Data security incident: what it means in an HOF clinic
Quick facts
- Definition
- An event that exposes, loses or alters personal data without authorization or because of a failure.
- Examples
- A lost phone with patient photos, a photo sent to the wrong contact, a patient record opened by someone who should not have seen it.
- What the LGPD requires
- Assess the risk, take action and, when the risk is significant, notify the authority and the data subjects.
- Prevention
- Restricted access, passwords, backups and staff training.
A data security incident is any event in which personal data is exposed, lost, altered or accessed without authorization. In an HOF clinic, the data at stake is sensitive: photos of the face, health history, patient records. The incident does not have to be a hacker attack; it is often a simple everyday mistake.
Which situations count?
What does the LGPD expect?
The LGPD (Brazil's General Data Protection Law) requires the controller to adopt security measures and, in case of an incident that may bring significant risk or harm, to notify the national authority and the data subjects within a reasonable time. The details on deadlines and format are set by the authority and may change, so check what is currently in force. A photo of the face is facial biometric data when used to identify someone, and falls into the group of sensitive personal data.
How do you prepare?
- Define who at the clinic responds when something happens.
- Record every incident: what happened, when, which data, what was done.
- Limit the damage: retrieve the image, change passwords, notify the patient if appropriate.
- Train the team on sending photos and using personal devices.
More on using photos in photo consent and the LGPD.
Frequently asked questions
Is sending a patient's photo to the wrong contact a security incident?
It can be. Sending it to an unauthorized person is an improper-access incident. Assess the risk, try to get the image back and record what happened. If in doubt, seek legal advice.