[Durgical](https://durgical.com/en/) › [DurgiPedia](https://durgical.com/en/durgipedia/) › [Medical ethics](https://durgical.com/en/medical-ethics/) › [Confidentiality and truth-telling](https://durgical.com/en/medical-ethics/areas/communication/) › Privacy and habeas data in health # Privacy and habeas data in health - Principle Privacy protects the patient's body, information and decisions; in Colombia it is guaranteed by the Constitution (art. 15) and Law 1581 of 2012. Updated Nov 13, 2026 ## Key points - Privacy: the right to control access to oneself. Confidentiality: the duty not to disclose what was entrusted. - Three forms: physical privacy (the body), informational privacy (data) and decisional privacy (personal decisions). - Constitution, art. 15: personal and family privacy, good name and habeas data. - Law 1581 of 2012, art. 5: health data are sensitive data; processing them is forbidden except for the exceptions in art. 6. - Law 1581, art. 10: no authorisation is needed in a medical or public health emergency. - Access to the record: only those involved in care, and only what they need for it. ## What it is Privacy is the right to control who has access to oneself: to one's body, personal information and own decisions. Confidentiality is narrower: it is the duty of whoever received information not to disclose it. Privacy can be violated without breaking a secret, for example by examining a patient with the curtain open or looking at their record without need. In Colombia, article 15 of the Constitution recognises the right to personal and family privacy and habeas data: the right to know, update and correct what has been collected about one in databases. Statutory Law 1581 of 2012 develops habeas data and classes health data as sensitive. The «Law 1581 of 2012» page details that law; this one explains the principle and how it is lived in the clinic. ## What it requires - Physical privacy: expose only what is necessary during the examination, offer a chaperone, ask permission before touching and respect modesty. - Informational privacy: collect only the data needed for the stated purpose, keep them secure and share them only with those who need them (Law 1581, art. 4: purpose, restricted access and circulation, security and confidentiality). - Decisional privacy: decisions about reproduction, sexuality or the end of life belong to the patient's own sphere. - Habeas data: the patient may know, update and correct their data, ask for proof of their authorisation and revoke it (Law 1581, art. 8). - Authorisation: prior, express and informed (Law 1581, arts. 4 and 9); for sensitive data it must be explicit (art. 6). ## In clinical practice - Discussing a patient's case in the lift or the corridor exposes their information even if no name is said. - Opening the record of a relative, a colleague or an acquaintance without taking part in their care violates their privacy, even if the system allows it. - Taking clinical photos requires authorisation and a clear purpose; sending them by personal messaging or social media is processing sensitive data without authorisation. - In teaching, the patient may refuse to have students present during an intimate examination. - Ward rounds in shared rooms: lower the voice and give sensitive news in a private space. ## Limits and exceptions - Law 1581 of 2012, art. 6: sensitive data may be processed with explicit authorisation, to safeguard the vital interest of an incapacitated holder, to defend a right in legal proceedings, or for historical, statistical or scientific purposes with identities removed. - Law 1581, art. 10: no authorisation is needed for a court order or a request by a public body exercising its functions, in medical or public health emergencies, and for purposes authorised by law. - Law 23 of 1981, art. 34: the medical record is a private document subject to confidentiality; third parties see it only with the patient's authorisation or in the cases set by law. - Law 1751 of 2015, art. 10, items j and k: care with respect for privacy, and confidentiality of health information, except access by relatives or authorities as the law allows. - Constitution, art. 15: in 2003 a constitutional amendment added a clause allowing interception of communications without a court order; the Constitutional Court struck it down (Ruling C-816 of 2004). - Official texts checked on 2026-11-13 at funcionpublica.gov.co (Constitution, Law 1581 of 2012, Law 23 of 1981 and Law 1751 of 2015). ## Test yourself Think of the answer, then tap the question to see it. ## How do privacy and confidentiality differ? Privacy is the patient's right to control access to their body, data and decisions; confidentiality is the duty of whoever received the information not to disclose it. ## Which article of the Colombian Constitution enshrines habeas data, and what does it allow? Art. 15: to know, update and correct the information collected about a person in databanks and in the files of public and private entities. ## How does Law 1581 of 2012 class health data? As sensitive data (art. 5); processing them is forbidden except for the exceptions in art. 6, such as the holder's explicit authorisation. ## Does a doctor violate privacy by opening the record of a hospitalised colleague they are not treating? Yes. Only those involved in care access the record, and only what they need; the record is a confidential document (Law 23 of 1981, art. 34). [Add to my cards (4)](https://durgical.app/estudiar/?add=/en/medical-ethics/privacy-and-habeas-data-in-health/) ## Connections ## Related 6 - [Professional secrecy and confidentiality](https://durgical.com/en/medical-ethics/professional-secrecy-and-confidentiality/) - [Ley 1581 de 2012: personal data in health](https://durgical.com/en/medical-ethics/ley-1581-de-2012-personal-data-in-health/) - [The limits of confidentiality: duty to warn and legal disclosure](https://durgical.com/en/medical-ethics/the-limits-of-confidentiality-duty-to-warn-and-legal-disclosure/) - [Resolución 1995 de 1999: the medical record](https://durgical.com/en/medical-ethics/resolucion-1995-de-1999-the-medical-record/) - [The electronic health record: Ley 2015 de 2020](https://durgical.com/en/medical-ethics/the-electronic-health-record-ley-2015-de-2020/) - [Genetic information: testing, confidentiality and relatives](https://durgical.com/en/medical-ethics/genetic-information-testing-confidentiality-and-relatives/) [← All of medical ethics](https://durgical.com/en/medical-ethics/) Educational content on ethics and health law; not legal advice. Laws and case law change: each page links the official text and says when it was last checked. For a real case, read the text in force and ask a lawyer or the medical ethics tribunal. Sources: [Constitución Política de Colombia de 1991, art. 15](https://www.funcionpublica.gov.co/eva/gestornormativo/norma.php?i=4125) (Función Pública, Gestor Normativo, 1991); [Ley Estatutaria 1581 de 2012, por la cual se dictan disposiciones generales para la protección de datos personales](https://www.funcionpublica.gov.co/eva/gestornormativo/norma.php?i=49981) (Función Pública, Gestor Normativo, 2012); [Ley 23 de 1981, por la cual se dictan normas en materia de ética médica](https://www.funcionpublica.gov.co/eva/gestornormativo/norma.php?i=68760) (Función Pública, Gestor Normativo, 1981); [Ley Estatutaria 1751 de 2015, que regula el derecho fundamental a la salud](https://www.funcionpublica.gov.co/eva/gestornormativo/norma.php?i=60733) (Función Pública, Gestor Normativo, 2015); [WMA Declaration of Lisbon on the Rights of the Patient](https://www.wma.net/policies-post/wma-declaration-of-lisbon-on-the-rights-of-the-patient/) (World Medical Association, 2015). ## **Spotted a mistake?** We are always improving for the community. Tell us what is wrong and our team will review it. Report a mistake Representative model, for educational purposes only. --- Source: https://durgical.com/en/medical-ethics/privacy-and-habeas-data-in-health/ License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Cite as: DurgiPedia (durgical.com), https://durgical.com/en/medical-ethics/privacy-and-habeas-data-in-health/