To protect patient data, start by accepting that the clinic is the controller of that data, then put five things in order: tell patients how their data is used, separate the few cases that really need consent, keep a record of what you process, limit access to patient records by role, and write down in advance what you will do when a patient asks for their data or a breach happens. Most of this is set up once and then becomes a daily habit.
This article gives practice owners a general framework and a checklist based on the EU’s General Data Protection Regulation (GDPR) and Turkey’s Personal Data Protection Law (KVKK). The two differ in detail, and other countries have their own rules; for questions specific to your practice, talk to a data protection adviser.
Who is responsible for what?
The person who decides why and how personal data is processed is the controller. In a clinic that is the clinic itself, or the doctor who owns the practice. The company that provides your patient software processes data on your behalf, as a processor.
The distinction has a practical consequence. However secure the software is, informing patients, answering their requests and organising staff access remain your work. The division of duties between you and the software provider is put in writing in a data processing agreement, which GDPR requires and KVKK expects in substance.
Why health data is a category of its own
Both laws give health data extra protection as a special category of personal data. Both also allow it to be processed without the patient’s explicit consent when it is needed for medical diagnosis, treatment and care, by professionals bound by confidentiality.
That does not mean everything can be done without consent. For purposes outside care, such as posting before-and-after photos on social media or using the data for marketing, you need separate, freely given consent. Consent must never be made a condition of treatment.
The checklist
Go through the items in order and mark each one "in place", "missing" or "not sure".
- Privacy notice: When you first collect a patient’s data, do you tell them what you collect, why, who receives it and what their rights are? If you use an online booking page, it should link to this notice. To see what a published notice looks like, Clinigim’s own privacy notice is an example.
- Consent: Where consent is needed, is it asked separately from treatment, with its own clear yes or no?
- Records and registration: GDPR expects a record of processing activities; in Turkey the controller may have to register with the data controllers’ registry (VERBİS). One of the Turkish exemption criteria is that processing personal data is not a core part of the business, so health providers should check their position carefully.
- Access control: Does each person see only the records their job needs? A receptionist does not need clinical notes, and a trainee does not need cash reports.
- Technical measures: Strong passwords, two-step verification, updated devices, encrypted backups and an access log.
- Staff: Have staff signed a confidentiality undertaking and received a short briefing? Is a leaver’s access closed the same day?
- Retention and deletion: Is it written down how long each kind of record is kept and how it is destroyed afterwards? Periods depend on health and tax rules; set them with your adviser.
- Patient requests: Who answers when a patient asks for their data? GDPR gives you one month in most cases; KVKK gives 30 days.
- Breaches: Is it clear what happens if a device is stolen or someone gets unauthorised access? Both GDPR and Turkish practice require notifying the authority within 72 hours of becoming aware of a breach, unless it is unlikely to put people at risk under GDPR.
- Providers and transfers: Do you have data processing agreements with your software, accounting and messaging providers? If data is stored in another country, is the transfer basis written down?
What data protection looks like in daily work
Most of the work happens in habits, not documents. A few examples:
- Patient names and appointments should not stay open on a screen visible from the waiting room.
- Appointment and balance reminders should not name a diagnosis or treatment, and should go only to the patient’s own number. More in our article on appointment reminders.
- Patient photos and reports should not circulate on personal phones or in group chats.
- Printed documents should not be left on desks, and those no longer needed should be destroyed.
- On a shared computer each person signs in with their own account; passwords are never shared.
Do you need a DPO or an impact assessment?
Under GDPR, a data protection officer is required when the core activity involves large-scale processing of special-category data, and an impact assessment is required for processing likely to result in high risk. The regulation itself notes that processing patient data by an individual physician is not considered large scale. A single practice is therefore often outside both duties, while a large clinic group may not be. Check your own case with an adviser.
Questions to ask when choosing software
When comparing patient software, ask where the data is stored, where the backups are, who can see what, and whether actions are logged. Check whether the provider publishes a data processing agreement and a list of subprocessors. The other questions to ask are in how to choose patient tracking software.
Where Clinigim helps
In Clinigim each clinic sees only its own data. Doctors, receptionists, assistants and managers are added with separate permissions, actions are logged, and two-step verification can be used at sign-in. Free-text clinical notes are stored encrypted. For each file uploaded to a patient, the access history shows who viewed or downloaded it, and quick notes are private to the person who writes them.
Clinigim is developed and operated in Turkey; the database sits in a data centre in Turkey, while patient files and encrypted backups are kept in data centres in the EU. Details are on the security page, the division of duties between you and us is in the data processing agreement, and the texts Clinigim publishes as a controller itself are on the KVKK page. Clinigim booking pages link to a privacy notice prepared on the clinic’s behalf.
What it does not do: Clinigim does not register you with VERBİS or any other authority, and it does not write your clinic’s privacy notice or retention policy. Those belong to the clinic as controller.
Frequently asked questions
Does a small practice need a privacy notice?
Yes. Every controller that collects personal data from patients must tell them, at the time of collection, what is collected, for what purpose and on what legal basis, who may receive it and what their rights are. Making the notice available on the registration form, somewhere visible in the clinic and on the online booking page is the most practical way to do it.
Do I need the patient’s consent to treat them?
Under both GDPR and KVKK, health data may be processed without explicit consent when it is needed for medical diagnosis, treatment and care by professionals bound by confidentiality. Purposes outside care are different: sharing before-and-after photos or using the data for marketing needs separate consent, freely given and never made a condition of treatment.
How quickly must I answer a patient who asks for their data?
Under GDPR you must answer without undue delay and within one month in most cases; the period can be extended for complex requests if you tell the patient why. Under KVKK the limit is 30 days. Decide in advance who in the clinic handles such requests, how the patient’s identity is checked and in which format the data is given.
What should I do after a data breach?
First stop it: sign out the lost device, change passwords and block the unauthorised access. Then write down what happened, whose data was affected and when. Notify the supervisory authority within 72 hours of becoming aware of it where the law requires, and tell the affected patients when the breach puts them at risk. Keep a record of every breach, even minor ones.