Patient record documents must be handled in compliance with the provisions on sensitive data of the Personal Data Protection Act. Except where the laws provide otherwise, personal data must be handled with explicit consent of the data subject. One must also take the special security measures provided for in Article 16 of the same law, such as using encryption when sending data over the Internet.