WeChat in care: Confidential workplace messaging needs an approved framework
A private group is not an approved care channel. Assess data, recipients, work devices and alternatives before sharing resident information.
Révision éditoriale :
Le texte de cet article est disponible en anglais dans cette version du site.
Contexte et sources
Messaging about an identifiable resident's condition is different from arranging a shift swap. Health data require an Article 6 GDPR basis and an applicable Article 9 exception. Even a room number can identify someone within a facility. These requirements apply regardless of the app or staff members' nationality. [1], [3]
Section 203 of the German Criminal Code protects professional secrets. It permits necessary involvement of service providers under conditions; using an external service is neither automatically prohibited nor automatically authorised. Roles, necessity and confidentiality arrangements matter. [2]
Third-country transfers require a separate Chapter V assessment. Absence of an adequacy decision is not an absolute transfer ban, but another applicable mechanism must be established rather than assumed. [3]
Portée et limites
This article makes no verified claim about current WeChat hosting locations, contracts or foreign authorities' ability to decrypt messages. Individual criminal liability cannot be inferred merely from the choice of app.
En termes simples
Fictional example: A team starts a private group for shift swaps and later posts handover sheets. The issue is uncontrolled use of confidential information, not international colleagues' cultural background.
Recommandations pratiques
Our recommendation: Map actual communication channels and explain boundaries in accessible language. Provide a usable approved alternative rather than only a ban. Assess provider roles, contracts, recipients and transfers before approval.
Test access withdrawal, lost-device handling and transfer of relevant decisions to the care record. If resident information has already circulated privately, stop further disclosure and involve the responsible privacy team. Preserve what is needed to establish the facts instead of ordering indiscriminate deletion. Decide on notification and corrective measures from the documented incident assessment.