Key points at a glance
- Health data is sensitive personal data (Art. 5 let. c FADP).
- The insurer may process data only to the extent that it needs it for its tasks under the Federal Health Insurance Act (KVG), such as premiums, benefits or risk equalisation (Art. 84 KVG).
- Personal data is passed on to third parties, including the insurer’s own supplementary insurance, only with a legal basis or with your written consent in the individual case (Art. 84a para. 5 KVG).
- You can ask your doctor to give medical information only to the insurer’s medical adviser (Art. 42 para. 5 KVG).
- You receive information about your data free of charge within 30 days (Art. 25 FADP, Art. 18 DPO).
What does data protection at your health insurer mean?
Data protection at your health insurer covers all the rules that determine what data an insurer may collect about you, what it may use it for and to whom it may pass it on. Insurers process particularly sensitive information: diagnoses, treatments, medicines and hospital stays, but also income in connection with premium subsidies. Under the Federal Act on Data Protection (FADP), health data is sensitive personal data.
The distinction between basic health insurance and supplementary insurance is decisive:
- Basic health insurance (KVG): the insurer performs a public task of the Confederation. It is subject to the data protection rules of the KVG, the duty of confidentiality of social insurance law and the FADP rules for federal bodies. It may process only what it needs for its tasks under the KVG.
- Supplementary insurance (ICA): here the insurer acts as a private insurance company. The Insurance Contract Act (ICA) and the FADP rules for private persons apply. Before concluding a contract, the insurer may ask health questions and use your answers to decide whether to accept you.
Even if both types of insurance are with the same group of insurers, they are legally separate areas. Data from basic health insurance may not simply flow into supplementary insurance.
Your insurer’s data protection must not be confused with the electronic patient record (EPR). The EPR is a collection of your health documents. There you grant access rights to health professionals, i.e. doctors, hospitals or pharmacies (Art. 9 EPDG), not to your insurer.
How it works
What data the insurer may process: the KVG lists the purposes exhaustively, including: checking compliance with the requirement to take out insurance, calculating and collecting premiums, assessing entitlement to benefits and calculating benefits, implementing premium subsidies, taking recourse against liable third parties, statistics, risk equalisation and informing you specifically about lower-cost services, insurance models and prevention.
What is on the bill: doctors, hospitals and therapists must state diagnoses and procedures in coded form on the bill. The insurer can request additional medical information. But you can ask for medical information to go only to the insurer’s medical adviser. The medical adviser is independent in their assessment and passes on to the administration only the information needed to decide on the benefit, the reimbursement, risk equalisation or a written decision.
Who else receives the data: the insurer’s employees are bound by a duty of confidentiality. The KVG allows data to be passed on only to certain bodies, for example to other social insurers with a statutory obligation, to statistical offices in anonymised form, to criminal prosecution authorities in the case of serious crimes, or, on a written and reasoned request in the individual case, to social assistance authorities, courts or debt enforcement offices. If premiums are unpaid, the insurer may inform social assistance authorities or the responsible cantonal bodies after an unsuccessful reminder.
All other third parties: personal data goes to others only if you have consented in writing in the individual case or, if that is not possible, if it can be assumed that the disclosure is in your interest. This also applies to supplementary insurance within the same group of insurers.
Technical security: insurers must take technical and organisational protective measures and draw up processing regulations. They submit these to the Federal Data Protection and Information Commissioner (FDPIC), and the regulations are publicly accessible.
Legal basis
Data protection in basic health insurance is based on several acts:
- Art. 84 KVG: the bodies of health insurance may process personal data, including sensitive data, to the extent that they need it for their tasks under the KVG or the Health Insurance Supervision Act (KVAG). The purposes are listed in para. 1 let. a–j.
- Art. 84a KVG: exhaustive rules on the disclosure of data to authorities and other bodies. Under para. 5 let. b, personal data may go to other third parties only if the person concerned has consented in writing in the individual case or if consent cannot be obtained and it can be assumed that the disclosure is in their interest. Para. 6: only the data required for the purpose may be disclosed.
- Art. 84b KVG: obligation to take technical and organisational measures and to draw up processing regulations, which are submitted to the FDPIC and are publicly accessible.
- Art. 42 paras. 3bis, 4 and 5 KVG: coded diagnoses on the bill, additional medical information, and the insured person’s right to have medical information sent only to the medical adviser.
- Art. 57 paras. 5 and 7 KVG: independence of the medical adviser; information is passed on to the administration only to the extent necessary for the decision on benefits, reimbursement, risk equalisation or a written decision.
- Art. 33 ATSG: duty of confidentiality for everyone involved in implementing social insurance.
From the Federal Act on Data Protection (FADP), the following apply in particular: Art. 5 let. c no. 2 FADP (health data is sensitive), Art. 6 FADP (lawfulness, proportionality, purpose limitation, deletion once the purpose no longer applies) and Art. 25 FADP (right to information, free of charge). Under Art. 18 DPO, the information must be provided within 30 days. In basic health insurance, insurers count as federal bodies within the meaning of Art. 5 let. i FADP, because they are entrusted with a public task of the Confederation.
Example: who may know what?
Mira, 38, has basic and supplementary insurance with the same insurer. In 2026, she has outpatient treatment, applies for higher supplementary hospital insurance and wants to know what data the insurer holds about her.
| Situation | What the insurer may do | Basis |
|---|---|---|
| Doctor’s bill for the treatment | Coded diagnosis on the bill to check the benefit | Art. 42 para. 3bis KVG |
| Mira does not want the administration to see the diagnosis | Doctor gives medical information only to the medical adviser | Art. 42 para. 5 KVG |
| Supplementary insurance wants data from basic health insurance | Only with Mira’s written consent in the individual case | Art. 84a para. 5 KVG |
| Application for supplementary hospital insurance | Ask health questions and use the answers to decide on acceptance | ICA, freedom of contract |
| Request for information | Reply within 30 days, free of charge | Art. 25 FADP, Art. 18 DPO |
What this means for you
- Request information: send the insurer a written request for information. It must reply within 30 days, free of charge.
- Ask for the medical adviser: for sensitive diagnoses, you can tell your doctor that medical information should go only to the medical adviser.
- Check declarations of consent: when getting quotes or applying, do not sign a blanket consent whose scope you do not understand. You get basic health insurance even without consent; the insurer must accept you under the KVG.
- Compare without giving away data: you can compare premiums in the premium calculator without giving your name, email address or phone number. How we handle data is explained in our privacy policy, and our business model under Disclosure.
- Know the insurers: you will find key figures on the insurers under Health insurers.
Common mistakes
- Believing basic and supplementary insurance automatically share all data. Legally, these are separate areas. Passing data on requires a legal basis or your consent.
- Signing declarations of consent without reading them. If you give blanket consent in an application, you may be allowing far-reaching flows of data.
- Not requesting information because you think it costs money. Information is, in principle, free of charge.
- Answering health questions incompletely. That is not data protection but a breach of the duty of disclosure. The insurer can then terminate the contract.
We prepare independent information on insurers and premiums without personal data; more on this under How we calculate.
Frequently asked questions
May my health insurer use data from basic health insurance for supplementary insurance?
Not as a matter of course. Basic health insurance may pass on personal data to third parties only with a legal basis or with your written consent in the individual case. Supplementary insurance is a contract under private law and counts as a third party here. So read declarations of consent carefully before you sign them.
Does my health insurer see my diagnosis?
Bills show diagnoses and procedures in coded form. But you can ask your doctor to give medical information only to the insurer’s medical adviser. The medical adviser passes on to the administration only what is needed to decide on the benefit.
How do I find out what data my health insurer holds about me?
With a request for information under Art. 25 FADP. The insurer must tell you free of charge within 30 days what data it processes, for what purpose, for how long and to whom it discloses it.
Where can I complain if my insurer breaches data protection?
First to the insurer itself. Data protection is supervised by the Federal Data Protection and Information Commissioner (FDPIC), to whom insurers also submit their processing regulations. For disputes about benefits, the Office of the health insurance ombudsperson is a point of contact.
Related terms
- Medical adviserThe medical adviser of the insurer (Vertrauensarzt) advises the health insurer on medical questions and checks whether it must pay for a benefit under basic health insurance. The adviser is independent in their judgement and only passes on to the insurer the information it needs for its decision. For psychotherapy, for example, the adviser reviews whether it continues after 40 sessions.
- Electronic patient recordThe electronic patient record (EPR, in German EPD) is a digital collection of your health documents, such as medical reports, your medication list or your advance directive. Since 2020 you have been able to open an EPR in Switzerland, voluntarily and only with your express consent. You decide which health professionals get access; hospitals, care homes and doctors authorised since 2022 must take part.
- Health questionnaireThe health questionnaire contains the questions about illnesses, treatment and symptoms that a health insurer asks in the application for supplementary insurance. You must answer them completely and truthfully (Art. 4 ICA). There are no health questions in basic health insurance: every insurer must accept you there without any check.
- Industry agreementThe industry agreement is a set of rules drawn up by health insurers for insurance intermediaries. Since 01.09.2024 it has applied to all insurers: cold calling is banned, every consultation needs a written record, and remuneration is capped at CHF 70 per person in basic health insurance and 16 monthly premiums per contract in supplementary insurance.
- Termination of pregnancyA termination of pregnancy that is not punishable under Art. 119 of the Swiss Criminal Code is paid for by basic health insurance in the same way as treatment for an illness. This applies at every health insurer. In the first twelve weeks, the woman decides for herself on written request. The deductible and the 10% retention fee apply as for any other treatment.
Sources
- Federal Health Insurance Act (KVG), Art. 84 Processing of personal dataArt. 84 KVGfedlex.admin.ch
- Federal Health Insurance Act (KVG), Art. 84a Disclosure of dataArt. 84a KVGfedlex.admin.ch
- Federal Health Insurance Act (KVG), Art. 42 Invoicing and medical informationArt. 42 para. 5 KVGfedlex.admin.ch
- Federal Health Insurance Act (KVG), Art. 57 Medical advisersArt. 57 para. 7 KVGfedlex.admin.ch
- Federal Act on the General Part of Social Insurance Law (ATSG), Art. 33 Duty of confidentialityArt. 33 ATSGfedlex.admin.ch
- Federal Act on Data Protection (FADP), Art. 5, 6 and 25Art. 25 FADPfedlex.admin.ch
- Data Protection Ordinance (DPO), Art. 18 Time limit for providing informationArt. 18 DPOfedlex.admin.ch
- Federal Act on the Electronic Patient Record (EPDG), Art. 9 Access rightsArt. 9 EPDGfedlex.admin.ch
- Federal Data Protection and Information Commissioner (FDPIC)edoeb.admin.ch