Checklist: data protection in medical clinics

☐ Do you process patients’ data concerning health only in one of the cases the law allows, for example to provide medical care by, or under the responsibility of, a professional subject to professional secrecy? art. 9

☐ Do you have a legal basis for each purpose for which you process patients’ data, including appointments, invoicing and reminders? art. 6

☐ When their data is collected, do patients receive the information the law requires: who processes their data, for what purposes and on what legal basis, to whom you disclose it, how long you keep it and what rights they have? art. 12art. 13

☐ Do you keep a written record of processing activities? The exemption for organisations with fewer than 250 employees does not apply where the processing includes data concerning health. art. 30

☐ Can each member of staff access only the patient data they need for their role, so that patient files are not accessible by default to all staff? art. 5art. 25

☐ Do your staff process patients’ data only on the clinic’s instructions? art. 29art. 32

☐ Do you send test results and other data concerning health only through channels whose security measures are appropriate to the risk for patients? art. 9art. 32

☐ Do you keep patients’ data only for as long as the purpose for which it was collected requires, or as long as health legislation requires? art. 5

☐ Do you have a written contract with every provider that processes data on the clinic’s behalf, such as the provider of your patient management software? art. 28

☐ Do you document every personal data breach, and do you know when the National Centre for Personal Data Protection must be notified and when patients must be informed? art. 33art. 34

☐ Have you checked whether you must carry out a data protection impact assessment, where the law requires one, for example before processing data concerning health on a large scale? art. 35

☐ Have you checked whether you must designate a data protection officer? Designation is mandatory where the clinic is a public institution or where its core activities consist of processing data concerning health on a large scale. art. 37