# Case study: medical clinic Source: https://conformitate.md/en/case-studies/medical-clinic Updated: 2026-10-17 Case study Illustrative example Patients' data concerning health belong to the special categories of data (art. 9). A clinic must protect them against unauthorised access with technical and organisational measures appropriate to the risk (art. 5 and art. 32) and, because it processes such data, must keep a record of processing activities (art. 30). In this illustrative example, none of these requirements was met. ## The situation A dental clinic in Chișinău with three surgeries. Every member of staff, reception included, had access to every patient file, test results were sent to patients over Viber, and the clinic kept no record of processing activities. On their first visit, patients filled in a questionnaire with their contact details and medical history without being told who would process the data or why. ## What was missing 1. Reception could see diagnoses and treatment plans, although booking appointments and taking payments only requires contact details and the visit schedule. The data were not limited to what each role needs and were accessible by default to all staff. [art. 5](https://conformitate.md/en/law-195-2024/article-5 "Principles relating to processing") [art. 25](https://conformitate.md/en/law-195-2024/article-25 "Data protection by design and by default") 2. Test results, which are data concerning health, went out over a messaging app to numbers typed in by hand, with no check of the recipient and no assessment of the risk that channel carried. [art. 9](https://conformitate.md/en/law-195-2024/article-9 "Processing of special categories of personal data") [art. 32](https://conformitate.md/en/law-195-2024/article-32 "Security of processing") 3. The clinic kept no record of processing activities. The exemption for enterprises with fewer than 250 employees did not apply to it, because the processing includes data concerning health and is not occasional. [art. 30](https://conformitate.md/en/law-195-2024/article-30 "Records of processing activities") 4. When their data were collected, patients did not receive the information the law requires: the clinic's identity, the purposes and legal basis of the processing, the recipients, the storage period, their rights and the right to lodge a complaint with the National Centre for Personal Data Protection. [art. 12](https://conformitate.md/en/law-195-2024/article-12 "Transparency of information, communications and modalities for the exercise of the rights of the data subject") [art. 13](https://conformitate.md/en/law-195-2024/article-13 "Information to be provided where personal data are collected from the data subject") 5. Staff had not received instructions on access to the data, although anyone acting under the clinic's authority processes them only on its instructions, and the clinic had no rule for documenting a personal data breach. [art. 29](https://conformitate.md/en/law-195-2024/article-29 "Carrying out processing activities under the authority of the controller or the processor") [art. 32](https://conformitate.md/en/law-195-2024/article-32 "Security of processing") [art. 33](https://conformitate.md/en/law-195-2024/article-33 "Notification of a personal data breach to the Centre") ## The risks ### A fine for breaching the principles Unrestricted access to patient files and sending results over an insecure channel breach the principles of processing and the rules on special categories of data. For these, the law provides for fines of up to 2,000,000 lei or, for an enterprise, of up to 2% of total turnover in the year preceding the sanction, whichever is higher. For the same processing operations, the total may not exceed the amount set for the gravest infringement. [art. 5](https://conformitate.md/en/law-195-2024/article-5 "Principles relating to processing") [art. 9](https://conformitate.md/en/law-195-2024/article-9 "Processing of special categories of personal data") [art. 87](https://conformitate.md/en/law-195-2024/article-87 "General conditions for imposing fines") [art. 88](https://conformitate.md/en/law-195-2024/article-88 "Infringements punishable by a fine") ### An inspection by the Centre The Centre may ask for the record of processing activities at any time, and its absence shows at the first request. The obligations on records and security carry fines of up to 1,000,000 lei or 1% of total turnover. Of the fine imposed, 10% applies in the first year after the law enters into force, 40% in the second and 100% from the third. [art. 30](https://conformitate.md/en/law-195-2024/article-30 "Records of processing activities") [art. 60](https://conformitate.md/en/law-195-2024/article-60 "Powers of the Centre") [art. 88](https://conformitate.md/en/law-195-2024/article-88 "Infringements punishable by a fine") [art. 90](https://conformitate.md/en/law-195-2024/article-90 "Transitional provisions") ### A patient's complaint and compensation A patient whose results reached someone else may lodge a complaint with the Centre within one year of the date on which he or she could have learned of the infringement, and no later than 3 years after it, and may claim compensation for material or non-material damage. If the breach is likely to result in a high risk, the clinic must also inform the patient. [art. 34](https://conformitate.md/en/law-195-2024/article-34 "Communication of a personal data breach to the data subject") [art. 72](https://conformitate.md/en/law-195-2024/article-72 "Right to lodge a complaint with the Centre") [art. 76](https://conformitate.md/en/law-195-2024/article-76 "Right to compensation and liability") ## What is in place now 1. An access policy for medical files, so that each employee sees only the data his or her role needs and reception no longer sees diagnoses. [art. 5](https://conformitate.md/en/law-195-2024/article-5 "Principles relating to processing") [art. 25](https://conformitate.md/en/law-195-2024/article-25 "Data protection by design and by default") [art. 32](https://conformitate.md/en/law-195-2024/article-32 "Security of processing") 2. A secure channel for sending results, chosen according to the risk to patients, in place of the messaging app. [art. 9](https://conformitate.md/en/law-195-2024/article-9 "Processing of special categories of personal data") [art. 32](https://conformitate.md/en/law-195-2024/article-32 "Security of processing") 3. A record of processing activities, which the clinic can make available to the Centre on request. [art. 30](https://conformitate.md/en/law-195-2024/article-30 "Records of processing activities") 4. A privacy notice for patients, handed out at the first visit, so that every patient knows who processes his or her data, for what purpose and with what rights. [art. 12](https://conformitate.md/en/law-195-2024/article-12 "Transparency of information, communications and modalities for the exercise of the rights of the data subject") [art. 13](https://conformitate.md/en/law-195-2024/article-13 "Information to be provided where personal data are collected from the data subject") 5. Confidentiality undertakings signed by staff and a briefing and advice session for the team, so that everyone processes data only on the clinic's instructions. [art. 29](https://conformitate.md/en/law-195-2024/article-29 "Carrying out processing activities under the authority of the controller or the processor") [art. 32](https://conformitate.md/en/law-195-2024/article-32 "Security of processing") 6. A register of personal data breaches, which lets the Centre check how each incident was handled. [art. 33](https://conformitate.md/en/law-195-2024/article-33 "Notification of a personal data breach to the Centre") ## Result Access to patient files is now granted by role, results are sent through a secure channel, patients receive a privacy notice, and the clinic has a record of processing activities, confidentiality undertakings signed by its staff, a breach register and a team briefed on its obligations. For a typical medical clinic The Essential package + extra work, 18,900 MDL This is an estimate for a typical organisation in the industry, with up to 20 people working with the data. The exact price depends on what you do with the data. [Calculate the exact price →](https://conformitate.md/en/tools/price-calculator?profil=clinici-medicale) FAQ ## Questions about this case ### Can reception see a patient's medical file? Only to the extent its tasks require. The data must be limited to what is necessary for the purpose, and the clinic's measures must ensure that by default they are not accessible to an indefinite number of people. Booking appointments usually needs no more than contact details and the visit schedule. [art. 5](https://conformitate.md/en/law-195-2024/article-5 "Principles relating to processing") [art. 25](https://conformitate.md/en/law-195-2024/article-25 "Data protection by design and by default") ### Does a clinic need the patient's consent to process health data? Not for medical care. The prohibition on processing health data does not apply where the processing is necessary for a medical diagnosis or the provision of health care, under legislation or a contract with a health professional, and the data are processed by or under the responsibility of a professional subject to professional secrecy. For other purposes, the clinic needs another basis. [art. 6](https://conformitate.md/en/law-195-2024/article-6 "Lawfulness of processing") [art. 9](https://conformitate.md/en/law-195-2024/article-9 "Processing of special categories of personal data") ### Does a small clinic have to keep a record of processing activities? Yes, if it processes data concerning health. The exemption for enterprises with fewer than 250 employees does not apply where the processing includes special categories of data, is not occasional or is likely to result in a risk to data subjects. The record is kept in writing, including in electronic form. [art. 30](https://conformitate.md/en/law-195-2024/article-30 "Records of processing activities") ### What should the clinic do if results reached another patient? This is a personal data breach. The clinic notifies the Centre without undue delay and, where feasible, not later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk. If the risk to the patient is high, the clinic informs him or her as well. [art. 33](https://conformitate.md/en/law-195-2024/article-33 "Notification of a personal data breach to the Centre") [art. 34](https://conformitate.md/en/law-195-2024/article-34 "Communication of a personal data breach to the data subject") Related pages [Medical & dental clinics](https://conformitate.md/en/industries/medical-clinics) [Personal data breach: what to do](https://conformitate.md/en/situations/data-breach) [Inspection by the Centre](https://conformitate.md/en/situations/inspection-by-the-centre) [Security and personal data breaches](https://conformitate.md/en/law-195-2024/security-and-breaches) [Principles and legal bases](https://conformitate.md/en/law-195-2024/principles-and-legal-bases) [Fines](https://conformitate.md/en/law-195-2024/fines) --- Provider: conformitate.md · RIGHT CONSULT COMPANY (IDNO 1022600002005) · MD-2072, mun. Chișinău, sect. Botanica, str. Grenoble 259/6, of. 57 Phone: +373 767 27 667 · Email: contact@conformitate.md Prices: https://conformitate.md/en/pricing