Data protection
Articles in the “Data protection” category of the Mi Clínica blog.
Data protectionWho Can See the Medical Record in a Private Clinic
Spain’s Law 41/2002 gives access to the record to the practitioners who diagnose or treat the patient, limits administrative staff to the data their functions require and recognises the patient’s right of access. How to organise it by role and how Mi Clínica handles it.
· 9 min read
Data protectionRecord of processing activities in a clinic (GDPR Article 30)
What the record of processing activities is, why a clinic must keep one even if it is small, what each activity must say under Article 30 of the GDPR, the typical activities of a clinic and how to keep it up to date.
· 8 min read
Data protectionData protection information notice for patients
What information each patient must be given about their data under the GDPR, when, how it is done in layers under the LOPDGDD, how to write it so it is understood and how to hand it over at reception with the signature on the tablet.
· 8 min read
Data protectionInformed Consent and Data Protection: Two Different Documents
Informed consent authorises an action on the patient’s health (Spain’s Law 41/2002); consent to process data is only one of the GDPR legal bases. It is not needed to treat the patient; it is needed for photos on social media, and the AEPD (the Spanish Data Protection Agency) also asks for it for advertising. Typical mistakes and how to keep them apart.
· 7 min read
Data protectionData protection in a clinic: the basics you need in place
The basics of data protection in a private clinic in Spain: why health data is special and what its processing rests on, what patients must be told, the record of processing activities, security, when a data protection officer is needed, processors and breaches.
· 9 min read
Data protectionData protection officer in a clinic: do you need one?
Spain's LOPDGDD requires healthcare centres that keep medical records to appoint a data protection officer, except health professionals who practise on their own account. Who can be one, what the role involves, how to notify the Spanish Data Protection Agency (AEPD) and what an officer will want to see in your software.
· 8 min read
Data protectionDoes your clinic need a data protection impact assessment?
When a clinic needs a data protection impact assessment: what the GDPR says about health data on a large scale, the Spanish AEPD's list and its two-criteria rule, three typical situations and the minimum content of the assessment.
· 8 min read
Data protectionData breach in a clinic: what to do and who to tell
What to do about a data breach in a clinic: recognise it (stolen laptop, report sent to the wrong patient, improper access), contain it, notify the AEPD within 72 hours when there is a risk, tell patients if the risk is high and always document it.
· 8 min read
Data protectionBefore-and-after patient photos: consent and use on social media
A photo taken in the consulting room is personal data and can reveal health information, and publishing it also affects the right to one's own image. How to separate clinical use from marketing, what the authorisation must say, what happens with minors and how to organise it in the clinic.
· 7 min read
