Case study: medical clinic
Patients' data concerning health belong to the special categories of data (art. 9). A clinic must protect them against unauthorised access with technical and organisational measures appropriate to the risk (art. 5 and art. 32) and, because it processes such data, must keep a record of processing activities (art. 30). In this illustrative example, none of these requirements was met.
The situation
A dental clinic in Chișinău with three surgeries. Every member of staff, reception included, had access to every patient file, test results were sent to patients over Viber, and the clinic kept no record of processing activities. On their first visit, patients filled in a questionnaire with their contact details and medical history without being told who would process the data or why.
What was missing
- 01Reception could see diagnoses and treatment plans, although booking appointments and taking payments only requires contact details and the visit schedule. The data were not limited to what each role needs and were accessible by default to all staff. art. 5 art. 25
- 02Test results, which are data concerning health, went out over a messaging app to numbers typed in by hand, with no check of the recipient and no assessment of the risk that channel carried. art. 9 art. 32
- 03The clinic kept no record of processing activities. The exemption for enterprises with fewer than 250 employees did not apply to it, because the processing includes data concerning health and is not occasional. art. 30
- 04When their data were collected, patients did not receive the information the law requires: the clinic's identity, the purposes and legal basis of the processing, the recipients, the storage period, their rights and the right to lodge a complaint with the National Centre for Personal Data Protection. art. 12 art. 13
- 05Staff had not received instructions on access to the data, although anyone acting under the clinic's authority processes them only on its instructions, and the clinic had no rule for documenting a personal data breach. art. 29 art. 32 art. 33
The risks
A fine for breaching the principles
Unrestricted access to patient files and sending results over an insecure channel breach the principles of processing and the rules on special categories of data. For these, the law provides for fines of up to 2,000,000 lei or, for an enterprise, of up to 2% of total turnover in the year preceding the sanction, whichever is higher. For the same processing operations, the total may not exceed the amount set for the gravest infringement. art. 5 art. 9 art. 87 art. 88
An inspection by the Centre
The Centre may ask for the record of processing activities at any time, and its absence shows at the first request. The obligations on records and security carry fines of up to 1,000,000 lei or 1% of total turnover. Of the fine imposed, 10% applies in the first year after the law enters into force, 40% in the second and 100% from the third. art. 30 art. 60 art. 88 art. 90
A patient's complaint and compensation
A patient whose results reached someone else may lodge a complaint with the Centre within one year of the date on which he or she could have learned of the infringement, and no later than 3 years after it, and may claim compensation for material or non-material damage. If the breach is likely to result in a high risk, the clinic must also inform the patient. art. 34 art. 72 art. 76
What is in place now
- 01An access policy for medical files, so that each employee sees only the data his or her role needs and reception no longer sees diagnoses. art. 5 art. 25 art. 32
- 02A secure channel for sending results, chosen according to the risk to patients, in place of the messaging app. art. 9 art. 32
- 03A record of processing activities, which the clinic can make available to the Centre on request. art. 30
- 04A privacy notice for patients, handed out at the first visit, so that every patient knows who processes his or her data, for what purpose and with what rights. art. 12 art. 13
- 05Confidentiality undertakings signed by staff and a briefing and advice session for the team, so that everyone processes data only on the clinic's instructions. art. 29 art. 32
- 06A register of personal data breaches, which lets the Centre check how each incident was handled. art. 33
Result
Access to patient files is now granted by role, results are sent through a secure channel, patients receive a privacy notice, and the clinic has a record of processing activities, confidentiality undertakings signed by its staff, a breach register and a team briefed on its obligations.
For a typical medical clinic
The Essential package + extra work, 18,900 MDL
This is an estimate for a typical organisation in the industry, with up to 20 people working with the data. The exact price depends on what you do with the data.
Calculate the exact price →FAQ
Questions about this case
Can reception see a patient's medical file?
Only to the extent its tasks require. The data must be limited to what is necessary for the purpose, and the clinic's measures must ensure that by default they are not accessible to an indefinite number of people. Booking appointments usually needs no more than contact details and the visit schedule. art. 5 art. 25
Does a clinic need the patient's consent to process health data?
Not for medical care. The prohibition on processing health data does not apply where the processing is necessary for a medical diagnosis or the provision of health care, under legislation or a contract with a health professional, and the data are processed by or under the responsibility of a professional subject to professional secrecy. For other purposes, the clinic needs another basis. art. 6 art. 9
Does a small clinic have to keep a record of processing activities?
Yes, if it processes data concerning health. The exemption for enterprises with fewer than 250 employees does not apply where the processing includes special categories of data, is not occasional or is likely to result in a risk to data subjects. The record is kept in writing, including in electronic form. art. 30
What should the clinic do if results reached another patient?
This is a personal data breach. The clinic notifies the Centre without undue delay and, where feasible, not later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk. If the risk to the patient is high, the clinic informs him or her as well. art. 33 art. 34
Free consultation
Not sure where to start?
Request a free 15-minute consultation. We will tell you which obligations under Law No. 195/2024 apply to you and which steps are needed.