[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f4IxQzRyoVoMsB1K1wQ2BM8u7mEXMuip3J02n7ge411w":3},{"article":4,"iocs":46,"watch_terms":47,"solutions":48,"lesson":134},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"64e5ed28-ac56-4eae-b459-675d315d503c","Garante per la protezione dei dati personali (Italy) - 616\u002F2026","garante-per-la-protezione-dei-dati-personali-italy-616-2026-6a036a","← Older revision Revision as of 14:23, 15 September 2026 (One intermediate revision by the same user not shown) Line 113: Line 113: === Facts === === Facts === The DPA received a complaint from a data subject concerning the processing operations of the University Health Agency of Friuli Centrale’s (the controller) electronic health record system. The data subject complained about a few activities of the controller: The DPA received a complaint from a data subject concerning the processing operations of the University Health Agency of Friuli Centrale’s (the controller) electronic health record system. The complaint related in particular to access by the controller, its staff and other healthcare professionals from other facilities to Covid-19 results and surgical department data. It also concerned the lack of access logs. - The access of her medical records, for the purpose of verifying whether she had Covid-19 in order to schedule her shifts. - The access to her medical records by individuals who were not caring for the data subject, through a reservation system. - The ability for healthcare professionals to access medical records from other healthcare facilities. - The ability for healthcare professionals to access all records from the surgical department regardless of whether they are treating the patient. - The lack of access logs. The DPA initiated an investigation. The controller highlighted the exceptional circumstances of Covid-19, and the difficulties of organisational management of healthcare facilities. The controller deemed the use of these verification methods justified as it was the only method to quickly ensure a negative test and allow the data subject access to a ward. The DPA initiated an investigation. The controller highlighted the exceptional circumstances of Covid-19, and the difficulties of organisational management of healthcare facilities. The controller deemed the use of these verification methods justified as it was the only method to quickly ensure a negative test and allow the data subject access to a ward. Line 131: Line 121: Moreover, the controller addressed the upcoming implementation of a system which detects anomalies, and that given the number of staff on duty, especially in emergency room areas, it is plausible to assume that the person who viewed the list of the data subject’s documents would have been able to gain access even if a shorter automatic lockout period was implemented. With this the controller addressed their systemic vulnerability to malicious conduct by employees. Moreover, the controller addressed the upcoming implementation of a system which detects anomalies, and that given the number of staff on duty, especially in emergency room areas, it is plausible to assume that the person who viewed the list of the data subject’s documents would have been able to gain access even if a shorter automatic lockout period was implemented. With this the controller addressed their systemic vulnerability to malicious conduct by employees. === Holding === === Holding === The DPA found the fact that the data subject was already admitted for treatment at the time that her file was accessed irrelevant because the access to her records had nothing to do with her treatment, but rather for the management of the schedule of shifts. The DPA insisted on the principle of data minimisation, the risk of unauthorised access and the necessity of imposing restrictions to limit the access to electronic health records solely to those involved with the patients care, and not those in administrative positions. Emphasis was placed by the DPA on the need for data minimisation, the risk of unauthorised access and the necessity of imposing restrictions to limit the access to electronic health records solely to those involved with the patients care, and not those in administrative positions. The DPA found the measures implemented by the controller to ensure data protection by design and default were not adequate. Namely, as the automatic locking of the computers was not established with an appropriate inactivity period which took into account the nature, subject matter, context, processing purpose and risk to the rights and freedoms of data subjects. The DPA found the measures implemented by the controller to ensure data protection by design and default were not adequate. Namely, as the automatic locking of the computers was not established with an appropriate inactivity period which took into account the nature, subject matter, context, processing purpose and risk to the rights and freedoms of data subjects.","Italy's Garante per la protezione dei dati personali (DPA) investigated a complaint regarding unauthorized access to a patient's electronic health records. The University Health Agency of Friuli Centrale was found to have inadequate data protection measures, including insufficient access controls and logging, and an inappropriate automatic computer lockout period. The DPA emphasized data minimization and limiting access to patient data strictly to those involved in direct care.","Italian DPA fines University Health Agency for improper access to patient records.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Garante_per_la_protezione_dei_dati_personali_(Italy)_-_616\u002F2026&diff=53036&oldid=53005","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002Fe\u002Fec\u002FLogoIT.png","2026-09-15T14:23:55+00:00","2026-09-15T16:00:45.478174+00:00",7,[17,20],{"name":18,"type":19},"Garante per la protezione dei dati personali","vendor",{"name":21,"type":22},"electronic health record system","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39,41],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},{"category":42},{"id":43,"icon":25,"name":44,"slug":45},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",[],[18,21],{"controls":49,"vendors":133},[50,79,107],{"slug":51,"name":52,"problem":53,"products":54},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[55,63,71],{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":80,"name":81,"problem":82,"products":83},"log-management","Log management and security data pipelines","Security logs are so expensive to collect and keep that teams drop the ones they need when an incident happens.",[84,92,99],{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"edge-delta","Edge Delta","\u002Fvendor-logos\u002Fedge-delta.png","edge-delta-telemetry-pipelines","Telemetry Pipelines","https:\u002F\u002Fedgedelta.com\u002Fproduct\u002Ftelemetry-pipelines","Pipelines that process logs, metrics, traces and security events before they are indexed, with masking, hashing and pre-built packs, and a full-fidelity copy in object storage for rehydration.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":94,"url":97,"description":98},"tenzir","Tenzir","\u002Fvendor-logos\u002Ftenzir.png","tenzir-platform","https:\u002F\u002Ftenzir.com\u002F","Pipelines that collect, shape, enrich and route security data, with an open-source core and free and commercial editions.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-transit","GreyMatter Transit","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Ftransit\u002F","Security data pipeline that normalises and routes telemetry and detects threats while the data is in motion, to cut lag and storage costs.",{"slug":108,"name":109,"problem":110,"products":111},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[112,117,125],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":113,"product_name":114,"url":115,"description":116},"purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",[],{"slug":135,"title":136,"body":137,"framework_refs":138,"framework_notes":153},"italian-dpa-finds-hospital-exposed-patient-records-through-weak-access-controls-and-logging","Italian DPA Finds Hospital Exposed Patient Records Through Weak Access Controls and Logging","The University Health Agency of Friuli Centrale failed to adequately restrict access to electronic health records, allowing unauthorized individuals to view sensitive patient data. Insufficient logging meant the organization lacked the visibility needed to detect, investigate, and respond to unauthorized access events in a timely manner. An improperly configured automatic screen lockout period further compounded the risk by leaving workstations exposed in clinical environments. This case illustrates that healthcare organizations must treat access control and audit logging as foundational safeguards — not optional additions — especially given the sensitivity of health data under GDPR and sector-specific regulations. Without enforcing the principle of least privilege and maintaining robust audit trails, organizations cannot demonstrate accountability or effectively contain breaches.",[139,140,141,142,143,144,145,146,147,148,149,150,151,152],"GDPR Article 5(1)(f) — Integrity and confidentiality","GDPR Article 25 — Data protection by design and by default","GDPR Article 32 — Security of processing","GDPR Article 5(1)(c) — Data minimisation","CIS Control 6 — Access Control Management","CIS Control 8 — Audit Log Management","NIST SP 800-53 AC-2 — Account Management","NIST SP 800-53 AC-6 — Least Privilege","NIST SP 800-53 AU-2 — Event Logging","NIST SP 800-53 AC-11 — Device Lock","ISO\u002FIEC 27001:2022 Annex A 8.2 — Privileged Access Rights","ISO\u002FIEC 27001:2022 Annex A 8.15 — Logging","HIPAA Security Rule 45 CFR § 164.312(a)(1) — Access Control","HIPAA Security Rule 45 CFR § 164.312(b) — Audit Controls",{}]