Identify the rules for health-related data
Clinical records, prescriptions, and information revealing health conditions require a specified purpose, necessary access, and an applicable condition under Article 11 of the LGPD.
01 · Operational scale
Growing operations need a shared inventory and clear responsibilities.
Patient support, materials, batches, quality records, dispensing, contracts, and services create connected data flows across teams and systems.
The organization must identify what it holds, where each record is stored, who authorizes access, which provider processes it, and how operations continue during an incident or system outage.
Brazilian data-protection framework
Health-data processing requires a documented purpose, legal basis, and safeguards.
Under Brazil’s LGPD, the organization must assess each processing activity: what data it uses, why, under which legal basis, for how long, with whom it shares the data, and who makes the decisions. Consent is not the automatic or only legal basis. The appropriate basis depends on the activity and the conditions set out in the law.
Distinguish decision-makers from service providers
Document who determines the purpose and essential means of processing, which providers act on instructions, and how people can contact the organization or its data protection officer.
Set up a process for individual requests
Requests for confirmation, access, correction, and other applicable rights need a contact channel, identity checks, an accountable role, and a record of the response.
Assess risk and notification duties
Record what happened, its effects, containment measures, and whether notification to the ANPD and affected people is required under the applicable rules.
Justify how long records remain
Retention schedules should account for applicable legal duties, care, research, contracts, and legal claims, then document deletion, anonymization, or authorized preservation.
Data protection does not replace health regulation
Research, cultivation, production, quality, and dispensing also depend on the authorizations and health rules applicable to the organization’s actual activities.
Review the sector rules →Official sources: LGPD — Law No. 13,709/2018; ANPD — processing roles; ANPD — individual rights; and ANPD — incident notification. This is educational guidance, not a determination that every rule applies to every organization or activity.
02 · Six operational data domains
Trace records across care, production, and institutional operations.
A shared inventory links records to the systems that hold them, the purpose for using them, and the people authorized to access them.
Link care records and follow-up
Identifiers connect health records, prescriptions, documented purposes, and each patient’s care history.
Trace materials, batches, and responsible roles
Field records identify materials, practices, cycles, batches, dates, and responsible parties.
Connect processes, tests, deviations, and decisions
Formulations, analytical results, shelf life, deviations, and release decisions remain linked to the relevant batch.
Reconcile inventory and dispensing
Receipts, dispatches, recipients, and supporting records document the movement of each batch.
Record teams, providers, contracts, and access
Roles, agreements, resources, and permissions identify who acts and who is accountable.
Document changes, incidents, and disposal
Logs record changes, disclosures, and incidents; retention schedules document when records are reviewed or disposed of.
03 · Protecting people
Unauthorized access can expose sensitive information and interrupt care.
Linked health, address, financial, membership, and treatment records can reveal a patient’s identity, condition, location, and care history. Unauthorized access, alteration, or loss can expose that information, prevent teams from retrieving current records, and delay continuity of care.
Patient organizations can reduce these risks by limiting each use to a documented purpose, restricting permissions, recording access and changes, and assigning an incident-response process.
04 · Public case and anonymized record
Two cases highlight communication, continuity, and accountability.
Investigation into patient-data safeguards
The ANPD announced an administrative enforcement proceeding concerning an incident reported to have affected records of approximately 500,000 patients. Its notice describes suspected shortcomings in security measures, communication with affected people, and information about the data protection officer.
The notice announces an investigation; it does not report a final finding of liability.
Service interruption, data transfer, and transparency
In a case involving a patient association and a software company, patients were informed by email about a platform migration and service interruption. The situation raised questions about continuity of care, transfer and destination of copies, continued access, and retirement of the former system.
An anonymized record from a patient perspective. After the initial notice, questions remained about the measures taken and any notification to the ANPD. Names are omitted, and the regulatory outcome has not been confirmed.
05 · Operational risks
Missing roles, histories, and recovery procedures can interrupt patient services.
When no one is assigned to authorize access, preserve change histories, restore systems, or communicate incidents, an organization may be unable to correct failures or demonstrate the safeguards it applied.
Unauthorized access or disclosure
Information may reach people or systems without authorization.
Fragmented record history
Missing change logs hinder investigation and correction.
Unprepared incident response
Teams may not know who decides, notifies, or preserves evidence.
Provider dependency
A service outage may interrupt requests or access to organizational records.
Controls that cannot be demonstrated
Patients and partners may be unable to verify how information is protected.
Institutional consequences
Administrative, civil, and reputational consequences may follow.
06 · Four control practices
Four documented practices for day-to-day governance.
Inventory systems and data transfers
Locate databases, spreadsheets, messages, providers, handoffs, responsible roles, and decision points.
Align collection and access with purpose
Collect necessary data and authorize access according to documented functions.
Preserve source, version, and reason for change
Change logs keep institutional memory available for review and correction.
Assign decisions before an incident
Define who contains the event, communicates, restores service, documents actions, and preserves evidence.
07 · Ten governance dimensions
Assess controls and plan the next improvement.
The ten dimensions examine curation, provenance, relationships, purpose, knowledge organization, retrieval and access, validation, controlled transfers, indicators, and human oversight.
For each dimension, document existing controls, evidence, gaps, an accountable role, and a next review action. The assessment must also consider providers, batches, dispensing, incidents, continuity, retention, and disposal.
08 · Data rights and accountability
Organizations must explain data practices so patients can exercise their rights.
Patients need plain-language information about the purposes and legal basis for processing, categories of data, responsible parties, disclosures, retention periods, and contact channels. Patient organizations should publish this information and maintain a documented process for receiving, verifying, and answering requests.
People can exercise data rights only when they can identify how their information is used, who is responsible, and where to submit a request. Organizations are responsible for providing that information and responding through accessible channels.
Editorial synthesis informed by discussions at the 1st Fiocruz Seminar on Privacy and Data Protection, 14 August 2025; rights guidance: ANPD — Data Subjects.