Data Protection Authorities ('DPAs') published several decisions related to the processing of health data in the past months.

Such decisions shed light on the key measures to implement to stay compliant with privacy (and healthcare) laws and avoid a critical finding.

For each decision, we propose key takeaways: use them as ideas and guidelines for your own organisations: check that such measures are implemented at your organisation, and if not, talk to your management (or talk to us!).

Many thanks to GDPR hub NOYB and to IAPP for all this valuable information!

France:

Fact:

The French DPA, the CNIL fined CRO IQVIA 5 million euros for illegal processing of patient data in big healthcare data warehouses. IQVIA receives pseudonymised patient data transmitted by pharmacies in town. But patients were not informed that their health date would be sent to IQVIA, infringing article 13 and 14 of the GDPR on transparency. Read article from the CNIL (in French): https://www.cnil.fr/fr/donnees...

Takeaway:

Always inform people that you are collecting or processing their personal data.

Fact:

On 21 May 2026, healthcare payer Almerys experienced a massive cyberattack: over 15 million of social security numbers and over 44 million payment lines were leaked.

Almerys acts as an intermediary between patients, healthcare professionals and health insurance companies. In addition to the social security number, the following have been leaked: first name, last name, date of birth, and links between members of the same family.

Many big and small health insurance companies are impacted, for example SwissLife, Generali, BNP, AG2R La Mondiale, etc. A similar important breach had taken place in 2024 also.

The hacker said that Almerys was not using MFA (Multi-Factor Authentication) to protect the accounts.More details here: https://frenchbreaches.com/blo...

Takeaway:

Multi-Factor Authentication should have been implemented.

We cannot comment further as the circumstances of the breach are not described in the article/

Fact:

Several other organisations in the healthcare sector have experienced cyberattacks in May in France: for example optician networks Atol, Auchan Optique and Optic 2000.

Read details on https://frenchbreaches.com/

United Kingdom:

Fact:

On 23 April 2026 the UK government announced that data from UK Biobank had been advertised for sale online. The UK Biobank holds the records of more than half a million volunteers. At the time we write, the NHS HRA is investigating this suspected breach. Read more here: https://www.hra.nhs.uk/about-u...

United States:

Fact:

Jennifer Kamrass confessed her worries to her therapist: her marriage, her finances, and self-esteem. Therapists are legally and ethically bound to confidentiality, but two years later, a transcript of every word Kamrass had typed to her psychologist using the app Talkspace was subpoenaed in court by her former employer.

Talkspace executives assure investors data is anonymized, but experts say that such anonymity can be broken.

Read article from Proofnews: https://www.proofnews.org/woma...

Takeaway:

It's not clear from Proofnews' article how Karmrass' former employer got hold of the personal data, and if it was via a legal mean.

• Firstly, Talkspace pseudonymises personal data (identifiers are redacted as per HIPAA), but personal data are not fully anonymised.
• Secondly, in the US, it is not against the law to sell redacted health data without patient's consent.
• Third, users of Talkspace in the US are not given the option to oppose to the reuse of their health data. So, probably the employer managed to acquire Kamrass' health data from a broker.

We can see here clearly that HIPAA and other US privacy laws don't provide enough protection to data subjects.

Fact:

The Centers for Medicare and Medicaid Services' new health directory allegedly exposed the Social Security numbers of healthcare professionals, The Washington Post reports. The database was opened to the public for several weeks as part of the center's data transparency initiatives. The CMS said it has "taken steps to address it promptly and reinforce safeguards around data submission and validation."
Read article from the Washington Post: https://www.washingtonpost.com...

Takeaway:

It is good practice in IT to test and review a system before making it live. Here it would have been necessary to check that no unwanted personal information was visible on the internet, before making the information live to the general public.

Fact:

Lack of transparency in Healthcare providers' privacy notices:

Dark patterns force patients to share their data with big healthcare networks, even when the privacy form they’re signing explicitly says they can opt-out. A lack of opt-out standards and alleged use of dark patterns could make it difficult for consumers to obtain documents they consented to and know what sensitive health data has been collected and shared.

Read article from Calmatters: https://calmatters.org/economy...

Takeaway:

Always inform data subjects clearly, transparently and with simple words on which of their personal data are collected, who will process their data, in which country, for how long it will be kept, and how patients can exercise their rights (e.g. get a copy of such personal data, oppose to a processing, etc.).