The foundation of a transparent, reasoned review
Professional foundations.
Clearly explained.
Which duties apply to patient data, and what do they mean for your IT, contracts and day-to-day work?
For medical practices, hospitals and other healthcare facilities, we explain the legal framework, FMH resources and FDPIC guidance. You will learn how these inform the twelve questions and the legal assessment of your facility.
01 · The legal framework
Data protection and professional secrecy belong together.
Under the Swiss Federal Act on Data Protection (FADP), health data are sensitive personal data. The review therefore goes beyond electronic medical records: laboratory values, imaging data and information on an invoice may also reveal information about a person’s health. The content, purpose and actual use of the data are decisive. FADP, Articles 5 and 6
Medical professional secrecy under Article 321 of the Criminal Code also protects the relationship of trust with patients. It extends to auxiliary persons, such as IT service providers. Their involvement, access and confidentiality obligations must be specifically clarified. Even within a facility, a professional role alone does not permit unrestricted access to records. FDPIC: disclosure of patient data
Which rules apply to a hospital?
Private medical practices and private clinics are generally subject to the federal FADP. For hospitals with a cantonal service mandate, cantonal data protection law may instead be decisive. A private legal form alone does not settle the question: activities, ownership and the public mandate must be examined. Relevant health legislation, for example on record keeping, also applies. FDPIC: jurisdiction in healthcare
We therefore first establish who is responsible for each processing activity and which rules apply. Whether consent is required and what form it must take depend on the specific processing and professional secrecy requirements. A privacy notice serves a different purpose from consent.
In MedData Check · Questions 1–3 and 6
Information on legal form, locations and responsibilities is useful, as is information on ownership and the service mandate for hospitals. The types of data described indicate which protection requirements must be considered.
02 · Working with providers
A contract must reflect the service actually provided.
The FMH checklist for cloud service contracts supports a structured review: which services have been agreed? Which annexes form part of the contract? How are availability, recovery and support addressed? It also draws attention to data processing, security measures and termination of the contract. We use this structure to read the main agreement and supporting documents together. FMH: cloud contract checklist, 2020 edition
The checklist predates the revised FADP, which entered into force on 1 September 2023. It offers practical guidance; using it does not replace a review under current law. The FMH also provides its IT resources as recommendations. FMH: understanding baseline IT protection
Responsibility remains with the facility
In outsourced processing, the provider processes data on behalf of the facility. Under Article 9 FADP, the facility must select the provider carefully, give appropriate instructions and supervise it. It may only delegate processing that it is itself permitted to carry out; confidentiality obligations must not prohibit that delegation. Sub-processors require prior authorisation. The FDPIC emphasises that outsourcing does not transfer responsibility for data protection to the provider. FDPIC: processing data on behalf of a controller
We therefore examine whether the documents clearly address data use, instructions, other providers involved, oversight rights and assistance with patient requests and incidents. The return and deletion of data when changing providers are also covered. A document entitled ‘AVV’ or ‘DPA’ is not sufficient on its own. FDPIC: data processing in the cloud
In MedData Check · Questions 3–5 and 8
Please compile the main contracts, general terms and conditions, data processing agreements (AVV/DPA), service level agreements (SLA) and security descriptions. It is important to establish which versions and annexes actually form part of the contract.
03 · The cloud and cross-border aspects
Server location is only part of the picture.
For the review, we establish where data are stored and processed and who can access them. This includes backups, sub-processors and remote maintenance. A data centre in Switzerland therefore does not settle the question of support access from abroad. The FDPIC’s guidance calls for the entire cloud service to be considered. FDPIC: responsibility in the cloud
For disclosure abroad, it must be established whether the destination country provides adequate data protection according to the Federal Council’s list. If it does not, appropriate safeguards are a principal option. Where standard data protection clauses are used, it must also be assessed whether foreign law permits compliance and whether additional safeguards are needed. A contractual annex alone does not answer this question. FDPIC: disclosure of data abroad
The FDPIC’s specific position on patient data
When cloud services are used, the FDPIC recommends obtaining patients’ consent as a precaution and advises against using cloud services abroad for patient data. It bases this position on the protection of medical professional secrecy. We expressly take this position into account: a disclosure abroad that is lawful under data protection law does not resolve the question of professional secrecy. FDPIC: patient data and the cloud
In MedData Check · Questions 5–7 and 9
Binding information on data and backup locations, lists of sub-processors and descriptions of support access are useful. ‘Unknown’ initially identifies a matter to clarify with the provider.
04 · Confidentiality, availability and response
Security requires clear responsibilities and verifiable procedures.
The FMH baseline IT protection guidance contains eleven recommendations for small and medium-sized medical practices. It combines organisational tasks with technical safeguards. For hospitals and other healthcare facilities, we use these topics as a starting point and consider their particular complexity, existing security organisation and facility-specific requirements. The recommendations for practices do not constitute a complete standard for these facilities. FMH: baseline IT protection D2, September 2023
The questionnaire covers personal user accounts, role-based permissions, multi-factor authentication and external access. For backups, we are interested in successful restoration as well as creation: the FMH recommends testing restoration at least annually. Written responsibilities and an incident procedure should ensure that technical problems reach the right people quickly. FMH: access, backups and incidents
Which notifications are required following an incident?
Under Article 24 FADP, a data security breach must be reported to the FDPIC as quickly as possible if it is likely to result in a high risk to the affected individuals. The processor promptly informs the controller of a breach. Affected individuals must be informed where this is necessary for their protection or where the FDPIC requires it. The assessment therefore needs a defined escalation route. FDPIC: reporting data security breaches
Institutions subject to the reporting obligation for critical infrastructure must also consider the requirement to report certain cyberattacks to the Federal Office for Cyber Security (BACS) within 24 hours of discovery. Whether the facility falls within the scope and which exceptions apply are clarified separately. This duty is distinct from the notification required under data protection law. BACS: duty to report cyberattacks
In MedData Check · Questions 2, 9 and 10
An access control policy, information on multi-factor authentication, evidence of backups and restoration, and an incident plan help with the legal assessment. The Basic Check does not test technical effectiveness.
05 · Data protection in everyday operations
Patients’ rights must work in practice.
A sound data protection organisation assigns tasks: who maintains the internal rules? Who trains staff? Who answers patient requests and involves IT or legal advisers where necessary? We consider written instructions, confidentiality undertakings and training records alongside the procedures described. Depending on the statutory conditions, a record of processing activities is also required. FADP: record of processing activities
For patient information, we examine the applicable duties to provide information and the exceptions. These cover, in particular, the controller, purposes and recipients of the data and, where relevant, disclosures abroad. The FDPIC requires information to be understandable and accessible. A notice should therefore reflect the services actually used and the actual data flows. FDPIC: duty to provide information
Access to data, release of records, rectification and deletion are different requests. The facility needs a procedure that takes account of the requester’s identity, responsibilities and deadlines. Statutory retention duties must also be assessed when a deletion request is made; the appropriate period cannot be set uniformly for all facilities. The facility must be able to fulfil patients’ rights even where data are outsourced. FDPIC: access, retention and deletion
When is a data protection impact assessment required?
Under Article 22 FADP, a data protection impact assessment (DPIA) is generally required before processing that is likely to pose a high risk to personality rights or fundamental rights. Large-scale processing of sensitive personal data and new technologies may be relevant; statutory exceptions must also be considered. MedData Check can identify the need for further investigation. A full DPIA requires a separate scope of review. FDPIC: data protection impact assessment
In MedData Check · Questions 11 and 12
Data protection instructions, training materials, patient information and a description of the request-handling process are useful. Templates and organisational documents are sufficient; we do not need patient records for the initial review.
06 · Our review method
From answers to reasoned recommendations.
The twelve main questions provide a structured assessment of the current position. They cover the four topic areas and identify the documents supporting the initial legal review. The mapping below describes our working method; it is not an assessment system prescribed by the FMH or the FDPIC.
| Questions | Review focus | Useful supporting material |
|---|---|---|
| A · 1–3 | Institution, responsibilities and external IT | Overview of responsibilities, IT provider’s tasks; information on the public mandate for hospitals |
| B · 4–7 | Systems, cloud, data types and processing locations | System overview, provider information, data locations and sub-processors |
| C · 8–10 | Contracts, access rights, backups and incidents | Contracts and annexes, access control policy, restoration evidence, incident plan |
| D · 11–12 | Internal rules, training and patients’ rights | Instructions, training records, patient information and request-handling process |
Four steps for each finding
- Identify the basis. Which answer and which contractual provision or document support the finding?
- Assess the legal position. Which requirement is involved, and what can be assessed from the available material?
- Identify outstanding points. Missing or contradictory information leads to targeted follow-up questions. ‘Unknown’ does not automatically mean red.
- Recommend the next step. The report identifies the appropriate measure and its review priority.
The traffic-light colours indicate qualitative priorities: green means that no heightened need for review was identified in the area examined; yellow indicates a need for review or clarification; red indicates a heightened need for review requiring priority attention. Every rating is accompanied by reasons. The assessment is an initial legal opinion within the agreed scope. It does not replace a technical security review, a full compliance audit or a DPIA.
Sources and editions
The original sources are linked alongside the relevant explanations. We use the 2020 edition of the FMH cloud contract checklist and the September 2023 edition of baseline IT protection D2. The currency and applicability of legislation and official information are checked in the context of the specific engagement.