Data breach in a clinic: what to do and who to tell

A data breach in a clinic is any failure that leaves patient data destroyed, lost, altered or within reach of someone who should not have it: a stolen laptop, a report sent to the wrong patient, improper access to a record. You need to contain it, assess the risk, notify the AEPD (the Spanish Data Protection Agency) within 72 hours if required, and always document it.

What a data breach is in a clinic

A breach is not only a cyberattack: it is any incident affecting the personal data the clinic handles. The General Data Protection Regulation (GDPR) defines it in Article 4 as any breach of security leading to the accidental or unlawful destruction, loss or alteration of personal data, or to unauthorised disclosure of, or access to, that data.

The AEPD guide on notifying personal data breaches sorts them into three types, according to what has been compromised: confidentiality (someone sees what they should not), integrity (the data is altered) or availability (the data stops being accessible).

In a clinic the matter weighs more, because almost everything it holds is health data. The GDPR defines it as personal data relating to the physical or mental health of a natural person that reveals information about their state of health, and places it among the special categories of data.

Examples of breaches in a practice

A breach does not need a hacking attack: a moment of distraction or a lost device can be enough. Some possible cases in a practice:

What happens	What is compromised
The reception laptop or the consulting-room tablet is stolen with the session still open	Confidentiality
One patient's report is emailed to another patient	Confidentiality
A clinical photo goes out on WhatsApp to the wrong number	Confidentiality
A member of staff looks up a neighbour's record with no care-related reason	Confidentiality
Paper with patient data is thrown in the bin without being destroyed	Confidentiality
Someone changes a patient's record, by mistake or on purpose	Integrity
Malware locks the computers and neither the diary nor the records can be opened	Availability

The right-hand column is our own guide based on the three types in the AEPD guide, not an official classification: one incident can affect more than one, and each case is assessed on its own circumstances. What helps is that the whole team can recognise them and knows who to tell inside the clinic as soon as they happen.

What to do in the first few hours

In the first few hours there are three things to do: stop the breach, understand what has happened and write everything down. A practical checklist:

1. Contain. Ask the wrong recipient to delete the email, change the affected passwords, recover the paper if you can.
2. Find out. What data, for how many patients, since when and why it happened.
3. Assess the risk. A name and an appointment time is not the same as a report with a diagnosis.
4. Write it down. The time you found out, what you did and who decided each step. You will need it whether or not you notify.
5. Tell your data protection officer, if you have one, from the very first moment.

In Mi Clínica, two tools help in these cases. If a device is stolen with the session open, whoever manages the team can set a new password for that person from “Equipo” (Team), and their open sessions are closed. And if you suspect improper access, the “Actividad” (Activity) tab on the patient's record shows who viewed their medical record and when: it is logged with user, date and time, and it is visible to anyone with clinical access.

When to notify the AEPD: the 72 hours

The clinic, as data controller, must notify the breach to the supervisory authority without undue delay and, where feasible, no later than 72 hours after becoming aware of it, unless it is unlikely to result in a risk to the rights and freedoms of individuals. That is what Article 33.1 of the GDPR says, adding that if the notification is made after 72 hours, the reasons for the delay must be given.

Two details worth keeping in mind:

• Weekends count. The AEPD guide makes clear that the 72 hours also include hours that pass over weekends and public holidays. A breach you discover on Friday afternoon does not wait until Monday.
• You do not need to have everything. If you cannot provide all the information at once, the GDPR allows it to be provided in phases without undue further delay. The AEPD guide describes an initial notification with the preliminary information, completed later by an amendment within 30 days of the initial notification.

The notification must describe, as a minimum, the nature of the breach (with the categories and approximate number of people and records affected, where possible), the contact details of the data protection officer or another contact point, the likely consequences and the measures taken or proposed. It is submitted through the form on the AEPD's online portal.

When to tell patients

Affected patients must be told when the breach is likely to result in a high risk to their rights and freedoms. Article 34 of the GDPR requires this to be done without undue delay and in clear and plain language, explaining what has happened, who they can turn to, the likely consequences and the measures taken.

With health data it is worth weighing this with particular care: the AEPD guide itself gives as an example of urgent action the online disclosure of special categories of personal data. As for how, the guide recommends contacting the person directly, by telephone, email, SMS, post or another means addressed to them.

Article 34 provides for cases where the communication is not necessary, for example if the clinic has taken subsequent measures ensuring that the high risk is no longer likely to materialise. If in doubt, consult your data protection officer or adviser before ruling it out.

Always document it, even if you do not notify

Every breach is documented, including one you decide not to notify. Article 33.5 of the GDPR requires the controller to document any personal data breach, including the facts relating to it, its effects and the remedial action taken.

The AEPD guide adds that this incident log must also record the decisions on notifying the authority and informing those affected, and that there is no standard model for an incident log: each organisation uses whichever fits best into its own management. In a small clinic, a tidy sheet with the date, what happened, who was affected, what was done and what was decided may be enough, kept out of reach of anyone who does not need it.

This log is kept alongside the rest of the clinic's data protection documentation, which we go through in data protection in a clinic.

What reduces the risk day to day

In a clinic, preventing a breach is above all a matter of organisation. Some simple measures:

• Let each person see only what they need. In Mi Clínica permissions work by role: “Recepción” (Reception) handles the diary, patients, payments and administrative documents with nothing clinical, and the healthcare professional sees their own diary and their own clinical area.
• One user per person. Without shared logins, the log of who views a record is actually useful.
• No patient data on personal mobile phones or in private chats.
• Check the recipient before emailing a report.
• Know what your supplier does. If a data processor, such as your management software, suffers a breach, the GDPR requires it to notify you without undue delay.

If your clinic needs a data protection officer, they will be the one to guide you through all this; we explain it in data protection officer in a clinic. The rest of what Mi Clínica does is on its home page (in Spanish).

Sources consulted

Checked on 11 October 2026. We link to the original source so that you can consult the current text.

• Reglamento (UE) 2016/679, Reglamento general de protección de datos. BOE (DOUE).
• Guía para la notificación de brechas de datos personales (v. junio de 2021). AEPD.