In brief
- Regulation: GDPR.
- Healthcare institutions, professionals, health software publishers and service providers handling health data are all in scope, with no threshold.
- Identify an exemption.
- Conduct a DPIA.
- Using an HDS-certified host.
- Fines can reach €20 M or 4% of global annual turnover.
Regulatory deadlines
The key dates of this regulation.
May 2018
Entry into application
In forceWhat does GDPR cover?
The GDPR classifies health data among the special categories under Article 9, the processing of which is prohibited except by exception. The data concerned includes physical and mental health status, as well as inferred data (results, prescriptions).
In France, protection is strengthened by the obligation to use a certified health data host (HDS) and by the role of the CNIL, which is particularly vigilant in this sector.
Is the 'Healthcare' sector affected?
Healthcare institutions, professionals, health software publishers and service providers handling health data are all concerned, with no threshold. The sensitivity of the data triggers requirements that go beyond those of standard processing.
Organisations that believe they only host 'administrative' data should verify: as soon as a piece of data reveals health status, even indirectly, the enhanced regime applies.
Detailed obligations
Identify an exception
Base each health data processing activity on a specific exception under Article 9 (care provision, public health interest, explicit consent).
Conduct a DPIA
Conduct an impact assessment for large-scale processing of sensitive data, which almost always falls within its scope.
Use an HDS-certified host
Entrust the hosting of health data to an HDS-certified provider, and govern it through a data processing agreement.
Strengthen security
Implement encryption, segmentation, fine-grained access rights management and access logging for files.
Frame information and consent.
Clearly inform patients and obtain, where this is the chosen legal basis, explicit consent.
Control retention periods
Apply the retention periods specific to medical records and archive or delete beyond them.
Sanctions & risks
Fines can reach €20 M or 4% of global turnover. The supervisory authority exercises heightened vigilance over health data and sanctions security and hosting failures.
A health data breach causes major harm to individuals and a severe reputational risk for the organisation concerned.
Common mistakes in the sector
- 1Processing without exception. Processing health data without a valid exception under Article 9.
- 2Missing DPIA. Omitting the impact assessment that is nevertheless near-systematic.
- 3Non-HDS hosting. Storing health data with a non-certified host.
- 4Untracked access. Not logging access to files, preventing any detection of abnormal usage.
Practical case
A healthcare organisation deploys a patient monitoring application hosted by a provider without HDS certification and without a DPIA. An audit identifies both shortcomings. Remediation requires migrating to an HDS-certified host, conducting the DPIA, and implementing access logging — three requirements on which the lawfulness of the system depends.
Compliance roadmap
- 1
Map. Mapping health data processing activities and their locations.
- 2
Qualifying the legal basis. Verify the exception invoked for each processing activity.
- 3
Conduct DPIAs. Conducting the required impact assessments.
- 4
Contractualise HDS. Use a certified hosting provider and formalise the DPA.
- 5
Secure access. Strengthen authorisations, encryption, and logging.
Frequently asked questions
Any data relating to physical or mental health status, including inferred data such as test results or prescriptions.
Take action on GDPR
Free assessment or a chat with an expert dedicated to health.
They already trust us
See how organisations in the health sector secured their compliance with DCO.