A history of illnesses, a set of test results, a referral to psychiatry. These are things a person shares with their doctor precisely because they trust they will stay there. The moment they end up where they should not, that trust breaks, and with it the relationship the whole of medicine rests on.
That is exactly why the law treats medical data differently from a name or an address. And for a medical unit, protecting it is not paperwork, it is part of caring for the patient.
Why medical data is treated specially
GDPR splits data in two. There is ordinary data, like a name or a phone number, and there is sensitive data in a special category. Health data sits in the special category, next to data about religion, political views or someone's intimate life.
For this data, the basic rule is simple: using it is forbidden, with a few well-defined exceptions. In other words, you cannot touch a piece of medical data unless you have a clear reason allowed by law. For a clinic, that reason is usually the care of the patient itself.
Where most problems come from
In healthcare, most leaks are not the work of hackers. They are everyday mistakes, made by people in a hurry, using the wrong tools.
- An Excel sheet of patients emailed to the wrong person. We wrote in detail about such a case in our article on a medical-data incident in an Excel file.
- Access to the whole system for everyone, when the front desk should not see diagnoses and a doctor does not need every record.
- Paper files left in plain sight, or files kept on a laptop with no password and no encryption.
- A medical software bought from a vendor, without a contract that clearly states who is responsible for patient data.
None of them seems serious at the time. All of them become serious when the data walks out the door.
What the law requires
- A clear basis. For the care of the patient, you may use medical data without a separate consent. Consent is still needed for other purposes, such as marketing or sending the data to someone not involved in the treatment.
- Medical confidentiality. Beyond GDPR, patient data is also protected by the rules of the profession. The two support each other.
- Breach notification. If patient data leaks, you notify the authority within 72 hours and, because it is sensitive data, usually the patients too.
- Risk assessment (DPIA). For high-risk processing, such as a new system holding records for thousands of patients, the law requires a risk analysis before you start.
What a medical unit can do in practice
The good news is that the steps are not complicated. They are the same for a hospital and for a small practice, just at a different scale.
- Role-based access. Everyone sees only what they need for their job. The front desk sees appointments, the doctor sees their own patients' records, not the whole hospital's.
- Encryption and passwords. On laptops, on phones, on USB sticks. If a device is lost, the data stays unreadable.
- Less data, not more. You collect and keep only what you need, for as long as you need it. What does not exist cannot leak.
- Contracts with vendors. With the medical software company, the lab, the people doing maintenance. In black and white, who is responsible for the data.
- Trained people. Staff taught what sensitive data is and how to send a file safely stop most mistakes.
- An incident plan. Who does what in the first hours, so the 72-hour notification does not catch you unprepared.
At INFOSHARE we help hospitals, clinics and practices put all of this in place, from GDPR compliance and the DPO role to information security. And the records, risk assessments and incident logs sit in one place, in the askGDPR platform.
Frequently asked questions
Why is medical data protected more strictly than other data?
Because it says very intimate things about a person: illnesses, treatments, pregnancies, mental health. GDPR places it in a special category, alongside data about religion or sexual orientation, and requires stricter rules for using it. A leak of medical data cannot be undone, because the information stays out there.
On what legal basis can a clinic use medical data?
Using medical data is forbidden as a rule, with a few clear exceptions. For a healthcare provider, the usual basis is the provision of care (diagnosis, treatment, running the health system), not simple consent. Patient consent is still needed in other situations, for example for marketing or for sharing data with third parties not involved in the treatment.
What does a medical unit do when patient data leaks?
It notifies the authority within 72 hours of becoming aware and, because this is sensitive data, it usually has to notify the affected patients too. At the same time it stops the leak, gathers the evidence and records the incident. Most such cases start with a file sent to the wrong person or with access that is too broad, not with a sophisticated attack.
Does a small practice really have to comply with GDPR?
Yes. GDPR does not apply by size but by the type of data. A family doctor or a dental practice works with medical data, so it has the same basic obligations as a large hospital: to use data on a clear basis, to keep it safe and to be able to prove it. The workload is smaller, but the rules are the same.
Want to protect your patients' data properly?
We run an assessment tailored to a medical unit and put in place the legal bases, the access rules, the contracts and the incident plan, with no hassle for your staff.