From Privacy to Data Erasure: A Review of New Rights and Emerging Challenges in the Era of Electronic Health Records

Abstract

The digitalization of healthcare systems has transformed the production, storage, and sharing of clinical information. While electronic health records (EHRs) enhance care efficiency, accessibility, and continuity, they simultaneously introduce complex ethical, legal, and cybersecurity challenges that directly affect patient interests. This narrative review examines the emerging rights associated with digital health records, particularly the right to privacy and the right to be forgotten, alongside threats to confidentiality, cybersecurity, and patient safety. A comprehensive literature search was conducted across PubMed, Web of Science, MEDLINE, and the Cochrane Library. First, the right to be forgotten appears particularly relevant for oncological patients facing financial discrimination and for individuals asserting gender identity rights, yet it cannot be unconditionally extended to genetic data, given its relevance to relatives and future generations. Second, confidentiality risks are amplified by re-identification vulnerabilities, unauthorized access by personnel, and the broad connectivity of digital systems. Third, the secondary use of data from EHRs, including artificial intelligence (AI) integration, commercial exploitation, and large language model training, raises substantial privacy concerns. Fourth, ransomware, phishing, and data breaches can erode patient trust. In this article, we analyze these issues within the evolving European regulatory framework, highlighting the tension between individual privacy rights and broader public interests. We argue that robust data protection must be balanced with scientific progress and that this requires opt-in consent frameworks, staff training, and transparent AI governance.