Introduction
Healthcare organisations handle a wide spectrum of data — from financial records and health insurance information to patient test results and biometric information. Some of these data types are more sensitive than the typical information collected by non-healthcare organisations.
According to Articles 13-15 of the GDPR, there are three types of personal data relevant to the healthcare industry that need to be protected:
Health data
Any data that is related to a person’s physical or mental health is considered personal and protected under the GDPR. This includes any information related to the type of care a person receives.
Biometric data
Biometrics refers to the physical or behavioural characteristics of a person. The GDPR defines such information as personal, as it can be used to identify a specific person. It includes facial images, fingerprints, gait traits, etc.
Genetic data
Information related to a person’s genetic makeup. It includes any lab results connected with the analysis of a biological sample as well as any characteristics that might reveal details of a patient’s physiology or health.
Healthcare providers should give patients correct information about their rights, for what purposes their health-related personal data is processed and how it is processed as well as by whom, for how long, and additional information.
For health data, the majority of EU countries have a form of doctor-patient confidentiality, where even treatment data sharing with third parties, including other medical professionals, generally demands the patient’s consent. So what other unique industry points need to be taken into account while working with private information?
One unified source of data
How quickly and coherent an organisation responds to the patient’s needs sometimes influences not only the health but also the life of the patient, so the whole system must be able to recognise and connect the data received personally from the patient and data that came from software and other organisations.
Requirements for apps, profiling, and big data
Apps are becoming a very important part of the healthcare sphere. Thanks to mobile devices, users can benefit from health services provided anywhere. But it also may imply special risks for their health data. The GDPR outlines what data protection requirements should be paid special attention to and what additional legal requirements must be taken into account.
Requirement to comply with multiple frameworks
GDPR compliance is absolutely vital in the healthcare industry, as it helps to prevent personal data breaches and so to protect the most sensitive information that each individual has. For this purpose, healthcare organisations must have a secure, digital, technological system led by skilled trained staff strictly following rules and regulations.
Reporting a breach
If a breach of personal data occurs, a healthcare organisation may be required to inform the relevant Data Protection Authorities. Under serious circumstances, there may be a necessity to inform the individuals whose data has been put at risk. DPIAs are required if an organisation’s data processing activities could pose a risk to the rights and freedoms of individuals.
Why is it Important?
Healthcare cyberattacks are now more frequent, with bigger financial losses and more patient data compromised by exposure.
The increase in cyberattacks is largely down to the COVID-19 pandemic, as resources were ploughed into COVID-19 responses, drawing attention away from cybersecurity. Healthcare has been targeted by a wave of cyberattacks as a result.
With so much sensitive data at stake, healthcare data breaches are some of the most damaging leaks when compared to any other industry.
Around 50% of healthcare data breach victims suffered medical identity theft, with an average out-of-the-pocket cost of $2,500 for patients.
Client Specific Needs?
Consistent data management approach
The business is very diverse with a wide range of activities from health provision to property management and fundraising. There was a challenge in ensuring a consistent approach to data management.
Back data alignment with the GDPR
Retention schedules for the whole organisation needed review and analysis of their GDPR compliance.
Subject requests processing systematisation
The nature of the organisation implies that we constantly receive subject data access requests that require a lot of resources to proceed with, so one of the key needs we had before the ROBUS’ launch was a formalised way of dealing with such requests.
