The DentalSystems guide in 22 points. For each one: what the law and good practice require, a question about your practice, and an answer explained according to your situation.
About 10 minutesAnswers saved in your browser only
It is the practice, its owner or the company that runs it, that is responsible for its patients' data. Not your IT provider, not your software vendor.
X-rays, diagnoses, treatment plans: this is health data, which the law classifies as sensitive data.
The law requires you to know where this data is, to protect it, to report a serious leak and to be able to show what you have put in place.
Fines, of up to CHF 250,000, target individuals and intentional violations, most often following a complaint. Negligence is not punished under this act, but an incident is costly in other ways.
In the event of an attack: unplug, call, do not pay, document, report.
The interactive check-up requires JavaScript. The explanations for each point remain readable below.
1
The law and your patients
The revised FADP has applied to every practice, whatever its size, since 1 September 2023. Four obligations to know.
Point 1Essential
Knowing where your data is
Patient files, X-rays, appointment book, e-mails, backups, paper: the law requires you to know where your patients' data is and how it is protected. Everything else builds on this.
Learn more
The most common blind spots: an old hard drive never wiped, a USB stick in a drawer, the laptop that goes home in the evening, the files sent to the laboratory, an assistant's phone.
Companies with fewer than 250 employees are in principle exempt from keeping a record of processing activities, unless they process sensitive data on a large scale. Keeping one is still the simplest way to show that you know where your data is.
Do you have an up-to-date list of every place where your patients' data is kept?
In order: you know where your data is.
Why it matters
You can only protect what you know about. On the day of an incident, this list saves you precious time in working out what is affected and whom to notify.
To keep it that way
Update it with every new software, computer or provider.
To fix: some data may be slipping through your fingers.
The risk
Without an inventory, you cannot tell whether everything is protected, nor reply quickly to the Federal Commissioner (FDPIC) or to a patient after an incident. The forgotten places are often the ones that leak.
What to aim for
A simple list of every software, computer, device, backup and provider that handles your patients' data, with how each one is protected.
With us
During a first visit, free of charge, we take an inventory of your IT equipment with you.
Could you say in five minutes on which devices, and with which providers, your patients' X-rays are kept? If it takes longer, the list is probably missing.
With us
During a first visit, free of charge, we check this point with you and explain what we found.
Your patients must know what data you collect, why, how long you keep it and to whom you pass it on: laboratory, insurers, specialists. That is the purpose of the data protection notice.
Learn more
The law requires patients to be informed when their data is collected (Art. 19 FADP). The notice can be on your website, displayed in the waiting room or handed out with the medical history questionnaire.
Intentionally failing to provide this information is punishable by a fine, if the patient files a complaint.
Do your patients receive clear information about how their data is used?
In order: your patients are informed.
Why it matters
You fulfil the duty to inform set by the law, and you show your patients that their data is taken seriously. It is one of the first documents you will be asked for if a question arises.
To keep it that way
Read it again whenever you change software, laboratory or provider: the list of recipients must stay accurate.
To fix: the duty to inform is not met.
The risk
It has been a legal obligation since September 2023. A dissatisfied patient can complain, and intentional omission is punishable.
What to aim for
A short, understandable text: what data, for what purpose, for how long, passed on to whom, and how to exercise one's rights.
With us
Template DS9 in the kit gives you a basis to adapt. We can help you list the actual recipients of your data: software, backups, providers.
Read your medical history questionnaire and your website again: does a paragraph explain what you do with the data? A simple "I agree" box is not enough to inform.
With us
During a first visit, free of charge, we check this point with you and explain what we found.
Any patient can ask you what data you hold about them. You must answer free of charge, completely, and in principle within 30 days.
Learn more
The practice remains responsible for the answer, even if the data is held by a provider: you cannot refer the patient to your IT provider. Check the requester's identity before sending anything.
Never answer "we found nothing" if data exists: in Zurich, in 2025, an answer of this kind earned its author a fine.
If a patient asked tomorrow for a copy of all their data, could you answer completely within 30 days?
In order: you are ready.
Why it matters
A complete answer within the deadline avoids complaints and disputes. It is often the first step taken by a dissatisfied patient.
To keep it that way
Record each request and the date of your answer: that is your proof.
To fix: a request would catch you off guard.
The risk
A patient's data is often scattered: practice management software, imaging, e-mails, paper archives. An incomplete or late answer exposes you to a complaint to the FDPIC, or even to court; a deliberately incomplete answer is punishable.
What to aim for
Knowing who handles these requests in the practice, where to look for the data (see point 1), and having a standard letter.
With us
Template DS10 in the kit gives you the standard letter. We can help you find and extract the data in your software.
Try it for an imaginary patient: where would you look for their file, their X-rays, their e-mails? If you hesitate, better to prepare now than under the pressure of a deadline.
With us
During a first visit, free of charge, we check this point with you and explain what we found.
If a leak or an attack is likely to result in a high risk for your patients, you must report it to the Federal Commissioner (FDPIC) as soon as possible. There is no fixed deadline like the European 72 hours, but you must act quickly.
Learn more
The report is made online, at databreach.edoeb.admin.ch: what happened, the consequences, the measures taken. It cannot be used against you in criminal proceedings without your consent.
Your IT provider must notify you as soon as possible of any breach it detects. If the protection of patients requires it, they must also be informed.
Keep a written record of every incident: the facts, the consequences, the measures taken. Breaches are documented, and the record is kept for at least two years from the report (Art. 15 para. 4 DPO).
Do you know who, in the practice, decides to report a leak to the FDPIC, and how to do it?
In order: the decision will not get lost in the emergency.
Why it matters
On the day of an incident, everything moves very fast. Knowing who decides and where to report avoids forgetting a legal obligation and shows your good faith.
To keep it that way
Keep the portal address and your IT provider's number on the quick-reaction sheet displayed in the practice.
To fix: a legal obligation may slip through the cracks.
The risk
After an attack, the priority is to reopen the practice; the report is often forgotten. Failing to report a serious leak exposes you far more than reporting it.
What to aim for
A designated person who decides, simple criteria for knowing what must be reported, and the useful contacts close at hand.
With us
Quick-reaction sheet DS2 and procedure DS5 in the kit cover these steps. In the event of an incident, we help you establish the facts the report needs.
E-mails, messages, paper: this is how most data leaves the practice.
Point 5Essential
E-mails containing patient data
An X-ray, a diagnosis or any information that identifies a patient is never sent by ordinary e-mail. You need encrypted e-mail, such as HIN within the healthcare network, or Proton.
Learn more
Gmail, Hotmail or Bluewin do not encrypt the content end to end: the message can be read on the servers it passes through, sometimes outside Switzerland.
With Proton, end-to-end encryption is automatic between Proton users; to any other address, you send a password-protected e-mail, with the password passed on by another channel. The subject line is never encrypted: never write a patient's name in it.
Is the patient data you send by e-mail always sent through encrypted e-mail?
In order: what you send is protected.
Why it matters
An X-ray that is intercepted or sent to the wrong address remains unreadable. You respect both professional secrecy and the security obligation of the law.
To keep it that way
Watch the subject line, which is not encrypted, and messages sent from a phone, which sometimes go through another app.
To fix: health data is travelling unencrypted.
The risk
An ordinary e-mail can be read along the way or stored on servers outside Switzerland. For health data, this breaches the security obligation and professional secrecy.
What to aim for
Encrypted e-mail for the whole practice, used as a reflex as soon as a message contains patient data.
With us
We are a Proton partner: we set up the e-mail service, transfer your old e-mails and show you how to send a protected message.
Sending a photo of an X-ray to a colleague by WhatsApp takes seconds. But it is health data leaving the practice, on a personal device.
Learn more
WhatsApp encrypts messages, but the photos remain in the phone's gallery, are often backed up to a personal cloud, and the phone can be lost, stolen or lent.
Professional secrecy applies to the dentist and their assistants: anyone who intentionally discloses patient data incurs personal criminal liability (Art. 321 SCC, Art. 62 FADP). The practice owner, for their part, must be able to show that clear rules were in place.
Is it clear to the whole team that no patient data goes through WhatsApp, text messages or a personal phone?
In order: the rule is known.
Why it matters
It is one of the most common leaks, and one of the easiest to avoid. A clear rule also protects your team.
To keep it that way
Repeat it to every newcomer, trainees and locums included.
To fix: X-rays may be sitting on personal phones.
The risk
A photo once sent stays in the gallery, in the phone's backups and with the recipient. If the phone is lost, that is a leak. And without a written rule, the practice owner cannot show that they had acted.
What to aim for
A written, signed rule, and above all a simple, secure way to send these images, so that no one needs WhatsApp.
With us
We set up the secure way to send them; security policy template DS3 in the kit gives you the written rule.
Ask the team, without looking for someone to blame: how do we send a photo to a colleague or to the laboratory? The answer will tell you straight away.
With us
During a first visit, free of charge, we check this point with you and explain what we found.
Not all leaks are digital. A file left on the reception desk or an X-ray thrown in the bin is also a breach of secrecy.
Learn more
The guide recommends a shredder for any document containing patient data, no file visible from reception, and screens turned away or fitted with a privacy filter where the waiting room can see them.
Are documents containing patient data shredded and never visible from reception?
In order: paper does not leak.
Why it matters
You close a door that many forget. Visitors and cleaning staff have access to nothing.
To keep it that way
Think of the printer too: a document left in the tray is a visible document.
To fix: paper is a quiet leak.
The risk
A bin searched, a file read by a patient at the desk: this breaches secrecy just as much as a misdirected e-mail.
What to aim for
A shredder within reach, a tidy desk at the end of the day, screens out of patients' sight.
With us
For digital media (old hard drives, USB sticks, replaced computers), we provide certified data erasure.
A single vulnerable device is enough to expose the whole practice.
Point 8Essential
Devices that still receive security updates
The law requires systems and software that are always up to date in terms of security (Art. 3 DPO). Windows 10 has no longer received security updates since 14 October 2025, except with a paid extended security updates subscription. Any device that no longer receives them is an open door, and one is enough.
Learn more
Known vulnerabilities are publicly listed, and automated tools exploit them. From one vulnerable computer, an attacker moves on to the server, the backups and the practice software, often at night or at the weekend.
Running Windows 11 is not enough: each version has its end date. Windows 11 24H2, Pro edition, has no longer received security updates since 13 October 2026.
Automatic updates and a restart every week take care of most of it. Think also of forgotten devices: an old server, a printer, the WiFi router. A medical device that can no longer be updated must be isolated from the rest of the network. We recommend replacing computers every five years at most.
Do all your computers and servers still receive security updates, and install them automatically?
In order: your equipment is up to date.
Why it matters
Security updates close vulnerabilities before they are exploited: it is the measure that prevents the most common attacks.
To keep it that way
Check your dental and imaging software too: their version must remain supported by the vendor.
To fix: one vulnerable device puts the whole practice at risk.
The risk
A computer without security updates accumulates vulnerabilities known to everyone. An attacker who gets in can reach the server and the backups within a few hours.
What to aim for
Only systems that are still supported, updated automatically and monitored, with a replacement plan for the oldest ones.
With us
We monitor your computers remotely, apply the updates and plan the replacement of end-of-life hardware.
On each computer, the name of the system appears in Settings, under System. A computer running Windows 7, 8 or 10 without an extended security updates subscription no longer receives security updates.
With us
During a first visit, free of charge, we check this point with you and explain what we found.
A laptop stolen from a car, a server taken in a burglary: without encryption, all the data can be read by anyone.
Learn more
Encryption is built into Windows Pro (BitLocker) and macOS (FileVault) at no extra cost. It makes the drive unreadable without its key.
The recovery key must be kept in a safe place, not on the computer itself: without it, a simple fault can make the data inaccessible.
Are the drives of your computers, laptops and server encrypted?
In order: a theft does not become a leak.
Why it matters
A stolen device remains a hardware problem, not a leak of health data. Depending on the circumstances, there is then nothing to report to the FDPIC.
To keep it that way
Make sure the recovery keys are stored somewhere other than on the computers themselves.
To fix: a theft would hand over your files.
The risk
Without encryption, removing the drive is enough to read everything. The theft of a laptop becomes a leak of health data, to be reported and explained to your patients.
What to aim for
Encryption enabled on every computer, laptop and server, with recovery keys stored in a safe place.
With us
We can enable it on your devices and keep the recovery keys securely.
On a Windows computer, type "BitLocker" in the Start menu: the status of each drive is displayed. On a Mac, look for FileVault in the Privacy & Security settings.
With us
During a first visit, free of charge, we check this point with you and explain what we found.
A patient's phone connected to the practice WiFi must never be able to reach your computers or your server.
Learn more
The guide recommends separate networks: one for the computers and the server, one for medical devices if needed, and one for guests, limited to the internet.
The password of the practice network is never displayed in the waiting room. WPA3 encryption is recommended; WPA2 is the minimum.
Is the WiFi offered to patients separate from the network of your computers and your server?
In order: the waiting room stays where it belongs.
Why it matters
An infected device on the guest side cannot reach your data. It is the digital equivalent of the door between the waiting room and the treatment room.
To keep it that way
Change the guest code from time to time, and keep the WiFi equipment up to date.
To fix: the waiting room has access to your network.
The risk
Without separation, any device connected to the WiFi can try to reach your computers and your server. One infected phone is enough.
What to aim for
A guest network that gives access to the internet only, and a practice network reserved for your devices.
With us
We install and configure the practice network, separate networks included.
If patients are given the same WiFi password as the team, the answer is no. If there is a "guest" network, it remains to be checked that it is truly isolated.
With us
During a first visit, free of charge, we check this point with you and explain what we found.
Not applicable: no WiFi for patients.
Worth bearing in mind
Nothing to separate on this side. Just check that the password of the practice network is known only to the team, and that personal phones are not connected to it.
An antivirus mainly blocks what it already knows, and no one sees its alerts. Protection known as EDR watches what programs do, stops an attack in progress, even an unknown one, and alerts a professional.
Learn more
If a program starts encrypting folders one after another, the EDR blocks it, isolates the computer and alerts the provider.
An EDR is only worth anything if it is monitored: someone must receive the alerts and react quickly.
Are your computers protected by an EDR solution whose alerts are followed up by your provider?
In order: an attack can be stopped while it is under way.
Why it matters
This is the level of protection we recommend for health data: the attack is detected by its behaviour, before it has encrypted everything, and someone reacts.
To keep it that way
Ask who receives the alerts, and how quickly they react.
To fix: an attack could go unnoticed.
The risk
An antivirus on its own, whose alerts no one follows, lets new or hands-on attacks through. They often remain invisible until everything is encrypted.
What to aim for
Behaviour-based protection on every computer and server, tuned for your dental software, and monitored by a professional.
With us
Computers under our monitoring contract are protected by an EDR whose alerts we handle as soon as they arrive, keeping you informed.
On the day everything is locked, your backup decides whether you reopen the next day or in a month.
Point 12Essential
A copy outside the practice
The 3-2-1 rule: three copies of your data, on two different media, one of them outside the practice. A fire, water damage or a burglary must not take all the copies at once.
Learn more
The copy outside the practice must be encrypted, automatic and recent, and be located in a country that offers adequate protection, ideally in Switzerland.
A drive taken home every evening works as long as no one forgets, which always ends up happening.
Is a complete, recent copy of your data kept outside the practice?
In order: a disaster will not make you lose everything.
Why it matters
Even if the whole practice is affected, your files can be rebuilt. This is the heart of the 3-2-1 rule.
To keep it that way
Check that this copy is encrypted and recent: a copy three months old means three months of files lost.
To fix: everything could disappear at once.
The risk
If all the copies are in the practice, a fire, a theft or an attack can take everything: patient files, X-rays, accounts.
What to aim for
An automatic, encrypted copy, sent outside the practice every day, in Switzerland.
With us
Our backups send an encrypted copy outside the practice every night, kept in Switzerland in our care.
Ransomware looks for backups so as to encrypt them first. A drive that is permanently connected will be encrypted along with everything else.
Learn more
The answer: a disconnected copy, or one locked so that no one can modify or delete it for a certain time, not even a program that has taken control of the network. This is called an immutable copy.
It is the recommended complement to the 3-2-1 rule; it is sometimes written 3-2-1-1-0: one more immutable copy, and zero errors in restore tests.
Is at least one of your backups disconnected, or protected against modification and deletion?
In order: your last line of defence holds.
Why it matters
Even if the attacker takes control of the network, they cannot destroy this copy. It is what allows you to refuse to pay a ransom.
To keep it that way
Make sure the history goes back far enough: an attack often stays silent for several days before showing itself.
To fix: your backups would be encrypted along with the rest.
The risk
Attackers go after the backups first. If they can be reached from the network, they are encrypted or erased before the attack is even noticed, and only the ransom remains.
What to aim for
An isolated or locked copy that no one can erase before a set period.
With us
Our backups keep a history of about two weeks, so that we can go back to before an attack began. We explain to you which copy would remain intact, and why.
A backup that has never been restored is a promise, not a guarantee. The law requires you to be able to restore access to the data quickly after an incident (Art. 3 DPO).
Learn more
A test consists of restoring a few patient files or X-rays and checking that they open normally.
At least once a year, ideally more often; each test is recorded with its date and result. This is also what you will be asked for after an incident.
Has a restore of your data been tested, successfully, in the last twelve months?
In order: you know your backups work.
Why it matters
You know that the files can be used and how long a restore takes. This is exactly what the law requires you to be able to do.
To keep it that way
Keep a written record of each test: date, what was restored, result.
To fix: nothing proves that your backups work.
The risk
A corrupted or incomplete backup is often only discovered on the day it is needed. By then it is too late.
What to aim for
Regular, recorded tests that check that the restored data really opens.
With us
We regularly test restores of the backups we manage, and monitor each one of them.
Who can get into your systems, and with which key.
Point 15Important
One account per person
A shared account, such as "reception" or "practice", makes it impossible to know who did what. Everyone must have their own account, with only the access their work requires.
Learn more
An assistant does not need the accounts, an external accountant does not need the X-rays: if an account is stolen, the attacker only gets what that account allows.
When a member of staff leaves, all their access is cut off the same day: computer, e-mail, software, remote access. Reviewing the list of accounts every quarter prevents forgotten access from piling up.
Does each member of staff have their own account, and is the access of former staff cut off on the day they leave?
In order: every action has an author.
Why it matters
In the event of an incident, you know who did what and when. And a stolen account only opens what its holder needs.
To keep it that way
Review the list of accounts every quarter: trainees, locums, former providers.
To fix: no way of knowing who did what.
The risk
With a shared account, one stolen password opens everything and no action can be traced. A former member of staff who keeps their access is a real risk.
What to aim for
A personal account for each person, rights limited to their role, and a leaving procedure that cuts everything off the same day.
With us
We create the accounts, set the rights according to roles and cut off access as soon as you tell us someone is leaving.
A short password, the name of the practice or a date of birth can be guessed in seconds. The guide recommends at least twelve characters and a different password for each service, stored in a password manager.
Learn more
A password manager keeps all the credentials encrypted: you only need to remember one. It does away with notes stuck under the keyboard and with the same password everywhere, the cause of many chain hacks.
Are the practice's passwords long, different for each service, and stored in a secure password manager?
In order: one stolen password does not open everything.
Why it matters
Each service has its own key: a leak at one does not compromise the others.
To keep it that way
The master password of the manager must be the strongest of all, and protected by two-factor authentication.
To fix: your passwords are an easy way in.
The risk
Programs automatically try millions of common passwords and reuse those that have leaked elsewhere. A reused password opens several doors at once.
What to aim for
Long, unique passwords, created and kept by a password manager, for every member of the team.
With us
We set up a password manager for the practice and store your credentials in it with you.
After the password, a code on the phone: even if the password is stolen, the attacker stays outside. It is the same principle as a bank card and its PIN.
Learn more
Enable it first on e-mail, remote access, online backups, the dental software if it allows it, and the bank.
A hacked mailbox is often used to deceive your contacts, laboratories and patients included.
Is two-factor authentication enabled on the practice's e-mail, remote access and online services?
In order: a stolen password is no longer enough.
Why it matters
It is one of the most effective measures against account theft, for minimal effort.
To keep it that way
Keep the backup codes in a safe place, for the day a phone is lost or replaced.
To fix: a single password protects your data.
The risk
A password can be stolen in seconds with a fake e-mail. Without a second factor, the attacker goes straight into your mailbox or your network.
What to aim for
A second factor on every service that allows it, starting with e-mail and remote access.
With us
We enable it on your accounts and help each member of staff set it up on their phone.
A remote control tool left permanently open, with a weak password, is a classic way in for ransomware.
Learn more
Every connection must be identified, protected by two-factor authentication, logged and limited in time. The wider the access (server, patient data), the more secure the solution must be.
The free versions of remote control tools are not designed for this.
Does remote access to your computers go only through a professional tool, with two-factor authentication and a record of every connection?
In order: every connection is controlled.
Why it matters
You know who connects, when and why. An attacker cannot use this door without passing the same checks.
To keep it that way
Keep the list of people authorised to connect, and remove those who no longer need to.
To fix: a door is left permanently open.
The risk
Bots constantly search for remote access tools exposed on the internet. With a weak password, the attacker gets in like a technician and installs their ransomware.
What to aim for
A single professional tool, every connection authenticated, logged and limited in time, and no free tool left on standby.
With us
Our remote maintenance goes through a professional tool: every connection is authenticated and logged.
Can you see a TeamViewer, AnyDesk or similar icon on your computers? Ask who uses it and how it is protected.
With us
During a first visit, free of charge, we check this point with you and explain what we found.
Not applicable: no remote access.
Worth bearing in mind
Nothing to protect on this side. Just check that no remote control tool (TeamViewer, AnyDesk or other) has been left installed on a computer: a forgotten tool is a forgotten door.
The contracts, rules and reflexes that hold everything else together.
Point 19Essential
An agreement with every provider
Your IT provider, your hosting provider, your fiduciary: any provider that processes your patients' data on your behalf must be bound by a data processing agreement (Art. 9 FADP).
Learn more
The agreement sets out what the provider may do with the data, how it protects it, to whom it may entrust it and what happens to it at the end of the relationship.
Before entrusting your data, you must also make sure that the provider is able to protect it. Intentionally entrusting data without complying with these rules is punishable, if a complaint is filed.
Do you have a signed data processing agreement with every provider that accesses your patients' data?
In order: your providers are bound by clear terms.
Why it matters
You know what each one may do with your data, and you have recourse if there is a problem. It is one of the first documents you will be asked for after an incident.
To keep it that way
Ask each provider for the list of services it uses on your behalf, and have the agreement updated when it changes.
To fix: your data is entrusted without any framework.
The risk
Without an agreement, you have no control over what happens to the data at the provider's, and your recourse is much harder to enforce. Before the FDPIC and your patients, you are the one who answers.
What to aim for
A written agreement for each provider, specifying the data concerned, the security measures, the services it uses itself and the time it has to notify you of an incident.
With us
Template DS7 in the kit gives you a basis. Ask each of your providers for this agreement, including us.
Look in your documents for an agreement that mentions Art. 9 FADP or data processing on your behalf. An invoice or an ordinary maintenance contract is not enough.
With us
During a first visit, free of charge, we check this point with you and explain what we found.
A large share of attacks begin with a booby-trapped e-mail or a deceptive phone call, received in good faith. Written, signed security rules and a short awareness session every year are the best defences.
Learn more
The written rules cover computers, passwords, e-mail, personal devices and what to do in the event of an incident. Every member of staff signs them on arrival.
The awareness session, 30 to 60 minutes long, takes place at least once a year and for every newcomer; a record of it is kept (date, participants, topics). The quiz on this site lets everyone test their reflexes.
Has your team signed written security rules and attended an awareness session in the last twelve months?
In order: the team knows the rules.
Why it matters
An alert team spots a fake e-mail before the click. And signed rules show that you had done what was needed, if a mistake happens all the same.
To keep it that way
Repeat the session every year and for every newcomer, trainees and locums included.
To fix: the team is the first target.
The risk
A click on a fake invoice, or a call from a fake technician, is enough to open the door. And without written rules, the practice owner cannot show that they had informed their team.
What to aim for
A short document, signed by everyone, and a recorded annual awareness session, with concrete everyday examples.
With us
Templates DS3 (security policy) and DS4 (training certificate) in the kit give you the basis, and the quiz on the site lets everyone practise.
The first minutes count. Everyone in the practice must know what to do, and above all what not to do, if a screen displays a ransom demand:
Isolate: unplug the network cable and turn off the WiFi. Do not switch the computer off.
Call your IT provider; failing that, the Federal Office for Cyber Security (FOCS).
Do not pay the ransom: that is the Confederation's recommendation.
Document: photograph the screens, note the exact time, delete nothing.
Assess: is patient data affected?
Report to the FDPIC if the risk for patients is high.
Is the procedure to follow in the event of an incident displayed in the practice and known to the whole team?
In order: the right reflex is close at hand.
Why it matters
Unplugging rather than switching off, calling rather than repairing yourself: these actions limit the damage and preserve the traces useful to the investigation and to the insurer.
To keep it that way
Check from time to time that the numbers on the sheet are still the right ones.
To fix: the team may make things worse.
The risk
Under stress, people switch the computer off, delete the suspicious message, try to repair it themselves. These are often the very actions that erase the traces and let the attack spread.
What to aim for
A sheet displayed near the computers, and a procedure known to everyone, with the right numbers.
With us
Quick-reaction sheet DS2, procedure DS5 and form DS11 in the kit are ready to print and display.
Cyber insurance covers part of the costs of an incident: recovery, business interruption, assistance. It complements security; it does not replace it.
Learn more
Read the exclusions and the preconditions: some policies do not pay out if updates had not been installed or if backups were missing.
Also check the excess, the coverage limit, and whether assistance can be reached at any hour.
Do you have cyber insurance, and do you know its conditions and exclusions?
In order: you are covered, and you know the terms.
Why it matters
In the event of an incident, you know whom to call and what is covered. And you know which measures the insurer expects of you.
To keep it that way
Read the conditions again at each renewal: insurers' requirements change.
To consider: an incident would be entirely at your expense.
The risk
Recovery, days of closure, informing patients: an incident quickly costs thousands of francs. It is not a legal obligation, but a risk to weigh up.
What to aim for
Cover suited to your practice, whose preconditions you meet.
With us
Insurers ask technical questions (backups, two-factor authentication, protection of computers): this check-up helps you answer them, and we provide you with the information on everything we manage.
"Send us this check-up" opens the contact form with this summary: you read it over, complete it and decide whether to send it. This check-up helps you take stock; it replaces neither an audit nor legal advice.