Data protection in a clinic: the basics you need in place

Data protection in a private clinic starts from one idea: health data is a special category. Processing it requires a legal basis, informing every patient, keeping a record of processing activities, applying security measures appropriate to the risk, appointing a data protection officer if you are a healthcare centre (unless you practise individually) and choosing carefully whoever processes data on your behalf.

Why a clinic's data is special

The health data a clinic handles is special because the GDPR (the EU General Data Protection Regulation) includes it among the special categories of personal data. The General Data Protection Regulation defines data concerning health as “personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status”. A good part of what is noted in a patient's file fits that definition.

Article 9 of the GDPR prohibits processing data concerning health except in the cases it lists. The one that fits a clinic's daily work is point (h): that the processing is necessary for medical diagnosis or the provision of health care or treatment. For that purpose, the GDPR sets a condition: that the processing is carried out by a professional subject to professional secrecy or by someone under their responsibility, or by another person also subject to secrecy.

In Spain this is set out by the seventeenth additional provision of the LOPDGDD (the Spanish organic data protection law): it declares that the processing of health data regulated in several laws, among them Law 41/2002, the basic law regulating patient autonomy, is covered by points (g) to (j) of article 9.2.

The practical consequence is summed up by the AEPD (the Spanish Data Protection Agency) in its guide for patients and users of healthcare: the healthcare centre does not need to ask for the patient's consent to collect and use their health data for medical diagnosis or the provision of healthcare. It will have to ask for it for some other purposes; the guide itself gives the example of the physiotherapist who wants to send advertising.

If your centre is not a healthcare centre, for example an aesthetics centre with no healthcare activity, the basis for processing health data may be a different one: check with your adviser before copying what a medical clinic does.

Informing each patient

Not needing consent to treat them does not exempt you from informing them. Under article 13 of the GDPR, when you obtain the data from the patient themselves you must provide them, at that moment, among other things, with:

• the identity and contact details of the clinic, and those of the data protection officer, where applicable;
• the purposes of the processing and its legal basis;
• the recipients of the data, if any;
• the period for which they will be kept, or the criteria used to determine it;
• their rights, including the right to lodge a complaint with a supervisory authority.

The LOPDGDD allows this to be done in two layers: basic information, with the identity of the controller, the purpose and the possibility of exercising rights, and an email address or other means that gives simple and immediate access to the remaining information. What to put in each layer and how to hand it over at reception is explained in how to inform patients about their data.

The record of processing activities

The record of processing activities is the inventory of what the clinic does with personal data, and article 30 of the GDPR requires each controller to keep one. Among other things, it contains the purposes of each processing, a description of the categories of data subjects and of data, the categories of recipients and, where possible, the envisaged time limits for erasure and a general description of the security measures.

What if the clinic is small? The GDPR exempts organisations employing fewer than 250 people from keeping it, but not where the processing includes special categories of data, such as health data. In practice, a clinic that processes medical records cannot rely on that exception because of its size. How to organise it around a clinic's typical activities (patients, appointments, invoicing, team) is covered in the record of processing activities in a clinic.

Security and confidentiality

The GDPR does not give a closed list of security measures: it requires the controller to apply appropriate technical and organisational measures to guarantee a level of security appropriate to the risk, taking into account, among other things, the nature, scope, context and purposes of the processing.

With health data, the LOPDGDD puts you on notice: among the higher-risk cases to be taken into account it cites the processing, other than merely incidental or accessory, of special categories of data. And it adds that controllers will assess whether an impact assessment is called for; when that applies in a clinic is covered in the impact assessment in a clinic.

Confidentiality is also a measure. The LOPDGDD subjects to a duty of confidentiality all persons involved at any stage of the processing, and that duty continues even after their relationship with the controller has ended. And the GDPR requires measures so that anyone acting under the authority of the controller who has access to personal data can process it only on the controller's instructions.

In a clinic, that translates into concrete habits:

1. One user per person. No shared passwords at reception: otherwise there is no way of knowing who did what.
2. Each role sees what it needs. Whoever books appointments and takes payments does not need to read the progress notes.
3. Joiners and leavers up to date. Anyone who leaves the clinic loses access the same day.
4. No patient data on personal phones or in private chats.
5. Periodic review of who has access to what and of who has consulted each record.

The data protection officer

A healthcare centre that is obliged to keep medical records must appoint a data protection officer. The LOPDGDD includes in its list “healthcare centres legally obliged to maintain patients' medical records”, and exempts health professionals who, even though legally obliged to maintain medical records, practise individually.

The AEPD's guide for patients gives examples of both sides: hospitals, health centres, specialist care centres and clinics must have an officer; private practices of a single healthcare professional need not. Who can be one, what functions they have and how they are notified to the AEPD is explained in the data protection officer in a clinic.

Suppliers who process data for you, and breaches

A supplier that processes your patients' data on behalf of the clinic, such as cloud management software, is a data processor. Article 28 of the GDPR requires the clinic to choose only a processor that offers sufficient guarantees, and that the relationship is governed by a contract or other legal act setting out the subject matter, duration, nature and purpose of the processing, the type of personal data and categories of data subjects, and the obligations and rights of the controller. That contract will be in writing, including in electronic form.

Ask for it before putting the first patient into a new service, and note it in your record of processing activities alongside what each supplier processes.

If something goes wrong, for example improper access or the loss of a laptop holding data, the GDPR requires the security breach to be notified to the supervisory authority without undue delay and, where feasible, no later than 72 hours after becoming aware of it, unless it is unlikely to result in a risk to the rights and freedoms of individuals.

What Mi Clínica does and what the clinic decides

It is the clinic that complies with the rules: the software does not certify compliance with any rule. What Mi Clínica does do is make some of the measures in this article easier:

• Each clinic, isolated. No clinic can see another's data.
• One user per person and permissions by role. Each team member signs in with their own user and sees what belongs to their role. By default, “Recepción” (Reception) handles the diary, patients, payments and administrative documents, with no clinical permission, and the healthcare practitioner sees their diary and their clinical part.
• Who changes permissions. Individual permissions are changed by whoever holds the management permission, which by default “Dirección” (Management) and “Administración” (Administration) have, except for clinical matters (access to the record and the prescription), which only “Dirección” grants or removes, and permission changes are logged. It is best for few people to hold that permission.
• Access trail. Who consults the medical record is logged, with user, date and time. Consultations of documents and photos are also noted.

What the software does not do is write your complete patient information notice, keep your record of processing activities or decide what each role needs to see: that is decided by the clinic, with its adviser. A summary of features is on the Mi Clínica page (in Spanish).

Sources consulted

Checked on 11 October 2026. We link to the original source so that you can consult the current text.

• Reglamento (UE) 2016/679, Reglamento general de protección de datos. BOE (DOUE).
• Ley Orgánica 3/2018, de Protección de Datos Personales y garantía de los derechos digitales (texto consolidado). BOE.
• Guía para pacientes y usuarios de la Sanidad. AEPD.
• Ley 41/2002, básica reguladora de la autonomía del paciente y de derechos y obligaciones en materia de información y documentación clínica (texto consolidado). BOE.