GDPR for medical clinics: what applies in practice

A clinic handles some of the most sensitive data anyone has every day: diagnoses, treatments, lab results. GDPR does not stop you from working with that data, but it does ask you to know on what basis you process it, who has access, and what you do when something goes wrong. Below are the rules that matter for a practice or clinic, and a checklist.

This article is for general information and is not legal advice. Check the current wording and how it applies to your clinic with your lawyer or data protection officer. The examples refer to Romania; in Belgium, the national rules and the supervisory authority differ.

Health data is a special category

Art. 9 GDPR prohibits processing health data as a rule, then lists the exceptions. For a clinic, the relevant exception for medical work is Art. 9(2)(h): processing for preventive medicine, medical diagnosis, care or treatment, by professionals subject to professional secrecy.

On top of the Art. 9 exception, you also need a basis under Art. 6. For the medical record, this is usually:

• Art. 6(1)(c), compliance with a legal obligation, for the medical documentation the law requires you to keep;
• Art. 6(1)(b), performance of the contract with the patient, for appointments, services and invoicing.

Consent is not the basis for the medical record

A common mistake is asking the patient for “GDPR consent” to treatment. Consent can be withdrawn at any time, and you cannot delete the medical record on request, because the law requires you to keep it. Informed consent to a medical procedure is a different thing, governed by medical law, not by GDPR.

GDPR consent is still needed for marketing: newsletters, offers, campaigns. For electronic marketing (SMS, email, messaging apps) in Romania, Law 506/2004 also applies.

Reminders are not marketing

A message reminding a patient of their appointment is part of the service they asked for. An offer for another procedure is marketing and needs separate consent. Do not mix the two in the same message.

The documents you need

Records of processing activities

Art. 30 requires records of processing activities: what data you process, for what purpose, on what basis, who you share it with, how long you keep it and how you protect it. The exemption for organisations with fewer than 250 employees does not apply when you process special categories of data, so a clinic must keep these records whatever its size.

Data protection officer (DPO)

Art. 37(1)(c) requires a DPO when the core activity involves large-scale processing of health data. Recital 91 states that the processing of patient data by an individual physician is not considered large-scale. A hospital or a clinic group with many locations is very likely to fall under the obligation. For cases in between, document the decision and the reasoning with your lawyer.

Data protection impact assessment (DPIA)

Art. 35 requires a data protection impact assessment before processing that is likely to result in a high risk. In clinics, typical examples are large-scale processing of health data or introducing new tools, such as AI-based tools that analyse patient data.

Your vendors are processors

Anyone who processes patient data on your behalf needs a contract under Art. 28 (a data processing agreement, DPA). The usual list for a clinic:

• your medical and booking software vendor;
• external labs, when they process data on your behalf (some may be independent controllers, check each one’s role);
• SMS, WhatsApp or email providers used for messages;
• external accountants;
• IT and hosting companies.

The contract must state, among other things, that the vendor processes data only on your instructions, keeps it confidential, which security measures it applies and what happens to the data at the end.

Data security

Art. 32 requires technical and organisational measures appropriate to the risk. For a clinic, a reasonable minimum looks like this:

• roles and access rights: the front desk sees appointments, not every clinical note;
• access logs: you can find out who opened a record and when;
• two-factor authentication for every account with access to patient data;
• encryption of data in transit and at rest;
• backups that are tested, not just scheduled;
• staff offboarding: accounts are disabled on the day the person leaves.

When an incident happens

If a personal data breach occurs (a lost laptop, an email sent to the wrong person, a compromised account), Art. 33 requires you to notify the supervisory authority, ANSPDCP in Romania, within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to individuals. If the risk to patients is high, Art. 34 requires you to inform them too, without undue delay.

Keep an internal log of all incidents, including those you do not notify, with the reasoning for the decision.

Patient rights

Right	What it means for the clinic
Access (Art. 15)	The patient receives a copy of their data; the first copy is free
Rectification (Art. 16)	You correct inaccurate data without altering the medical history
Erasure (Art. 17)	Limited by the legal duty to keep medical documentation
Portability (Art. 20)	For data the patient provided, processed by automated means on the basis of contract or consent
Objection to marketing (Art. 21)	You stop marketing messages straight away

As a rule, you reply within one month of receiving the request (Art. 12). Check the identity of the person asking before you send any data.

Retention periods

How long you keep the medical record, imaging or financial documents is not set by GDPR but by national law (medical, accounting, archiving). Periods differ by document type. Confirm them with your lawyer and write them into your records of processing.

Checklist

• You have up-to-date records of processing activities.
• You have documented the legal basis for each purpose, without consent for the medical record.
• You have separate, provable consent for marketing.
• You have assessed whether you need a DPO and documented the conclusion.
• You have Art. 28 contracts with every vendor that processes data on your behalf.
• Access is role-based, with two-factor authentication and access logs.
• Backups are tested regularly.
• You have a written incident procedure and know who notifies the authority.
• You have a procedure for patient requests and response deadlines.
• Retention periods are confirmed with your lawyer and applied.

Clinesto provides roles and access privileges, restricted access per record, an audit log of changes, two-factor authentication and a data processing agreement under Art. 28. Your clinic’s compliance documents and decisions remain your responsibility and your lawyer’s.