Moving from paper files to digital records improves organisation, but also shifts the risk: a locked cabinet becomes a database reachable over the internet. Health information is among the most sensitive there is, and protecting it is a matter of trust as much as compliance. This article lists concrete measures to put in place in a practice or clinic. It does not replace legal advice: always verify your precise obligations with INPDP, your medical association or your counsel.
A General Framework, to Verify with the Authorities
The rules applying to the protection of personal health data depend on the country, the profession and the type of processing. In Tunisia, the authority competent for personal data is INPDP, and the medical association frames professional-secrecy obligations. This article asserts no precise legal obligation: it describes security good practices found in any serious approach.
Before rolling out a digital file, ask these bodies or your counsel about the declarations, authorisations and retention conditions that apply to your situation, including if you entrust data to a host or a software vendor.
Access Control and Role Management
The principle is simple: everyone sees only what they need for their job. The secretary manages the calendar and reception; she does not need to read operative reports. The practitioner accesses the clinical file of their own patients. An administrator manages accounts but does not necessarily have access to medical content.
In practice, check that the software lets you define roles, give each person a named account (never a shared one), and instantly remove access for a departing colleague. Shared accounts make any traceability impossible.
Strong Authentication
A password alone is fragile. Require long, unique passwords, and enable a second verification (a code sent to the phone, an authenticator app) for accounts that access data. Avoid the sticky note on the screen, which remains one of the most widespread weaknesses in practices. A password manager helps the team follow these rules effortlessly.
Audit Trail: Knowing Who Did What
An audit trail records who viewed, modified or exported which file, and when. It deters curiosity browsing, allows investigation after an incident and provides precise answers if a patient asks a question. Software that does not trace access is hard to defend when something goes wrong. Ask to see this log during the demonstration, not just to hear about it.
Encryption at Rest and in Transit
Encryption in transit protects data travelling between the browser or app and the server: the connection must be secure (HTTPS). Encryption at rest protects stored data: if a disk or backup is stolen, its content stays unreadable without the key. Both levels are expected standards. Ask your vendor what is encrypted, and how the keys are managed.
Backups and Restore Testing
A backup that has never been restored is a hypothesis, not a guarantee. Check that backups are automatic, stored in a place separate from the main system, and above all that a restore test is run regularly. Think also of outages, human error and ransomware-type malware: an isolated backup is often the only way out.
Retention
How long should a file be kept, what should happen to those that no longer need to be, how to delete them cleanly? These rules are regulated and vary; check with INPDP and your medical association. In the software, plan a clear policy rather than indefinite storage by default, because keeping data too long is also a risk.
Who Physically Hosts the Data?
This question is often dodged although it is central. Is the data on a practice server, with a local host, or in a data centre abroad? Who accesses it on the provider's side? A contract must answer precisely. Depending on the hosting chosen, specific rules may apply to transferring data outside the country: to be validated with the competent authorities.
Also ask what happens if the provider disappears or if you leave: how do you retrieve your data, and is it then deleted from their systems? Our article on choosing booking software insists on this reversibility.
Training and Team Habits
The strongest technology fails if the team does not follow good practice. Make staff aware: do not share credentials, lock your workstation, be wary of suspicious emails, do not send health data through an unsecured personal inbox, do not photograph a file with a private phone. A short training for each new colleague, repeated regularly, costs little and prevents many incidents.
Incident Response Plan
You must know in advance what to do when it happens: a lost computer, a compromised account, an email sent to the wrong recipient. Write a short procedure: who to alert, how to contain the problem, how to assess what was affected, how to inform the people concerned and the authorities where required. Any notification obligations are to be verified with INPDP or your counsel. A written, known procedure lets you react calmly instead of improvising.
Patient Consent and Right of Access
The patient must understand what data is collected, why, and who accesses it. Consent documents should be clear, attached to the file and retained. The patient may also wish to consult or obtain a copy of their file: the software must make it easy to produce one. The exact terms of these rights depend on the applicable regulations, to be confirmed with the competent bodies.
Security Questions to Ask Your Vendor
A software demo mostly shows visible features. To assess security, you need to ask precise questions and demand clear answers, ideally written into the contract.
- Can the practice configure roles and access rights?
- Is two-step verification available, and mandatory for sensitive accounts?
- Can the practice consult the access log, and for how long is it kept?
- What happens if a device connected to the system is lost?
- Can the provider's employees access the data, under what conditions and with what traceability?
- How are any subcontractors handled, notably the host?
- What recovery time is announced after an outage, and has it ever been tested?
A vendor who answers precisely, without vague formulas, shows they have thought about the subject. One who dodges or falls back on generalities should alert you, especially if the patient file contains operative information or clinical photographs.
Photos and Documents: An Often-Forgotten Angle
In a specialty such as aesthetic surgery, files contain before-and-after photos, procedure plans and signed consents. These files circulate easily by messaging or end up in the gallery of a personal phone. They should be stored in the secure file, under the same access controls, and not in consumer tools you do not control. Set a clear rule: where to store these files, who may take them, and how to delete them from the phone afterwards. Using such images for communication or on a website further requires the patient's explicit and informed agreement, to be framed with your medical association.
The same discipline applies to scanned documents, referral letters and laboratory results received by email. Decide on a single place where they are filed, name them consistently so they can be found, and remove copies lying in inboxes and downloads folders. Scattered copies are the hardest to protect, because nobody remembers they exist, and they are exactly what turns a small incident into a large one.
What a Practice Can Do This Week
- Remove shared accounts and create named accounts.
- Enable two-step verification wherever possible.
- Check that backups exist and schedule a restore test.
- Ask the vendor where the data is hosted.
- Make the team aware of the basic rules.
- Write a one-page incident procedure.
How Codini Approaches the Subject
When we design software for a practice, role management, traceability and backups are planned from the start rather than added later, and data export is always possible. You will find our approach to practitioner software on the surgeon software page, and how a project unfolds in our article on building custom medical software.
Conclusion
Protecting the patient file does not require transforming everything, but laying solid foundations: role-based access, strong authentication, traceability, encryption, tested backups, controlled hosting, a trained team and an incident procedure. Verify your precise obligations with INPDP and your medical association.
Preparing the move to digital? Contact Codini to discuss the security of your future tool.