Handles health records, in Spain

Ley 41/2002, arts. 7, 16 and 17 · Read the law's page

• If you run a public or private health centre or service in Spain, adopt measures that keep patients' health data confidential and allow access to it only with prior authorization backed by law (Ley 41/2002, Article 7).
• If you hold clinical records, limit administrative and management staff to the data related to their own functions, bind everyone who accesses the data to secrecy, and keep clinical documentation maintained and secure for at least five years from discharge from each care process (Ley 41/2002, Articles 16(4), 16(6) and 17(1)).

Ley 41/2002, de 14 de noviembre, arts. 18 and 19 · Read the law's page

• If you run a public or private health centre or service in Spain, let a patient (or a duly accredited representative) access the clinical record and obtain a copy of the data in it, through a procedure you regulate, while protecting third persons' confidential data and professionals' subjective notes (Ley 41/2002, Article 18(1) to (3)).
• If you are a health centre or individual practitioner holding the record of a deceased patient, give access only to persons connected to the patient for family or de facto reasons, unless the deceased prohibited it, and keep the clinical records under an active and diligent custody mechanism (Ley 41/2002, Articles 18(4) and 19).

Ley 14/2007, art. 5 · Read the law's page

• If you carry out biomedical research in Spain, keep the personal data and biological samples it produces confidential, disclose personal data to third parties outside the care or research activity only with the person's express written consent, and do not use health data for purposes other than those consented to (Ley 14/2007, Article 5(1) to (3)).
• Bind everyone who accesses personal data in a care or research activity to secrecy, including after the activity ends, and publish results that identify a participant only with that person's prior and express consent (Ley 14/2007, Article 5(4) and (5)).

Real Decreto-ley 12/2018, de 7 de septiembre, de seguridad de las redes y sistemas de informacion, art. 16, developed by Real Decreto 43/2021, de 26 de enero · Read the law's page

• Adopt adequate and proportionate technical and organisational measures to manage the risks to the networks and information systems you use to provide the service, and take measures to prevent and minimise the impact of incidents that affect you; as a digital service provider, determine the security measures you apply, taking into account at least the state of the art and the security of your systems and facilities, incident management, business-continuity management, monitoring, auditing and testing, and compliance with relevant international standards.
• If designated an operator of essential services, designate a responsable de la seguridad de la informacion within three months of your designation, notify the competent authority of the appointment, and file a Declaracion de Aplicabilidad of the security measures you apply within six months of designation, reviewing it at least every three years.
• This binds an operator of essential services designated under Ley 8/2011's critical-infrastructure regime and a digital service provider that is an online marketplace, online search engine or cloud computing service established in Spain, with its EU main establishment in Spain, or that has designated a Spain-based EU representative; a digital service provider that is a micro or small enterprise under Commission Recommendation 2003/361/EC is exempt, and so is an electronic-communications or trust-service operator not separately designated a critical operator.

Real Decreto-ley 12/2018, de 7 de septiembre, de seguridad de las redes y sistemas de informacion, arts. 19, 21 y 22, developed by Real Decreto 43/2021, de 26 de enero · Read the law's page

• If you are an operator of essential services, notify the competent authority, through your reference CSIRT, of an incident that may have a significant disruptive effect on the provision of your service, making the initial notification without undue delay; if you are a digital service provider, notify the competent authority, through your reference CSIRT, of an incident that has a significant disruptive effect on your service, whether the incident is on your own networks or a third-party provider's.
• For a CRITICO-severity incident under the national notification instruction, notify immediately on becoming aware of it, follow up with an interim notification within 24 to 48 hours of the initial notification, and file a final notification within 20 days of the initial notification; for a MUY ALTO-severity incident, notify immediately on becoming aware of it, follow up within 72 hours of the initial notification, and file a final notification within 40 days of the initial notification; an ALTO-severity incident requires only an immediate initial notification (Real Decreto 43/2021, annex, section 6).
• This binds an operator of essential services and a digital service provider within the scope described on this jurisdiction's companion security-obligations row; a digital service provider's notification duty applies only when it has access to the information needed to assess the incident's impact.

LOPDGDD, Ley Orgánica 3/2018, de 5 de diciembre, disposición adicional decimoséptima, apartado 2, letras d) a g) · Read the law's page

• If you use pseudonymized personal data in Spain for health research, and in particular biomedical research, keep the research team technically and functionally separate from whoever carries out the pseudonymization and holds the information that makes re-identification possible, under LOPDGDD additional provision 17(2)(d)1.
• Give the research team access to pseudonymized health research data in Spain only where it has expressly committed to confidentiality and to carrying out no re-identification activity, and specific security measures are in place to prevent re-identification and access by unauthorized third parties, under LOPDGDD additional provision 17(2)(d)2.
• Re-identify pseudonymized health research data at its source in Spain only where the research reveals a real and concrete danger to the safety or health of a person or group, a serious threat to their rights, or re-identification is necessary to guarantee adequate health care, under LOPDGDD additional provision 17(2)(d).
• If you process personal data in Spain for public health or biomedical research under the safeguards of GDPR Article 89, carry out an impact assessment that specifically covers the risks of re-identification linked to the anonymization or pseudonymization of the data, under LOPDGDD additional provision 17(2)(f)1.
• Obtain the prior report of the research ethics committee before using pseudonymized personal data in Spain for public health or biomedical research, or, where no committee exists, the prior report of the data protection officer or an expert, under LOPDGDD additional provision 17(2)(g).

Anteproyecto de Ley de Coordinacion y Gobernanza de la Ciberseguridad, text approved by the Consejo de Ministros on 14 January 2025 (transposing Directive (EU) 2022/2555) · Read the law's page

• As drafted, the Anteproyecto would require you to carry out an individualised risk assessment and put in place technical, operational and organisational measures, proportionate to the risk, to secure the networks and information systems you use and to prevent or minimise the impact of an incident.
• As drafted, the Anteproyecto would require you to designate a responsable de la seguridad de la informacion (information security officer) as your point of contact and technical coordinator, with accredited personnel in that role where your entity is classified as essential.
• As drafted, it would reach your service where you are classified as an essential or important entity under the Anteproyecto's sector criteria, which track NIS2's own classification of an online marketplace, online search engine and cloud computing service among the digital providers it names; the wider sector classes the Anteproyecto also reaches (energy, transport, banking, health, water, digital infrastructure, public administration and others) are reached too, by declaring that you are an essential or important entity.

Anteproyecto de Ley de Coordinacion y Gobernanza de la Ciberseguridad, text approved by the Consejo de Ministros on 14 January 2025 (transposing Directive (EU) 2022/2555) · Read the law's page

• As drafted, the Anteproyecto would require you to notify the competent authority of a significant incident affecting the provision of your service, whether on your own networks or a third-party provider's.
• As drafted, the Anteproyecto would require you to send an early warning without undue delay, and in any event within 24 hours of becoming aware of a significant incident, to the competent authority through your reference CSIRT, stating, where applicable, whether the incident is suspected to result from an unlawful or malicious act or could have cross-border repercussions (Article 18(6)(a)).
• As drafted, the Anteproyecto would then require you to submit an incident notification to the competent authority, through your reference CSIRT, within 72 hours of becoming aware of the significant incident, updating the early warning with an initial assessment of the incident; a trust service provider whose services the incident affects would have to submit it within 24 hours instead (Article 18(6)(b)).
• As drafted, the Anteproyecto would require you to submit an interim report when your reference CSIRT or the competent authority asks for one, and a final report within one month of submitting the incident notification, or, if the incident is still ongoing, a status report then and a final report within one month of the incident being handled (Article 18(6)(c) to (e)).
• As drafted, the Anteproyecto would require you to communicate to the recipients of your service, as soon as possible, a significant cyberthreat that could affect them and any mitigating measures they can take.
• As drafted, it would reach your service where you are classified as an essential or important entity under the Anteproyecto's sector criteria; the wider sector classes are reached as on this jurisdiction's companion risk-management row.