How we handle a data breach

Who does what

The Clinico is the personal information processor; each clinic is the controller of its own patients’ data. Mark Cordovero is The Clinico’s Data Protection Officer (privacy@theclinico.com) and the breach response lead; until a second person joins, he does every step below and writes down when he did it. The clinic’s Owner is the clinic’s contact and, unless the clinic names someone else, its Data Protection Officer.

1. Detect

A breach can show up as a database alert or log entry (unusual sign-ins, a failed access rule, bulk reads), a staff member or patient reporting that they saw another person’s data, a lost or stolen device still signed in, a leaked key, a provider telling us of an incident, or a report to privacy@theclinico.com. Anyone who sees one of these reports it to the Data Protection Officer at once. We write down the time it was noticed; the 72-hour clock starts when The Clinico knows, or should reasonably have known, that a breach happened.

2. Contain, in the first hour

Stop it getting worse before working out how bad it is: deactivate the staff account involved, reset the Owner’s password, rotate the leaked key, pause the affected clinic if the breach is still live, and check that public sign-ups are still off. We keep the evidence: no logs are deleted and the records involved are not purged.

3. Assess, within 24 hours of detection

We answer in writing: what data (names, mobile numbers, medical history, notes, bills), how many people, which clinics, how it happened, whether the data was only exposed or also taken or changed, and whether it was encrypted or readable. Then we decide whether it must be reported. The rules make notification mandatory when sensitive personal information or information usable for identity fraud is involved, there is reason to believe an unauthorised person acquired it, and the breach is likely to cause serious harm. Medical history, diagnoses and treatment are sensitive personal information, so most breaches of a clinic’s records will be reportable.

4. Tell the clinic, within 24 hours of detection

We email and text the Owner of every affected clinic, within 24 hours and sooner where possible, with: what happened, what data and roughly how many of their patients, what we have done to contain it, what we are still finding out, and what we suggest they do. We offer to draft their notice to the National Privacy Commission and their notice to patients, and keep updating them until the matter is closed. This is a commitment in our terms; it exists so the clinic can meet its own 72-hour deadline.

5. Notify the National Privacy Commission and the people affected, within 72 hours

The controller notifies. For a clinic’s patients that is the clinic; The Clinico helps and, where the clinic asks, sends the notice on the clinic’s behalf. For The Clinico’s own data, such as demo requests, The Clinico notifies.

The Commission: within 72 hours of knowledge, through its breach notification form at privacy.gov.ph, giving the nature of the breach, the data involved, the number of people, the measures taken, the Data Protection Officer’s contact details, and the steps being taken to prevent a repeat. If the full picture is not known in time, what is known is sent and followed up.

The people affected: within the same 72 hours, in plain words: what happened, what data of theirs, what they should do (for example, watch for texts or calls pretending to be from the clinic), and who to contact. By text or email where the clinic has it, otherwise a notice at the clinic. The Commission may allow a delay or a general public notice where contacting each person is not practical; that is asked for in the notice to the Commission.

6. Record

One file per incident, kept for at least 5 years: when it was detected and by whom, the timeline of containment, the assessment and the decision on whether to report, copies of every notice sent with the times sent, what was done to prevent a repeat, and the date it was closed. The file is kept even when the breach was judged not reportable, and every incident is summarised in the annual report to the Commission.

7. Afterwards

Within two weeks of closing the incident, we write down what changed to stop it happening again and review this procedure. Affected clinics are told what changed.