Digital Divide in Bulgaria's Health System Leaves Roma Vulnerable to Medical Fraud
02 November 2026
Roma in Bulgaria who lack access to their personal data, not only face further exclusion from health services, but are left exposed to digital fraud. The ERRC and local partners investigated the situation and the ERRC has just lodged a complaint to Bulgaria’s Commission for Personal Data Protection (CPDP) concerning unauthorized access and fraudulent manipulation of digital medical records of Romani citizens.
According to information received by the ERRC from Roma NGOs and activists based in Bulgaria, there have been recent cases involving unauthorised access to, and manipulation of the medical records of Romani citizens, in which procedures that never took place were recorded.
Bulgaria which ranked joint bottom with Hungary of the EU in the 2025 Corruption Perceptions Index is no stranger to massive fraud, and the healthcare sector is far from immune. In March 2026, the Bulgarian National Health Insurance Fund (NHIF) referred files to the prosecution service to establish whether patients' personal data had been misused in connection with hospitalisations. The investigation covered 258 hospitals and over 4,000 patients, many of whom appeared to be present at gambling halls and casinos while at the very same time were officially registered as hospitalised.
On 3 June 2026, the District Prosecutor's Office in Plovdiv charged two doctors and three accomplices for theft and money laundering. The five were accused of participating in an organised criminal group established to steal funds from the NHIF by using falsified documents between March and 2 June 2026.
Over the past decade, Bulgaria has significantly expanded its National Health Information System (NHIS), electronic prescriptions, electronic referrals, electronic health records, and the eZdrave mobile application. This application provides citizens with access to their personal health record, containing electronic health documents registered in the NHIS.
In June 2026, Bulgaria introduced a new ‘Public Oversight’ feature in the eZdrave system, expressly enabling citizens to identify and report medical events recorded in their electronic medical records that they do not recognise as having occurred. The Ministry of Health described the feature as a mechanism for protecting patients' rights and promoting transparency.
Electronic health records can protect patients against fraud, but only those who can access and understand them are able to benefit effectively from this protection. As the ERRC complaint states, “people who lack access to eZdrave have fewer opportunities to discover that medical services may have been entered into the system or billed in their name.”
The complaint cites two examples as evidence that the fear of fraud is far from unfounded. Prior to the digitalization of the health service records, there were two criminal investigations into fictitious dental examinations and treatments, when in 2015, the authorities seized more than 700 health booklets belonging to Romani children and approximately 1,000 outpatient records. Their parents told investigators that they neither knew the dentists, nor had never taken their children there for treatment. According to the ERRC complaint, these incidents demonstrate how personal data and medical records of socially vulnerable patients has economic value within reimbursement systems and are open to abuse.
Just one month after online reporting via the ‘Public Oversight’ feature became possible on 1 August 2026, the Bulgarian authorities announced that they had received 1,760 reports from citizens concerning irregularities through the eZdrave platform. While this does not mean that all reports have proven to be substantiated cases of fraud, it is a clear signal that there is nothing hypothetical about disputed or suspicious entries in medical records.
Distrust, discrimination, and the digital divide
The ERRC complaint presented the CPDP with documented evidence demonstrating that Romani people have limited access to digital health services and limited practical opportunities to protect themselves against inaccurate, unauthorised or otherwise unlawful processing of electronic health data.
Research into healthcare for Roma people in Bulgaria has long documented distrust among Roma patients resulting from discriminatory treatment. One qualitative study cited in the complaint identified cases where “doctors refused to register Roma patients in their practices, as well as humiliating treatment, communication barriers, and avoidance of healthcare services by Roma people because they feared degrading treatment.”
These inequalities have also been recognised by international human rights institutions. Following a 2017 complaint by the ERRC, the European Committee of Social Rights concluded that Bulgaria had violated the non-discrimination provisions of the European Social Charter in conjunction with the right to protection of health, with regard to Roma women's access to health insurance and maternity healthcare.
Discriminatory inequalities have been exacerbated by digitalization. In its 2025 Country Health Profile, the European Commission highlighted that that the use of electronic health records, online appointment booking, and online health information is significantly lower among people with low levels of education than among those with higher education. More specifically, only a small proportion of people with low educational attainment had accessed their electronic health records, compared with a much larger proportion of highly educated people.
In its 2026 review of Bulgaria’s health system, the OECD estimated that approximately one quarter of the Romani population lacked health insurance, with unemployment, lack of identity documents, and difficulties proving residence as significant contributing factors. The report highlighted identity verification as an obstacle to patients' access to electronic records, and recommended that Bulgaria facilitate access to electronic health records by simplifying identification and security procedures.
This combination of factors means that not only does lack of effective access to data perpetuate discrimination but leaves Roma vulnerable to fraudulent abuse of their medical records by criminal actors. The ERRC complaint states that poverty, administrative exclusion, and lack of digital access significantly limits the possibilities for such persons to review their electronic health records; identify medical activities registered in their name that they do not recognise; or detect potential unauthorised use of their identity. This in turn makes it well-nigh impossible to request the correction of inaccurate information or make effective use of complaint mechanisms and legal remedies.
Recommendations
The starting point is that the principle of transparency requires individuals to be informed, in a clear and accessible manner, about how their personal data are collected, processed, stored, and shared. It is clear from the evidence contained in the ERRC complaint that this principle does not hold in practice when it comes to Roma and healthcare records. So, the ERRC has called upon the CPDP to investigate and remedy all the deficits and barriers facing Roma as they relate to digital literacy, access to technology, poverty and social exclusion, that affect the practical exercise of data subjects' rights within the health system.
When it comes to fraudulent misuse, or unauthorized processing of patient data, the CPDP should (1) examine whether relying on patients to identify unrecognised medical activities creates a protection gap for individuals who lack access to electronic health records; (2) examine whether data controllers implement sufficient proactive technical and organisational measures to prevent and detect potentially fictitious, anomalous, or unauthorised processing of patient data; and (3) examine whether the National Health Information System (NHIS) provides appropriate mechanisms for delegated or assisted access that safeguard personal data, including for individuals who rely on relatives, caregivers, or health mediators.
On public information and awareness, the complaint also calls on the CPDP to issue guidance on the handling of electronic health identification credentials by health mediators, civil society organisations, and other individuals who assist vulnerable data subjects. As for wider public awareness, the ERRC calls on the CPDP to conduct targeted activities within Romani communities concerning all the relevant rights relating to electronic health data, including the rights to lodgecomplaints and obtain legal remedies.
