Home / Healthcare sector
Health sector
Health data and HDS
A relationship involving health data must distinguish between data processing, international transfer, and any hosting activity carried out on behalf of third parties.
Effect of this requirement
This rule cannot be read in isolation.
- Transfers
- Bilateral relationship
- Country sources reviewed on
Assumptions, limitations and sources of this reading
Reading point
Health data requires precise mapping
The nature of the operations and roles precedes any conclusion on hosting.
- Nature and identifiability of health data
- Role of each entity in the processing
- Ongoing hosting, one-off processing or simple exchange
- Access from abroad, subcontractors and return of data
- Qualification of HDS scope according to actual activity
Health role chain
Identify the parties, data and hosting involved before reaching a conclusion on HDS.
Data controller
The healthcare organisation defines the purposes and the framework of the processing.
Primary supplier
It describes the service provided, its locations of delivery and the data concerned.
Hosting and operations
Activities falling under hosting are isolated from other services.
Sub-processors and access
Every actor, remote access and transfer remains known and controlled.
Decision path
Separate health data, processing and hosting
The presence of medical data alone does not settle the question of GDPR roles or the scope of HDS certification.
01Data and purpose
Describe the data received, whether it is identifiable, the reason for its processing and the level of detail actually required by the service.
02Role of each party
Distinguish who decides the purposes, who acts on instruction, who provides the infrastructure and who can access the environments concerned.
03Activity performed
Qualify separately long-term retention, administration, backup, one-off processing, manufacturing or simple file exchange.
04Demonstrated execution
Link processing locations, access rights, subcontractors, incidents, return and deletion to the health scope actually entrusted.
Health scope
The distinctions needed before assembling the evidence file.
Questions to address
- What health data is received and for what purpose
- Who decides on the processing and who acts on its behalf
- Where data is stored, accessed and processed
- If the activity actually performed constitutes health data hosting
Elements that support the response
- Mapping of datasets and their identifiability
- Documented instructions from the data controller
- Register of access rights, processing locations and subcontractors
- Return, deletion and incident management procedures
Confusions to avoid
- Inferring HDS scope from the mere presence of medical data
- Conflating manufacturing, one-off processing and ongoing hosting
- Sending more data than is necessary for manufacturing or the service
- Forget local copies, temporary exports and support access
Assurance file, AC-017Demonstration example
Client requirementPrivileged access is reviewed every quarterFinding
Proposed responseA quarterly review is carried outFinding
Available evidenceIAM export, validations, departure ticketsFinding
Divergence observedExternal providers' accounts are excludedGap
ImpactThe answer is only partially supportedGap
ActionExtend the scope and produce traceable validationDecision
Reading the coloursFactual observationGap or riskDecision or action
Demonstration
Assign roles before concluding on healthcare data hosting.
The case distinguishes purpose, processing, infrastructure and administrative access so that health data alone does not trigger an incorrect overall qualification.
Understanding how evidence is qualified →Apply this reading
Specify health data, roles and hosting operations.
The nature of the data, the purpose of the service, the parties involved and the infrastructure operations make it possible to distinguish processing from hosting.