Patient Confidentiality in Switzerland: What the Law Actually Protects

Patient confidentiality in Switzerland: the short answer

Patient confidentiality in Switzerland rests on criminal law, not only on professional rules. Article 321 of the Swiss Criminal Code makes it an offence for doctors, psychologists, nurses, pharmacists and other listed health professionals, and for their assistants, to disclose what a patient has confided to them or what they learned in their work. The penalty is a custodial sentence of up to three years or a monetary penalty.

Cantonal health laws repeat the duty. Geneva's Health Act, for example, binds health professionals and their auxiliaries to professional secrecy within the meaning of Article 321. Three further layers sit on top: the revised Federal Act on Data Protection (FADP), in force since 1 September 2023, which treats health data as sensitive and gives patients a right of access; cantonal rules on how long medical records are kept and how patients see them; and the Civil Code, which decides who speaks for a patient who can no longer decide.

This guide sets out who is bound, how secrecy can be lifted, what the data protection act adds, the rules on records and on sending data abroad, and what it all means for an international patient's family, employer, insurer and entourage. Federal law is quoted from the English translations on Fedlex, which are published for information and have no legal force.

Article 321 of the Swiss Criminal Code: who is bound and what it protects

Article 321 names the professions it binds: members of the clergy, lawyers, defence lawyers, notaries, patent attorneys, auditors bound to confidentiality under the Code of Obligations, doctors, dentists, chiropractors, pharmacists, midwives, psychologists, nurses, physiotherapists, occupational therapists, dieticians, optometrists and osteopaths, together with anyone who works as their assistant. Students are bound by what they learn in their studies. The current wording of this paragraph dates from the Healthcare Occupations Act, in force since 1 February 2020.

What is protected is broad: anything confided to the professional in that capacity or learned in the practice of the profession. The Federal Data Protection and Information Commissioner (FDPIC) gives practice receptionists and other administrative staff, medical assistants, IT providers and laboratory technicians as examples of assistants who are bound. The duty outlasts the job: a breach remains an offence after the professional's employment or studies have ended.

Cantonal law applies the same logic to the bare fact of a stay. Zurich's Patients Act, for example, allows information about patients to be given to third parties only with their consent, subject to legal duties and rights to report and to a release from secrecy.

The monetary penalty is normally capped by the Criminal Code at 180 daily penalty units of at most CHF 3,000 each. The offence is prosecuted only on complaint, and the right to file a complaint expires three months after the person concerned learns who disclosed the information.

How secrecy can be lifted: consent, official release and reporting rules

Article 321 itself names three routes. The patient consents. A superior or supervisory authority issues a written authorisation at the professional's request. Or federal or cantonal law provides otherwise: Article 321 reserves the provisions on rights to report and to cooperate, on the duty to testify and on the duty to give information to an authority. The official German, French and Italian texts speak of rights to report, although the English translation on Fedlex says duties. Article 321bis adds a separate route for research, where the responsible ethics committee authorises the disclosure.

Consent does not have to be written. The FDPIC notes that it can be express, or tacit, as when a doctor says a report will go to a named specialist and the patient does not object. It has to cover the disclosure in question, though: the FDPIC points out that doctors may not pass on information about a patient to a colleague simply because the colleague is also bound by confidentiality.

The statutory exceptions are specific. Professionals bound by secrecy, though not their assistants, may notify the child protection authority when that is in a child's interest (Civil Code, Article 314c). In criminal proceedings, doctors, psychologists, nurses and the other listed health professions, and their assistants, may refuse to testify about patient secrets. They must testify if they are subject to a duty to report or have been released from secrecy; after a release, the authority still respects secrecy if they show that the patient's interest outweighs the interest in establishing the truth (Criminal Procedure Code, Article 171).

Insurance is the everyday boundary. An insurer asked to pay for treatment will want medical information to assess the claim, and for a patient paying through a foreign or private policy it receives what the patient's release allows. Read that release before signing it, and narrow it where you can.

Are lifestyle managers in Switzerland bound by professional secrecy?

Not by Article 321, unless they work as the assistant of a doctor or another listed professional. The article binds the listed professions and the people who assist them in that work; a lifestyle manager, concierge, driver or interpreter engaged by the patient is neither.

They are not outside the law, though. Article 62 of the revised Data Protection Act makes it an offence to wilfully disclose secret personal data learned in practising a profession that requires knowledge of such data, in the words of the official German and French texts. The same applies to anyone working for or training with such a person, and to disclosure after they stop practising. The penalty is a fine of up to CHF 250,000, on complaint. The FDPIC applies this to health directly: health professions not covered by Article 321 are subject to the duty of confidentiality under Article 62.

The difference matters in three ways. Article 321 carries a possible custodial sentence, Article 62 a fine. Professionals under Article 321 may refuse to testify about patient secrets, while people entrusted with other confidential information protected by law must testify unless the director of proceedings relieves them, which requires them to show that confidentiality outweighs the interest in establishing the truth (Criminal Procedure Code, Article 173). And Article 62 applies only where the profession requires knowledge of such data, which will not be clear for every role in an entourage, so a written confidentiality agreement with anyone in your entourage is still worth having.

The revised Federal Act on Data Protection (FADP) and health data

The revised FADP came into force on 1 September 2023. It applies to private persons, which includes private clinics, and to federal bodies. The act classes data relating to health as sensitive personal data, and where the consent of the patient is required to process such data, the consent must be given explicitly.

For patients the most useful right is access. Anyone may ask a clinic whether it processes data about them and receive the data itself, the purpose, the retention period and the recipients. The information must be provided free of charge as a rule and in general within 30 days (Article 25). A clinic may refuse, restrict or delay it only on stated grounds, for example where a formal law requires it in order to preserve professional secrecy, or where third parties' overriding interests require it (Article 26).

A clinic must notify the FDPIC as quickly as possible of any breach of data security likely to lead to a high risk for the patients concerned, and must inform the patients where that is required for their protection or the FDPIC requests it (Article 24).

Sanctions are criminal fines aimed at the responsible individuals rather than the company: up to CHF 250,000 for wilfully giving false or incomplete information in response to an access request, for disclosing data abroad in breach of the rules, for failing to meet the minimum data security requirements, and for breaching professional confidentiality under Article 62. Where tracing the responsible person would take disproportionate effort and the fine would not exceed CHF 50,000, the business can be fined instead (Articles 60 to 64).

Medical records: how long they are kept and how to get a copy

Medical records are governed by cantonal law, so the rules depend on where you were treated. Zurich, Geneva and Vaud show how far they differ.

Cantonal minimums sit below the federal limitation period. Claims for damages arising from injury or death in breach of contract prescribe at the latest twenty years after the harmful conduct (Code of Obligations, Article 128a, in force since 1 January 2020), and the FMH, the Swiss medical association, therefore advises keeping medical histories for 20 years after the end of treatment.

The cantonal right and the FADP's access right work side by side. Ask for the complete file, including imaging and discharge letters, and, if you prefer, for it to go directly to your doctor at home.

The electronic patient record: voluntary today, opt-out planned

Switzerland's electronic patient record (EPR, in German EPD) has had a legal basis in the Federal Act on the Electronic Patient Record since 15 April 2017. According to the Federal Office of Public Health (FOPH), inpatient institutions that bill compulsory health insurance, namely hospitals, rehabilitation clinics, psychiatric clinics, nursing homes and birth centres, are required to be connected, as are doctors newly admitted to bill it since 1 January 2022. For patients and for other outpatient professionals, opening an EPR is voluntary, and patients grant access to the professionals treating them.

That is set to change. On 5 November 2025 the Federal Council sent Parliament a new law under which the EPR becomes an electronic health record (E-GD) that every person resident in Switzerland receives automatically and free of charge unless they object, with introduction expected around 2030. The National Council approved the bill as first chamber in September 2026, by 134 votes to 53 with 10 abstentions, as reported by SWI swissinfo.ch on 14 September 2026; the Council of States has still to decide.

The E-GD is designed for residents. For patients who come from abroad, the clinic's own file, kept under cantonal law, remains the record to ask for.

Sending health data abroad: the EU, the US and everywhere else

A Swiss clinic may disclose personal data abroad without further safeguards where the Federal Council has decided that the destination guarantees an adequate level of protection (FADP, Article 16). The list, in Annex 1 of the Data Protection Ordinance, includes all EU and EEA states and the United Kingdom and, since 15 September 2024, organisations in the United States certified under the Swiss-US Data Privacy Framework.

For countries not on the list, which include the Gulf states, China, India and Russia, the clinic needs another basis: contractual safeguards, or one of the exceptions in Article 17, of which the most relevant for a patient is explicit consent. If you want records sent to a doctor in such a country, expect to be asked for that explicit consent.

Data also flows the other way. On 15 January 2024 the European Commission confirmed the adequacy of the Swiss level of data protection, so personal data from EU and EEA states can continue to be transferred to Swiss clinics without additional guarantees.

How Swiss medical privacy compares with GDPR and HIPAA

The Swiss FADP and the EU's General Data Protection Regulation (GDPR) both treat health data as sensitive. In Switzerland, federal criminal law applies as well: the person who treats you, and everyone assisting them, is personally liable to prosecution for disclosing what they learn.

Swiss protection is strongest while records stay in Switzerland, so decide before discharge which documents go where, and to whom.

What it means in practice for an international patient

Family. An adult who can decide for themselves decides who is told what. In Zurich hospitals, though, the Patients Act presumes consent to inform your contact persons about your state of health unless you object, and if you have named no one, your partner and then close relatives count as contact persons. If you lose the capacity to decide, the Civil Code gives the right to consent to treatment first to the person you named in a patient decree, then to a deputy, then to a spouse or registered partner who lives with you or regularly supports you, and after them to anyone else who lives with you, your children, your parents and your siblings, each only if they regularly and personally support you, in that order (Articles 370 and 378).

Employer. Your doctor may not tell your employer anything without your consent, a release or a legal duty. Swiss employment law also limits an employer to data that concern an employee's suitability for the job or are needed for the employment contract (Code of Obligations, Article 328b). If your employer needs evidence of absence, ask the clinic what a certificate will state before it is issued.

Insurer and embassy. An insurer paying for the stay will need information to assess the claim; keep the release to the documents, the stay and the department concerned. An embassy or consulate is a third party like any other: the clinic needs your consent, or a legal basis, before telling it anything.

Interpreter, concierge, lifestyle manager. People you engage yourself are not bound by Article 321, and Article 62 of the FADP reaches them only if their profession requires knowledge of such data. Where you can, have the clinic provide interpreting, and give anyone in your entourage a written confidentiality agreement. Family members and friends who travel with you have no professional duty of confidentiality; our guide to visas, family and the flight home covers the practical side.

Clinics also differ in how they handle data day to day: where records are stored, whether they are shared across a hospital group, how arrivals and visitors are managed. These are fair questions to put to any clinic before admission, above all for addiction and mental health treatment, which our guide to private addiction and mental health clinics covers.

If you are weighing where to be treated, we can put the options and the current published facts in front of you. Write to us.

Sources

Swiss federal law is quoted from the English translations on Fedlex, published for information only and without legal force; cantonal law is quoted from the official cantonal texts. Every source was read on 22 September 2026.