What you need to know as a dental practitioner in Switzerland
As a dental practitioner, you handle sensitive data every day: medical records, patients' personal information, X-ray results, etc. In Switzerland, the protection of this data is governed by the FADP (the revised Federal Act on Data Protection), which imposes strict requirements on the confidentiality and security of information. Here is what you need to know to make sure your practice complies with this act and to protect your patients.
What is the FADP?
The revised Federal Act on Data Protection (FADP) is the revision of the Swiss data protection act. It came into force in September 2023 to strengthen individuals' rights over their personal data and to bring Switzerland into line with European standards (in particular the GDPR). It applies to all Swiss companies, including dental practices, that collect, process or store personal data.
Main obligations under the FADP
Information and consent of patients: Patients must know how their data is used: storage, processing and possible transfer to third parties, in particular other healthcare professionals or laboratories (Art. 19 FADP). The care itself is based on the treatment contract and legal obligations. Where the patient's consent is needed, for example to pass their data on to a third party not involved in the treatment, it must be freely given, informed and, for health data, explicit (Art. 6 para. 6 and 7 FADP).
Securing data: The act requires technical and organisational measures to be put in place to protect data. This includes the use of secure passwords, antivirus software and encryption systems to prevent unauthorised access to information.
Notification of a data breach: If a data security breach (leak or hacking) is likely to result in a high risk for patients, you must report it to the Federal Data Protection and Information Commissioner (FDPIC) as soon as possible, and inform the patients concerned if their protection requires it (Art. 24 FADP).
Right of access and correction: Patients have the right to request access to their personal data and to have it corrected or deleted if it is inaccurate or unnecessary.
Retention period: You must define a data retention period in line with the legal and medical obligations specific to your field. The minimum retention period for medical records is set by the cantonal health laws: at least 10 years in Geneva, in the canton of Vaud and in Fribourg, at least 20 years in Valais, in Neuchâtel and in the canton of Bern. The 20-year limitation period for personal injury is a reason to aim for 20 years everywhere. Once the applicable period has expired, data that is no longer needed must be deleted or anonymised; in Geneva and Fribourg, the record must be destroyed after 20 years at the latest, unless there is an overriding interest.
The risks of non-compliance
Failing to comply with the FADP can have serious consequences, including substantial fines and legal penalties. More importantly, it can seriously affect your patients' trust. A leak of medical data can damage your practice's reputation, or even lead to legal action.
Secure e-mail and e-mail encryption
Sending medical results or other sensitive information by e-mail is common practice, but it carries risks. Unencrypted e-mails can be intercepted, exposing patients' data. Using secure e-mail, such as ProtonMail, makes it possible to ensure that your exchanges meet the security standards required by the FADP. By choosing an e-mail provider based in Switzerland, you benefit from one of the strictest data protection regimes in the world.
Data backup
Regular, secure backups are another essential element of data protection. Your practice must have a reliable backup system that allows information to be restored quickly if there is a problem, while ensuring that this data is protected by encryption technologies.
The security of IT systems
In the dental field, the use of specific software for managing patients or X-rays is common. It is imperative to make sure that all the operating systems, software and devices used in your practice are updated regularly to receive the latest security patches. Outdated or insecure systems can become gateways for cyberattacks.
What measures should you put in place to comply?
Here are a few practical steps to make sure your practice complies with the FADP:
Security audit: Assess your practice's IT infrastructure to identify vulnerabilities.
Setting up secure e-mail: Switch to encrypted e-mail for sensitive exchanges.
Staff training: Make your teams aware of good data security practices.
Regular backups: Use a reliable backup solution that guarantees the security of your patients' data.
If you have questions about data protection or would like to upgrade your practice's security, DentalSystems is here to support you. Our expertise in medical IT helps you meet the standards of the FADP while simplifying your day-to-day management.
Contact us for a free security audit or to discover our tailor-made solutions.