The individual's right to determine if, when and how data about them will be collected, stored, used and shared with others is called the right to privacy. The problem of data collection and sharing arises daily among health services. Among medical staff, there are numerous message flows, including the medical records of patients and other patient's personal data. These data are often completely unprotected and available to anyone who knows where it is. Unfortunately, the same data might not be available for patients, despite the fact that each individual has the right to view their own medical record and despite the fact that many other persons connected directly or indirectly to the patient has this access without limitations. In the paper, we will not concentrate on actions that medical staff has to perform nor on the knowledge that they have to have in order to protect a patient's personal data and enable a patient's access to their own data, but we will concentrate on the problem of educating patients about their rights and duties with regard to safety and privacy. Our educational suggestions will be given on the basis of corresponding Slovenian legislation and guidelines for medical staff regarding the protection of personal data.