore not automatically an offence under section 121 StGB.

The data must concern a person's health. This may include findings, diagnoses, treatment, medication or information about a medical consultation. Whether a single detail has the required secret character depends on the context and what the recipient could understand from it. The content must be examined in its setting.

The professional access must also be established. A person who learned the information privately or outside the protected activity does not fall under section 121 merely because the information is medical. Conversely, the provision may cover someone who did not provide treatment if the person performed one of the specified administrative or insurance tasks.

Section 121 StGB and refusal rights under the StPO serve different purposes. Section 121 StGB addresses criminal responsibility for disclosing or using a health secret. Sections 156 and 157 StPO address when a person summoned as a witness is exempt from giving evidence or may refuse to answer particular questions.

Section 157(1) numbers 2 to 5 StPO lists specific professional groups and professional secrecy areas. They include lawyers, defence counsel, notaries, accountants, certain psychosocial professions, media workers and legally secret voting. It does not follow that every person working in health care has a general right to refuse testimony.

A person who receives a summons should therefore assess the professional role, the exact question and the source of the information separately. Patient confidentiality may restrict disclosure. Whether the witness may refuse the particular question also depends on the applicable StPO provision and the circumstances of the examination.

Section 121(1) StGB names two forms of conduct: disclosing and using. Disclosure makes the secret accessible to another person. Use means using the secret for a purpose of one's own or another person. The classification depends on the flow of data and what was done with the information.

The transfer may take place orally, in writing, electronically or through access to a system. A small detail can reveal a person's health when combined with other information. Preserve the wording, recipients, time, data scope and technical method of transmission for the assessment.

Section 121(1a) StGB also covers unlawfully demanding that a person disclose, allow inspection of or permit the use of health secrets. The demand must be made with the intention of harming or endangering that person's or another person's employment or professional progress if they refuse. This provision therefore addresses pressure to reveal the information.

Section 121(3) StGB separately covers an expert appointed by a court or another authority for specific proceedings who discloses or uses a secret. The information must have been entrusted or made accessible solely through the expert activity and the disclosure must be capable of harming a legitimate interest.

The assignment defines the evidentiary purpose. It does not remove the need to examine the precise data scope. An expert should distinguish information needed to answer the question from additional details found in the file. A finding that is unnecessary for the report cannot simply be shared without further examination.

Section 121(4) treats assistants and people participating in the activity for training purposes in the same way as the persons covered by subsections (1) and (3). Their exact task, access permission and onward disclosure should be recorded. Internal sharing is therefore not automatically without consequence.

Section 121(5) StGB provides that the offender is not punished where the disclosure or use was justified in its content and form by a public or legitimate private interest. Both parts matter. A valid reason does not necessarily justify the method or the amount of data transmitted.

The review should address the purpose, necessary data, recipients and whether a less intrusive method was available. A report to a competent authority may have to be assessed differently from disclosure to a wider group. Consent or an instruction must also be examined for its exact content, period and scope.

The justification should be recorded when the disclosure takes place. Preserve the reason, the information available at the time, the weighing of interests and the choice of transmission method. General explanations added later provide only a limited substitute for that factual basis.

The basic offence under section 121(1) StGB carries up to two years' imprisonment. Section 121(2) applies where the act was committed to obtain a financial advantage for the offender or another person or to cause a disadvantage to another person. The maximum penalty in that case is up to three years. The mental purpose is therefore a separate issue.

Section 121(6) StGB provides that the offender is prosecuted only with the authorisation of the person whose interest in secrecy was harmed in the cases covered by subsections (1) and (3). This concerns prosecution. It does not answer whether the disclosure was lawful or replace the assessment of the elements and any justification.

A criminal allegation should be set out in sequence: the person concerned, professional access, data, conduct and recipient. Only then can intent, justification and authorisation be assessed reliably. Isolated screenshots or a single message often do not show the complete course of events.

Preserve the original request, the data transferred and communications with every recipient. Record when the information became known, what professional role existed and whether there was consent, a legal duty or an order. Any change to the data should remain traceable.

For an official request, record the legal basis, period, requested data and responsible authority. For a completed disclosure, focus on recipients, transmission method and possible purpose. For an expert, also preserve the appointment, evidentiary question and report versions.

The assessment should distinguish section 121 StGB, data protection, professional confidentiality and refusal rights under the StPO. These areas may overlap, but their requirements and consequences differ. An organised record allows defence counsel to classify the allegation more reliably.