GDPR and medical data: what an EU clinic must do today to avoid a million-euro fine

Serhii Shypylov

• 5 min read
Share
GDPR and medical data: what an EU clinic must do today to avoid a million-euro fine

Why medical data is a separate level of risk

Patient medical data belongs to the special category of personal data under the GDPR. This means that an EU clinic cannot process it solely on the basis of ordinary consent or general interest.

A separate legal basis under Article 9 of the GDPR is required. Most often, this is the provision of medical care, compliance with legal obligations, public health, or the patient’s explicit consent where appropriate.

💡 Key insight: for a clinic, the GDPR is not just paper consent. It is a system of evidence that patient data is collected lawfully, stored securely, and deleted when required.

1. Determine your role: controller or processor

A clinic is usually the controller of patient data because it determines the purposes and means of processing. However, for certain services — a laboratory, a cloud platform, a billing contractor — the role of processor is possible.

This must be documented. If the clinic works with contractors, each of them must be vetted and bound by a contract under Article 28 of the GDPR.

  • ✅ Determine which data the clinic collects itself and which it receives from partners.
  • ✅ Check whether a Data Protection Officer is required due to the scale of medical data processing.
  • ✅ Record the roles in internal policies and contracts.

Medical data requires two bases: a general one under Article 6 of the GDPR and a special one under Article 9. For example, the provision of medical care may be both a legal obligation and a basis for processing special category data.

Consent is not a universal solution. It must be freely given, specific, informed, and unambiguous. The patient must be able to withdraw it without harm to treatment where applicable.

⚠️ Separate consent is required for marketing, transferring data to optional research, or using a patient’s photo in advertising. Treatment cannot be made conditional on consent to marketing.

3. Minimization and purpose limitation

A clinic must collect only the data that is actually needed for a specific medical, administrative, or legal purpose. Redundant fields in forms, old questionnaires, and data duplication are direct GDPR risks.

  • 📌 Review registration forms and remove unnecessary fields.
  • 📌 For each processing purpose, specify the legal basis and retention period.
  • 📌 Do not use medical data for new purposes without a separate legal assessment.

4. Transparency for the patient

The patient must understand who processes their data, why, for how long, to whom it is transferred, and what rights they have. The privacy policy must be written in plain language.

It is not enough to have a long legal text on the website. The information must be available at the moment of data collection — at the reception desk, on a tablet, in a form on the website, or in a mobile application.

  • 🧾 Add a short explanation to data collection forms.
  • 🧾 Update the privacy notice to reflect medical specifics.
  • 🧾 Translate key messages into a language that the clinic’s patients understand.

5. Patient rights: a process, not a slogan

Patients have the right of access, rectification, restriction of processing, objection, and in certain cases — erasure of data. For medical data, there are exceptions related to mandatory retention and the protection of legal claims.

The clinic must have a request log, a responsible person, and a response procedure. The standard response period is one month, with the possibility of extension in complex cases.

  • 📬 Create a separate channel for personal data requests.
  • 📬 Train staff to identify patient requests.
  • 📬 Keep evidence of timely and correct responses.

6. Storage security: paper, cloud, and people

The GDPR requires risk-based technical and organizational measures. For a clinic, this means access control, encryption, backup, activity logging, physical security of premises, and staff training.

Particular attention should be paid to employee accounts. Access rights must be minimal, and terminated employees must lose access immediately.

  • 🔐 Enable multi-factor authentication for medical systems.
  • 🔐 Use encryption for laptops, storage media, and cloud storage.
  • 🔐 Audit access to medical records.
  • 🔐 Protect paper records, logs, and printouts from unauthorized persons.
🛡️ Security is not a separate IT project. It is the clinic’s daily hygiene: from the password on the desktop to vetting the contractor that processes laboratory results.

7. Security breach: 72 hours to respond

If there is loss, unauthorized access, or leakage of medical data, the clinic must assess the risk and, if necessary, notify the supervisory authority within 72 hours after becoming aware of the incident.

If the risk to patients is high, they must also be notified. Even if notification is not required, the incident must be entered in the internal register.

  • 🚨 Appoint a person responsible for incident response.
  • 🚨 Prepare a risk assessment and notification template.
  • 🚨 Verify that contractors are obligated to notify the clinic of incidents without delay.

8. DPIA for high-risk processes

A Data Protection Impact Assessment, or DPIA, is required where processing may create a high risk. For a clinic, this often includes electronic medical records, large-scale processing, telemedicine, biometric data, AI diagnostics, or health analytics.

A DPIA should not be a formal document for a checkmark. It must show the risks, protection measures, and residual risk after system implementation.

  • 🧠 Compile a list of high-risk systems and processes.
  • 🧠 Involve IT, legal, medical staff, and the DPO.
  • 🧠 Update the DPIA when the vendor or functionality changes.

9. Contractors, cloud, and cross-border transfers

A clinic does not bear less responsibility because data is stored in the cloud. Before choosing a vendor, a security review, a contract under Article 28 of the GDPR, and an understanding of where data is physically processed are required.

If data is transferred outside the EU, appropriate safeguards are required: an adequacy decision, standard contractual clauses, or other lawful mechanisms.

  • 🌍 Check the data storage region with the cloud provider.
  • 🌍 Obtain the list of subprocessors and the procedure for changing them.
  • 🌍 Record the vendor’s obligation to assist with patient rights and breach procedures.

10. Retention and deletion periods

Medical data cannot be stored indefinitely simply because it is convenient. A clinic must have a retention schedule: which documents are stored, for how many years, and on what basis.

After the period expires, the data must be deleted or anonymized. It is important to take into account national requirements for medical documentation and limitation periods.

  • 🗂️ Specify retention periods for patient records, consents, financial documents, call recordings, and video.
  • 🗂️ Verify that data is deleted from backups according to a defined procedure.
  • 🗂️ Do not store patient data in staff personal messaging apps.

11. Accountability: prove compliance

The GDPR requires not only complying with the rules but also documenting compliance. For a clinic, this includes policies, a processing register, contracts, training, request logs, DPIAs, an incident log, and evidence of technical measures.

If a supervisory authority or patient asks a question, the clinic must be able to quickly show exactly how it protects medical data.

  • 📚 Update the Records of Processing Activities.
  • 📚 Conduct practical training for reception, doctors, and IT.
  • 📚 Schedule regular internal audits of access and contractors.

Clinic checklist for this week

  • ✅ Verify the legal bases for each category of medical data.
  • ✅ Update the privacy notice for patients.
  • ✅ Review staff access rights to medical systems.
  • ✅ Sign or review DPAs with all processors.
  • ✅ Approve the 72-hour breach notification procedure.
  • ✅ Determine which processes require a DPIA.
  • ✅ Establish retention periods and a deletion procedure.
  • ✅ Appoint responsible persons for patient requests and data security.
🚀 A clinic that gets its GDPR house in order today does not just avoid fines. It builds patient trust, reduces operational risks, and prepares for digital medicine without chaos.

This material is for informational purposes only and does not replace legal advice regarding a specific clinic and the national legislation of an EU country.

📬 Get in touch

Want to implement this in your business? Contact us!

Contact us
Telegram WhatsApp Email