Healthcare

In healthcare, two regulations apply to the same data set. Article 9(1) GDPR includes data concerning health among the special categories of personal data — and the same data feed a service whose unavailability shows not as an operational complication but directly on the patient. That is why treating one without the other is not enough.

Which regimes usually concern you

• GDPR. The focus is on accountability: knowing who accessed the records, on what legal basis, and what the documentation says about it. With special categories of data, the risk to the people concerned is higher — and Article 32 GDPR requires controllers and processors to implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the risk of varying likelihood and severity for the rights and freedoms of natural persons.

• Cybersecurity (NIS2). Directive (EU) 2022/2555 lists the sectors of high criticality in its Annex I: energy, transport, banking, financial market infrastructures, health, drinking water, waste water, digital infrastructure, ICT service management (business-to-business), public administration and space. Where it applies, it does so through the national law of each Member State. Whether it covers you, and in which regime, depends on the service you provide, on your size and on the national rules — it cannot be inferred from the industry alone.

• ISO/IEC 27001. It is a practical way to run one system that serves both the security requirements and the evidence needed for data protection.

Connected devices are part of care and part of the network

Hospitals run equipment that is part of patient care and at the same time part of the network — imaging and laboratory systems, infusion pumps, building technology. Such devices often run software that the hospital cannot update or change itself, and some of them cannot be scanned without disturbing their operation.

We include them in the asset inventory and the risk analysis as they are, agree with you what can be assessed and how, and say when the manufacturer or a specialist needs to be involved. We mention this as a risk on your side, not a promise on ours.

We do not carry out penetration tests, threat-led or otherwise.

What we do for healthcare

We take on the role of data protection officer, including the contact point for patients and for the supervisory authority, handle data subject requests and investigate complaints. Alongside that we carry out the risk analysis and the documentation so that the same register of assets and risks serves both regimes at once — and so that the documentation matches how things really work.