Federal Act on Data Protection (FADP)
In force since 1 September 2023. Health data counts as sensitive data under the act: the practice must protect it with measures appropriate to the risk, whether it is kept in the practice or online.
Cloud storage
Online storage lets you find your files on every computer in the practice, and even outside it. For health data, it must meet three conditions: encryption that not even the provider can remove, access reserved for the right people, and a clear contract. Here is what the law says, and what we put in place.
What the law says
Data Protection Ordinance (DPO)
It sets minimum requirements: each person only accesses the data needed for their work, the data can only be read by authorised persons, including while it is being transferred, and it can be restored quickly after an incident.
Professional secrecy
It binds the dentist and their assistants (Art. 321 of the Swiss Criminal Code). Entrusting patient files to an online service is only permitted if this secrecy is preserved: encryption that the provider cannot remove is the best guarantee of this.
Data processing agreement
The provider processes your data on your behalf: an agreement must set out what it may do with the data, where it keeps it, to whom it entrusts it, and how you get it back at the end of the contract (Art. 9 FADP). The practice remains responsible.
Country of storage
No law requires a practice to store its data in Switzerland: a country whose data protection Switzerland recognises is suitable, such as those of the European Union. The United States is only recognised for certified companies, and an American provider can be compelled to hand over the files it is able to read.
Standards and labels
The ISO 27001 standard is a good selection criterion, but it remains voluntary: no Swiss law requires it. Nor is there, in Switzerland, any mandatory register of health data hosting providers.
RETENTION
How long to keep patient files?
These periods come from the cantonal health laws, not from the FADP. Since 2020, a claim for personal injury becomes time-barred after 20 years at most: we therefore recommend keeping patient files for 20 years.
| Canton | Minimum period | Maximum period |
|---|---|---|
| Vaud | At least 10 years from the last consultation | No maximum set |
| Geneva | At least 10 years from the last consultation | Destroyed after 20 years at the latest, unless there is an overriding interest |
| Fribourg | At least 10 years | Destroyed after 20 years at the latest, unless there is a major interest |
| Valais | At least 20 years | No maximum set |
For Neuchâtel and Jura, check with your canton's public health department. Patients may request access to their data, its correction or its delivery in a common format (Art. 25, 28 and 32 FADP); its erasure remains limited by these retention periods.
Features of our cloud solution
The service we install meets these requirements. You subscribe to it directly: the contract and the data remain in your name.
End-to-end encryption
Your files, and even their names, are encrypted on your computer before being sent: the provider cannot read them. The servers are located in Switzerland or in countries whose data protection Switzerland recognises.
File version history
Previous versions of each file are kept for an adjustable period: a document overwritten or deleted by mistake can be recovered. This is not the legal archiving, which concerns the patient file itself.
Secure file sharing
A password-protected link, with an expiry date, to send a document to a colleague or a laboratory. Passing on a patient's file does, however, require their consent or a legal basis.
Offline access
The files you choose remain available on the computer, even without a connection. These local copies must be protected: the computer's drive must be encrypted.
Access across platforms
The practice's computers, tablets and phones: each account is protected by two-factor authentication, which we enable with you. Avoid personal devices that the practice does not manage.
Access control
Each member of staff has their own account, and each shared folder its own rights: read or edit. Only the people who need the data can access it (Art. 3 DPO).
Online storage is not a backup Synchronisation also copies a file that has been deleted, or encrypted by ransomware. Version history limits the damage, but your data also needs real backups with a copy outside the practice. And with end-to-end encryption, a lost password with no means of recovery means losing access to the files: keep these recovery means in a safe place.
SELF-ASSESSMENT
Take stock of your practice
Five points taken from our guide, each explained according to your answer. Your answers stay in your browser and carry over to the full check-up.
The assessment requires JavaScript. The explanations for each point remain readable below.
Point 1Essential
A copy outside the practice
The 3-2-1 rule: three copies of your data, on two different media, one of them outside the practice. A fire, water damage or a burglary must not take all the copies at once.
Learn more
The copy outside the practice must be encrypted, automatic and recent, and be located in a country that offers adequate protection, ideally in Switzerland.
A drive taken home every evening works as long as no one forgets, which always ends up happening.
Is a complete, recent copy of your data kept outside the practice?
In order: a disaster will not make you lose everything.
- Why it matters
- Even if the whole practice is affected, your files can be rebuilt. This is the heart of the 3-2-1 rule.
- To keep it that way
- Check that this copy is encrypted and recent: a copy three months old means three months of files lost.
To fix: everything could disappear at once.
- The risk
- If all the copies are in the practice, a fire, a theft or an attack can take everything: patient files, X-rays, accounts.
- What to aim for
- An automatic, encrypted copy, sent outside the practice every day, in Switzerland.
- With us
- Our backups send an encrypted copy outside the practice every night, kept in Switzerland in our care.
To check: this is often where the risks hide.
- How to find out
- Ask where the most recent copy of your data outside the practice is, and how old it is. If no one knows, the answer is no.
- With us
- During a first visit, free of charge, we check this point with you and explain what we found.
Point 2Essential
A copy that an attack cannot erase
Ransomware looks for backups so as to encrypt them first. A drive that is permanently connected will be encrypted along with everything else.
Learn more
The answer: a disconnected copy, or one locked so that no one can modify or delete it for a certain time, not even a program that has taken control of the network. This is called an immutable copy.
It is the recommended complement to the 3-2-1 rule; it is sometimes written 3-2-1-1-0: one more immutable copy, and zero errors in restore tests.
Is at least one of your backups disconnected, or protected against modification and deletion?
In order: your last line of defence holds.
- Why it matters
- Even if the attacker takes control of the network, they cannot destroy this copy. It is what allows you to refuse to pay a ransom.
- To keep it that way
- Make sure the history goes back far enough: an attack often stays silent for several days before showing itself.
To fix: your backups would be encrypted along with the rest.
- The risk
- Attackers go after the backups first. If they can be reached from the network, they are encrypted or erased before the attack is even noticed, and only the ransom remains.
- What to aim for
- An isolated or locked copy that no one can erase before a set period.
- With us
- Our backups keep a history of about two weeks, so that we can go back to before an attack began. We explain to you which copy would remain intact, and why.
To check: this is often where the risks hide.
- How to find out
- Ask your provider: if ransomware took control of the server tonight, which copy would remain intact, and why? The answer must be precise.
- With us
- During a first visit, free of charge, we check this point with you and explain what we found.
Point 3Essential
A restore that has actually been tested
A backup that has never been restored is a promise, not a guarantee. The law requires you to be able to restore access to the data quickly after an incident (Art. 3 DPO).
Learn more
A test consists of restoring a few patient files or X-rays and checking that they open normally.
At least once a year, ideally more often; each test is recorded with its date and result. This is also what you will be asked for after an incident.
Has a restore of your data been tested, successfully, in the last twelve months?
In order: you know your backups work.
- Why it matters
- You know that the files can be used and how long a restore takes. This is exactly what the law requires you to be able to do.
- To keep it that way
- Keep a written record of each test: date, what was restored, result.
To fix: nothing proves that your backups work.
- The risk
- A corrupted or incomplete backup is often only discovered on the day it is needed. By then it is too late.
- What to aim for
- Regular, recorded tests that check that the restored data really opens.
- With us
- We regularly test restores of the backups we manage, and monitor each one of them.
To check: this is often where the risks hide.
- How to find out
- Ask for the date of the last restore test and what was restored. Without a precise date, count it as no.
- With us
- During a first visit, free of charge, we check this point with you and explain what we found.
Point 4Essential
An agreement with every provider
Your IT provider, your hosting provider, your fiduciary: any provider that processes your patients' data on your behalf must be bound by a data processing agreement (Art. 9 FADP).
Learn more
The agreement sets out what the provider may do with the data, how it protects it, to whom it may entrust it and what happens to it at the end of the relationship.
Before entrusting your data, you must also make sure that the provider is able to protect it. Intentionally entrusting data without complying with these rules is punishable, if a complaint is filed.
Do you have a signed data processing agreement with every provider that accesses your patients' data?
In order: your providers are bound by clear terms.
- Why it matters
- You know what each one may do with your data, and you have recourse if there is a problem. It is one of the first documents you will be asked for after an incident.
- To keep it that way
- Ask each provider for the list of services it uses on your behalf, and have the agreement updated when it changes.
To fix: your data is entrusted without any framework.
- The risk
- Without an agreement, you have no control over what happens to the data at the provider's, and your recourse is much harder to enforce. Before the FDPIC and your patients, you are the one who answers.
- What to aim for
- A written agreement for each provider, specifying the data concerned, the security measures, the services it uses itself and the time it has to notify you of an incident.
- With us
- Template DS7 in the kit gives you a basis. Ask each of your providers for this agreement, including us.
To check: this is often where the risks hide.
- How to find out
- Look in your documents for an agreement that mentions Art. 9 FADP or data processing on your behalf. An invoice or an ordinary maintenance contract is not enough.
- With us
- During a first visit, free of charge, we check this point with you and explain what we found.
Point 5Essential
Two-factor authentication
After the password, a code on the phone: even if the password is stolen, the attacker stays outside. It is the same principle as a bank card and its PIN.
Learn more
Enable it first on e-mail, remote access, online backups, the dental software if it allows it, and the bank.
A hacked mailbox is often used to deceive your contacts, laboratories and patients included.
Is two-factor authentication enabled on the practice's e-mail, remote access and online services?
In order: a stolen password is no longer enough.
- Why it matters
- It is one of the most effective measures against account theft, for minimal effort.
- To keep it that way
- Keep the backup codes in a safe place, for the day a phone is lost or replaced.
To fix: a single password protects your data.
- The risk
- A password can be stolen in seconds with a fake e-mail. Without a second factor, the attacker goes straight into your mailbox or your network.
- What to aim for
- A second factor on every service that allows it, starting with e-mail and remote access.
- With us
- We enable it on your accounts and help each member of staff set it up on their phone.
To check: this is often where the risks hide.
- How to find out
- When you sign in to your e-mail from a new device, are you asked for a code? If not, two-factor authentication is not active.
- With us
- During a first visit, free of charge, we check this point with you and explain what we found.
0out of 5 points
- 0 in order
- 0 to fix
- 0 to check
Your answers carry over to the full check-up: 22 points, with a summary you can send us.
Take the full check-upContact us
Is your current storage suitable for patient data? We look with you at what is stored, where and how, and what would need to change. First visit free of charge, quote if you wish.