Scenarios · Healthcare

A hospital group with research and telemedicine

Sint Amandus is a hospital group with three sites in Belgium, an outpatient network, a research institute that is a separate legal person, and a telemedicine platform bought as a service. It processes health data, criminal conviction data in a small forensic unit, and it discloses to a national cancer registry under national law. It is the hardest kind of organisation to hold in a register, because the same patient record is used for care, for research and for a statutory disclosure, each on a different basis.

Who and what appears in this scenario

Each kind of record keeps the same mark throughout, so the same name always means the same thing.

Entity

Sint Amandus Hospital Group — The controller for every clinical activity.
Sint Amandus Research Institute — A second controller, separate legal person, runs the research.
Telecura — The telemedicine platform vendor, acting as processor.
National Cancer Registry — The recipient of a statutory disclosure.

Business unit

Ghent, Bruges, Ostend — One unit per hospital site.
Outpatient network — Clinics outside the three sites.
Forensic unit — The only place criminal conviction data is processed.

Data subject set

Inpatients — Admitted patients. Special category health data, includes children.
Research participants — The subset whose data is used for research.
Clinical staff — Employees, for access logging and rostering.

Processing activity

Provision of inpatient care — Article 6(1)(c) and (e) with the Article 9(2)(h) condition.
Secondary use for clinical research — Article 6(1)(e) with Article 9(2)(j) and Article 89 safeguards.
Statutory disclosure to the cancer registry — Article 6(1)(c) with the Article 9(2)(i) condition.
Telemedicine consultations — Delivered on the vendor platform.

Assessment

Telemedicine impact assessment — Article 35, citing the risk records.

Transfer

Platform support from outside the Union — Clauses plus a transfer impact assessment.

Risk

Reminder message discloses a condition — High harm to the individual, low cost to treat.

Measure

Neutral message templates — The treatment that carries the risk down.

Document

Data processing agreement, Telecura — The Article 28(3) terms.

Person

Dr Katrien Vermeersch — Data Protection Officer, approver on assessments.
Joris Maes — Head of digital care, owner of the telemedicine activity.
Professor Ilse Baeten — Research director, owner of the research activity.

How it gets built

The shape of the organisation

Everything else hangs from the parties and the places, so they are recorded first. Two legal persons means two controllers, not one controller with a department.

The entity register. Each party carries its role, its state and the country it is established in.

Entity: Sint Amandus Hospital Group

What is held: The controlling legal person, with its supervisory authority and its Data Protection Officer.
Why: The hospital decides the purposes of care, so it is the controller for every clinical activity. The Data Protection Officer is mandatory here under Article 37(1)(c), because health data is processed on a large scale.

Entity: Sint Amandus Research Institute

What is held: A second controller, related to the group but a separate legal person.
Why: Research decides its own purposes and holds its own ethics approvals. Recording it as a separate controller is what allows the research activity to have a different basis from the care activity.
Alternative: If the institute were a department rather than a legal person, it would be a business unit under the hospital instead, and the research activity would sit with the hospital as controller. Choose by who decides the purpose, not by who sits in which building.

Business units: Ghent, Bruges, Ostend, Outpatient network, Forensic unit

What is held: One unit per site, plus the forensic unit as a unit of its own.
Why: The forensic unit is separated because it is the only place criminal conviction data under Article 10 is processed. Keeping it as its own unit means the Article 10 answers, and the risks that follow, do not have to be repeated across the whole group.

Who the data is about

Data subject sets are reference records. They are created once and cited by every activity, so a change to what is held about patients is made in one place.

The data subject sets register. Special category and Article 10 answers are held on the set, then inherited.

Data subject set: Inpatients

What is held: Patients admitted to a site, including the categories of data held about them and whether they include children.
Why: Health data is special category data, so the set is marked accordingly. Every activity that cites it inherits that answer and is then asked for the Article 9 condition.

Data subject set: Research participants

What is held: The subset of patients whose data is used for research.
Why: A separate set, because the basis, the retention and the rights available differ. Holding one combined patient set would make the research activity look as though it applied to everyone.
Alternative: A single patient set with the research activity scoped by system is simpler to maintain, but it costs you the ability to answer a rights request about research participation without reading the activity. For a hospital, the separate set is worth the extra record.

The processing activities

The activities are where the regulation is answered. The same patient record appears in three of them, on three different bases, which is exactly why they are three records and not one.

Processing activity: Provision of inpatient care

What is held: Care delivery across the three sites, on Article 6(1)(c) and (e) with the Article 9(2)(h) condition for health data.
Why: Care is a public interest task and a professional obligation, not consent. Recording consent here would be wrong and would imply a right to withdraw that the hospital cannot honour without ending the care.

Processing activity: Secondary use for clinical research

What is held: Research on data collected during care, with the institute as controller, on Article 6(1)(e) with the Article 9(2)(j) condition and the safeguards of Article 89(1).
Why: Research is a compatible further purpose under Article 5(1)(b) when the Article 89 safeguards are in place, so the activity states the safeguards: pseudonymisation, access control and no decisions about individuals.
Alternative: Explicit consent under Article 9(2)(a) is the alternative, and is often preferred by ethics committees. It gives participants a clean withdrawal, but it makes the cohort incomplete and requires a consent record per participant. The register supports either; what it will not accept is a research activity with no condition stated.

Processing activity: Statutory disclosure to the cancer registry

What is held: The notification required by national law, on Article 6(1)(c) with the Article 9(2)(i) condition.
Why: The disclosure is a legal obligation, so it is its own activity with the registry named as a recipient. Making it a step inside the care activity would hide a disclosure that a supervisory authority will ask about first.
Alternative: The registry can be treated as a separate controller receiving a disclosure, which is what the law usually establishes, or as a joint controller where the hospital genuinely shares the determination of purposes. If joint, the joint controller arrangement template applies and the essence has to be made available to patients.

Processing activity: Telemedicine consultations

What is held: Remote consultations delivered on a bought platform, with the vendor as processor.
Why: The hospital decides why and how consultations happen, and the vendor acts on instructions, so the vendor is a processor and the data processing agreement applies.
Alternative: Where a vendor uses consultation data for its own product improvement, it is no longer only a processor for that use. The honest set up is a second activity with the vendor as controller and a clear notice, not a processor agreement stretched to cover it.

Assessments, transfers and risks

Health data on a large scale meets the Article 35(3)(b) criterion, so an assessment is required for care, research and telemedicine. Prudence raises it as a gap on the activity rather than blocking the activity from being in use.

The risk register, read on the data subject lens before treatment.

Assessment: Telemedicine consultations

What is held: An impact assessment with the necessity and proportionality test, the risks and the measures, linked to the activity.
Why: Remote care combines special category data, a new technology and a processor with technical access. The assessment cites the risk records rather than describing risks in prose, so the register and the assessment cannot drift apart.

Transfer: Platform support from outside the Union

What is held: The vendor's support team access from a third country, with the safeguard and the supplementary measures recorded.
Why: Remote access to data held in the Union is a transfer. Standard contractual clauses plus a transfer impact assessment are the usual answer, with the supplementary measures actually implemented named on the record.
Alternative: Contractually restricting support to Union based staff removes the transfer altogether. It is often cheaper than evidencing supplementary measures, and it is worth pricing before accepting the clauses.

Risk: Reminder message discloses a condition

What is held: One risk, rated on both lenses, treated by removing the clinic name from message text.
Why: The harm to the individual is high while the cost to the hospital is low, which is precisely the case a single averaged score would bury.

How it gets maintained

A register is not finished when it is built. Three changes arrive at every organisation, and each one is absorbed the same way.

A new risk arrives

A ward reports that appointment reminders sent by text name the oncology clinic, so anyone reading the screen learns the condition.

01Set the context band to Sint Amandus Hospital Group and the Ghent unit, so the new record inherits the right scope.
02Open Risks in the left menu and press the plus button beside the register title.
03Name the risk Reminder message discloses a condition, and state the source and the effect on individuals in the Details tab.
04Move the record to Under assessment on the lifecycle bar, then rate both lenses: harm to individuals, and effect on the organisation.
05Choose the treatment, then use Link a record in the Linked records band to attach the measure Neutral message templates and the activity Provision of inpatient care.
06Record the residual rating, send the record for approval, and have Dr Katrien Vermeersch approve it.
07Set the review date, then read the heatmap on the risk register to confirm the cell has moved.

The risk is rated, treated, approved and dated, and the linked activity now shows it, so the next assessment cites a real record instead of a sentence.

The risk register with the heatmap, after the treated risk has moved cell.

A new processing activity starts

The group opens a home hospitalisation service, with nurses recording observations on tablets in patients' homes.

01Set the context band to the Outpatient network unit.
02Open Processing activities and press the plus button, then answer the special category question first: health data, yes.
03State the purpose, the lawful basis and the Article 9 condition, and name Joris Maes as owner.
04In the Linked records band, use Link a record to cite the existing data subject set Inpatients rather than creating a new one.
05Open the Assessment tab. Because the activity is special category data at scale, screening asks for an impact assessment: link the existing telemedicine assessment if the service is covered by it, or create a new one from the same tab.
06Move the activity to In use on the lifecycle bar. If evidence is missing the state is blocked and the reason is named.
07Open the record of processing and confirm the new line appears with its basis and retention.

One new activity, cited to an existing subject set and an assessment, visible in the Article 30 record the moment it goes into use.

The assessment page of an activity, where screening and the linked assessment sit together.

A new data processor is engaged

The research institute engages a transcription service to write up recorded consultations.

01Open Entities, press the plus button and create the entity, choosing the processor family and then the processor role.
02Record the country of establishment and the owner of the relationship.
03Open Documents, create the data processing agreement from the supplied template, and link it to the entity.
04Open the activity Telemedicine consultations and use Link a record to attach the processor.
05If the service operates outside the Union, open Transfers, create one record per destination, and state the safeguard and the supplementary measures.
06Raise or re-rate the risk that the new party introduces, and link it to the same activity.
07Read Route to a compliant state on the overview to confirm nothing is left open.

The processor, its agreement, its transfer and its risk are all attached to the activity they affect, so the chain reads from the activity outwards.

Linking an existing record. What the activity already applies to is shown first, so nothing is linked twice.

Try it

The demo site builds a register from a sentence. Describe an organisation like this one and it will draft the records, then leave you the gaps to close.