IT for a clinic:
what changes

Because the GDPR puts it in a different category. Article 9(1) generally prohibits processing certain special categories of data, including data concerning health, except in the cases the article itself lists, and healthcare provision is one of them. Article 4(15) defines that data broadly: any data relating to a person's physical or mental health, past, present or future, that reveals information about their health status. In practice that covers far more than the medical record: the reason for an appointment in the diary, a treatment estimate, an X-ray on the desktop or an email in which a patient describes what's wrong with them. All of it passes through the same equipment as in any office, but the level of protection expected is higher.

The GDPR doesn't impose a closed list of measures, but measures appropriate to the risk, and among the examples given in Article 32(1) are encryption of personal data and the ability to restore availability of and access to data promptly after an incident. With health data the risk is high by definition, so the sensible approach is for any backup that leaves the premises to be encrypted, for the key not to travel with the backup, and for someone to check from time to time that it can be restored. An unencrypted backup on a drive someone takes home turns a car theft into a health-data breach. A backup that has never been tested may be useless on the day it's needed.

Spain's Patient Autonomy Act (Ley 41/2002) states in Article 16.4 that administrative and management staff at healthcare centres may only access the medical-record data related to their own duties. Translated into IT terms: reception needs the diary, contact details and billing, not the clinical notes. Almost every practice-management system supports user profiles with different permissions, and it's common to find them left unconfigured, with everyone logging in as administrator. Setting up the profiles properly is little work and completely changes the answer to the question of who could have seen a particular piece of data.

Spanish national law, Ley 41/2002 in Article 17.1, sets a minimum of five years from the date of discharge for each episode of care. In Catalonia, Ley 21/2000 also applies: its Article 12, as amended by Ley 16/2010, requires certain documents to be kept for fifteen years from discharge for each episode — such as informed-consent forms, discharge reports, surgical reports, reports on additional investigations and pathology reports — and allows the rest to be destroyed after five years. There are nuances, such as documentation considered especially relevant for clinical, epidemiological or legal purposes, so your clinic's specific schedule has to be set by your legal adviser. Our job is making sure the system can apply it.

In common areas, such as the entrance, waiting room or corridor, yes, with the information sign visible and a proportionate field of view. In rooms where patients are seen, such as the consulting room or treatment room, we don't install them: it's the most private space in the whole clinic, and what would be recorded there is health data. Spain's data protection act (Ley Orgánica 3/2018), in Article 22.3, requires CCTV footage to be deleted within one month of capture at most, unless it must be kept as evidence of specific events. If the camera also covers staff, the specific rules on recording employees apply, and they're strict.

Yes. Whoever maintains your computers or servers accesses, or can access, patient data, and Article 28 of the GDPR requires that processing to be governed by a contract or other legal act setting out its subject matter, duration, nature and purpose, the type of data and each party's obligations. What's more, the controller must only choose processors that provide sufficient guarantees. The same applies to the provider of a cloud practice-management system, the email provider and whoever hosts the backups. If your IT provider has never raised that contract with you, ask for it: their reaction will tell you a lot.

No regulation lists two-factor authentication by name, but with health data it's one of the measures that removes the most risk for the least effort. Most unauthorised access doesn't come from a sophisticated attack but from a password that was reused, written down or stolen through a fake email. With a second factor, that password alone is no longer enough to get in. The priority is to enable it on the clinic's email, on the practice-management system if it supports it, on any remote access and on administrator accounts. And always with personal accounts: two-factor authentication on a shared account offers little protection and leaves no trace of who logged in.