The Center for Health and Welfare Information Systems (TEHIK) said an audit of 760 health data requests to the Police and Border Guard Board (PPA) between January 2025 and October 2026 found one that was unlawful.

The disclosure comes amid wider controversy over health data access.

The error in this case surfaced through an information request about health data disclosures to the police and the Internal Security Service (KAPO) in supervisory proceedings. The law permits disclosure in criminal proceedings, not supervisory ones alone.

"This is a very regrettable case and I apologize for this mistake. Work reorganization must help in preventing such errors," said TEHIK director Margus Arm.

Arm said the TEHIK internal review would involve a representative of the Ministry of Social Affairs' internal audit, to get an assessment from outside the agency, and that all healthcare institutions should review how they handle health data requests.

The ambulance record was issued to police in September 2025. Police requested it to assess whether a person under the influence of narcotics should face restrictions on a weapons license.

Liis Valk, head of the PPA's identity and status bureau, said the request had not appeared in the police's own internal review because it was made earlier. "This was a request made in a weapons license follow-up, where the case officer should have turned to a healthcare institution and asked for a doctor's assessment," Valk said.

Valk said the PPA began a more systematic checking of gun owners after the Lihula shooting in June 2020, which saw two people killed. The shooter, who themselves passed away in prison nearly two years later, had held a valid firearms license despite serious mental health issues and being on strong medication. In cases where a firearms license holder has drug-related incidents or mental health concerns to their name, the PPA Now asks a doctor for a new assessment alongside the existing health certificate.

Under current law, the Health Services Organization Act allows health data to be released without consent for criminal or court proceedings. A supervisory proceeding alone does not provide that right. A government bill in the Riigikogu would require a court order for police to obtain health data without consent, and only where the data is essential to a criminal investigation.

The disclosure comes amid a wider fight over health data access: the Medical Association has demanded a court order requirement. Social Affairs Minister Karmen Joller (Reform) has accused doctors of breaching confidentiality themselves, and two government bills — the Joller and Pakosta drafts — appear to contradict each other on how far access should extend. Meanwhile the Chancellor of Justice has said the current provision is too broad and needs clarifying, while the Interior Ministry has separately begun publishing deceased people's personal data as open data. TEHIK is at the same time preparing a €28 million overhaul of the social insurance system.

--

Follow ERR News on Facebook and Twitter and never miss an update!