A Privacy Tools It supports healthcare institutions in handling sensitive patient data with traceability, responding to data subjects within the deadline, and demonstrating compliance with audits, agreements, and the ANPD (Brazilian National Data Protection Authority).
Health data is sensitive personal data: a LGPD It imposes stricter legal hypotheses for its treatment, prohibits its use for risk selection by operators, and requires proportionate safety measures. Medical records, exams, clinical research, agreements, and partner laboratories are multiplying the points of collection and sharing.
A Privacy Tools It organizes this scenario into a single environment: mapping treatment activities by unit and specialty, discovering sensitive data in systems, assisting patients exercising their rights, responding to incidents, and evaluating suppliers who access data.
Health data are sensitive personal data (art. 5, II, of the LGPDThe processing is only permitted in the cases outlined in Article 11, such as specific and explicit consent, compliance with a legal obligation, protection of health in procedures carried out by health professionals or services, and protection of life. Article 11, § 4, prohibits the communication or shared use of health data between controllers for the purpose of obtaining economic advantage, except in exceptional cases, and § 5 prohibits health plan operators from using this data for risk selection. ANPD The Federal Council of Medicine (medical records, confidentiality, and telemedicine) completes the picture, and hospitals providing care to foreigners may be subject to... GDPR.
Tests delivered to the wrong patient or withdrawal requests handled via email without proper oversight; medical records accessed by professionals unnecessarily; health data stored in shared spreadsheets and folders; health insurance companies and laboratories with broad access without operator contracts; results and telemedicine applications without adequate consent; and marketing campaigns based on diagnoses. Each of these risks corresponds to a module of the platform.
A D'Or NetworkThe largest private hospital group in the country has implemented data mapping and workflows, patient consent processes, data subject management, and cookie and policy management across all its portals. AFIPAt the largest laboratory in the SUS (Brazilian public healthcare system) outpatient network, requests for test results have dropped from up to 200 per day to about 20 per month. Unimed Ceará has adapted its websites with cookie management. See also the page about... LGPD and the entry sensitive personal data.
Not for healthcare purposes: the LGPD (Brazilian General Data Protection Law) allows the processing of health data for the protection of health in procedures performed by healthcare professionals and services (art. 11, II, “f”). Specific and explicit consent is required for purposes beyond this, such as marketing or research not supported by another basis.
Yes. Access to data is the right of the data subject (article 18, II), and the medical record belongs to them; the CFM (Federal Council of Medicine) also guarantees this access. The DSAR module authenticates the patient and organizes the delivery within the deadline.
When they process data on behalf of the hospital, yes, and the hospital is responsible for the processing they perform. It's necessary to evaluate the data, formalize a contract, and register the data sharing in ROPA; Third-Party Risk Management structures this process.
Almost always, because sensitive data in large volumes poses a significant risk to the data subjects. Notification must occur within three business days, describing the data, the data subjects, and the measures taken; patients must also be informed.
Yes. Data Discovery is the only module of Privacy Tools which can operate on-premise, for institutions whose security policy does not allow reading internal databases from the cloud.
Request a demo from our team and see the platform in the context of your healthcare institution.
