GDPR in Healthcare: Why Is Compliance Essential?

Triskle GRC understands the critical importance of protecting customer and employee data in any industry, given the growing number of security incidents that result in financial losses and, often, emotional distress—especially in areas where the data shared is highly sensitive.

Since August 2020, the General Data Protection Law (LGPD) has been in effect, providing a legal foundation for a secure environment. The LGPD establishes guidelines for data processing, whether in the physical or digital world, making it essential to standardize regulations and practices regarding the collection and storage of information.

Specifically, in the healthcare sector, Triskle GRC has observed a profound impact. A study by Tenable, a company specializing in cyber risks, found that 43% of data breaches originated in Brazil between November 2021 and October 2022. The healthcare sector accounted for 35.4% of all cybercrime cases during that period.

The National Data Protection Authority (ANPD) revealed that, among the eight cases related to reported data breaches, surprisingly, four of them involve healthcare companies. Notably, the Ministry of Health is involved in two of these cases. In addition, the Santa Catarina State Department of Health and Iamspe (São Paulo Institute for Assistance to State Public Servants) appear on the list of institutions linked to these violations, underscoring the importance of a rigorous approach to data privacy in the healthcare sector.

In addition, the Santa Catarina State Department of Health and Iamspe (São Paulo Institute for Assistance to State Public Servants) appear on the list of related institutions and have already been formally sanctioned by the ANPD, with violations deemed serious, underscoring the importance of a rigorous approach to data privacy in the healthcare sector.

The LGPD requires institutions to establish rules for best practices and governance, covering organization, operations, procedures, complaints and requests from data subjects, security, technical standards, and obligations for those involved in data processing. It is imperative that companies review their processes to identify potential vulnerabilities. The identification and secure storage of information, supported by cloud systems, are crucial. Medical records, laboratory tests, X-rays, clinical reports, diagnoses, and prescriptions must be given special consideration.

It is clear that it is of the utmost importance for healthcare companies to remain fully compliant with the LGPD and to strictly adhere to its guidelines. Only in this way can we prevent unauthorized access to sensitive patient data, thereby safeguarding the reputation of these institutions and the financial interests of all parties involved.

See the full Tenable report at: https://pt-br.tenable.com/cyber-exposure/tenable-2022-threat-landscape-report