HEALTH DATA CYBERSECURITY AND PERSONAL DATA PROTECTION LAW

Abstract

Cyberattacks are increasingly targeting healthcare facilities. This can lead to the leak of patients’ health data, with all the consequences that such a leak can entail for the privacy of data subjects. To mitigate these risks, health data controllers are subject to stricter security obligations under European data protection law. In parallel, the French Public Health Code requires the adoption of security standards designed to ensure the protection, and in particular the cybersecurity, of health data. While these initiatives are, at first sight, desirable, they nevertheless face difficulties in defining the exact scope of the concept of health data and the attached legal regime.