I have a friend living in Germany who is seeking therapy in her small town. However, a problem that she is facing is that all of the psychological/psychiatric institutions in her town are managed by the same company and have access to the same patient databases. In particular, one of these is the psych ward at the hospital where were mother works, and her mother routinely accesses other patients' records including hers (for instance, she found about some lab tests that she had gotten and picked up the results for her). This severely limits what she can safely share with a therapist, because there are certain things that her family has told her they want her to keep quiet about.
To me, this seems brazenly illegal and a huge breach of confidentiality that basically makes therapy useless. However, I live in the US and have no idea how the particulars of the law work in Germany, both in terms of whether or not this is illegal (perhaps data sharing within the owning company is a non-issue) and if it is, what particular law is being broken. Is what's going on here illegal, and if so, who should my friend contact in Germany to seek help?