Healthcare Sector
Regulatory and organisational support for private hospitals, clinics, outpatient centres, residential care facilities and diagnostic laboratories: we work with clinical management, risk management, the DPO, information systems and procurement on accreditation, patient safety, health data, NIS2 and the 231 Model.
Sector challenges
Structural, technological and organisational requirements with a national baseline (Italian Presidential Decree of 14 January 1997), further qualification requirements set by the Regions, periodic inspections and contractual agreements fixing volumes and tariffs: what is at stake here is not merely a penalty, but the very title under which the facility operates and its financial relationship with the Italian National Health Service.
Adverse events and sentinel events to be identified and reported, claims to be handled, insurance cover to be maintained, medical records to be released within the statutory deadlines: patient safety is now an organisational duty, not an optional good practice.
The electronic patient record, the health dossier, the Fascicolo sanitario elettronico (the Italian national electronic health record), telemedicine, online test reports and clinical research multiply the points of access to special categories of data, with different legal bases for care, public health and research, and with the need to trace who consults what.
Ransomware on a hospital information system does not bring an office to a halt: it blocks operating theatre lists, the laboratory, diagnostic imaging and access to the patient’s history. Poorly segmented networks, connected medical devices with long update cycles and untested backups make recovery uncertain.
Reporting of the services provided, public grants and funding, purchases of medicines and devices, relations with prescribing doctors: areas in which Italian Legislative Decree 231/2001 exposes the entity to financial penalties and to disqualification penalties, the latter capable of affecting the authorised activity itself.
Biological risk, ionising radiation, cytotoxic drugs, patient handling, work-related stress and assaults on healthcare staff, together with clinical waste and continuing professional development: obligations that involve every department and have to be documented, not merely declared.
Areas of work
We compare the applicable requirements, from the national minimum standards to the further requirements of the Region concerned, with the documentation and the practices actually followed on the wards, identify the missing evidence and prepare the facility for inspections. Where certified systems already exist or would be useful (ISO 9001, ISO 45001, ISO/IEC 27001), we use them as the framework, avoiding parallel manuals.
We work alongside clinical management and the risk management function on incident reporting, analysis of adverse events, clinical audits, reporting flows to the regional centre and to the national observatory, and the recommendations issued by the Italian Ministry of Health. We review the process for releasing medical records so that the deadlines in Article 4 of Italian Law 24/2017 are met in a traceable way.
We put in order the record of processing activities, the privacy notices and consents kept separate for care, research and communications, and the breach procedure. For the health dossier we define access profiles by role and department, logging and periodic log review; for suppliers (software houses, external laboratories, clinical reporting services) we review contracts and processor appointments. We take on the role of outsourced DPO where the facility has no adequate and independent internal function.
We check whether the facility falls within the scope of Italian Legislative Decree 138/2024 and under which classification, handle registration with the ACN (the Italian cybersecurity agency), the risk management measures and the incident notification procedure, and put the electronic patient record, PACS, laboratory systems, booking portals and medical device networks through vulnerability assessment and penetration testing.
We build or update the Model around the processes that are genuinely exposed (reporting to the Region, healthcare procurement, donations and sponsorships, health and safety, computer crime and tax offences) and organise the Supervisory Body (OdV) with information flows from risk management, the DPO and the management systems. For entities also subject to Italian Law 190/2012 and to the publication duties of Italian Legislative Decree 33/2013, we coordinate the two systems instead of duplicating them.
We set up a single audit plan covering clinical, administrative and IT matters, with sample checks on medical records, consents, system access, procurement and safety obligations, and provide general management with readable indicators on adverse events, complaints, response times and the status of corrective actions.
For a healthcare provider the rules do not merely govern the way it works: they govern the title under which it works. Authorisation to operate, institutional accreditation and contractual agreements rest on Articles 8-ter, 8-quater and 8-quinquies of Italian Legislative Decree 502/1992. The minimum structural, technological and organisational requirements have a national baseline (Italian Presidential Decree of 14 January 1997), but the Regions supplement them with further qualification requirements and periodically verify that they are met: they differ from one territory to another and have to be read in the version currently in force.
Patient safety has been part of the right to health ever since Italian Law 24/2017 (Gelli-Bianco) set out the instruments for it: a clinical risk management function, reporting flows on adverse events to the regional centre and to the national observatory at AGENAS (the Italian national agency for regional health services), and the duty to hold insurance cover or equivalent measures (Article 10), with minimum requirements defined by implementing rules. Article 4 fixes the deadlines for releasing medical records: seven days from the request, with any additions within thirty.
Data and systems make up the chapter that is growing fastest. Health data are special categories of data within the meaning of Article 9 of the GDPR, with different legal bases for care, public health and research; designation of a data protection officer is compulsory for public bodies and wherever large-scale processing of such data is a core activity (Article 37 of the GDPR): this is the ground covered by the outsourced DPO. Italian Legislative Decree 138/2024 places healthcare among the highly critical sectors, with a classification that depends on size and activity and has to be checked case by case (NIS2 compliance). The unavailability of clinical systems is at once a matter of continuity of care, of information security and of a breach involving health data: it has to be managed through a single procedure. Connected medical devices (Regulation (EU) 2017/745) add a technical scope of their own, distinct from administrative IT.
Then there are the duties of the entity itself: the 231 Model covering offences against the public administration, the improper receipt of public funds, and involuntary manslaughter and serious negligent injury (Article 25-septies), alongside health and safety at work (Italian Legislative Decree 81/2008). For public bodies and, within the limits of Article 2-bis of Italian Legislative Decree 33/2013, for privately incorporated entities under public control, corruption prevention (Italian Law 190/2012) and transparency come into play as well, to be coordinated with the Model rather than duplicated alongside it.
We work inside the clinical and administrative processes. The starting point is a review of what already exists: evidence of the accreditation requirements, procedures issued by clinical management, incident reports and open claims, the record of processing activities, access profiles for the clinical applications. From there comes a plan with priorities, owners and timescales.
The engagement is proportionate to the facility: a private clinic with an operating theatre, a residential care home and a diagnostic laboratory face different risks and different obligations, and oversized procedures are not applied on the ward.
Our counterparts are the general and clinical management, risk management, the DPO, the information systems function and procurement: a single point of contact who works across the functions instead of four consultants who never speak to one another. The scope is defined together: a single topic (an accreditation requirement to be rebuilt, an adverse event to be analysed, the access profiles for a clinical application), periodic oversight of obligations and indicators, or support during a specific phase, such as an announced accreditation inspection or a change of information system. Responsibilities and timescales are set at the outset.
The value lies in holding together matters usually entrusted to different parties. The electronic patient record is an accreditation requirement, an archive of special categories of data, a system critical to continuity of service and a source of evidence in litigation: reading it from all these angles produces one procedure, one access log, one plan of checks. The decisions remain with management.
Frequently asked questions
Italian Legislative Decree 231/2001 does not impose the Model as a general rule. In some Regions the rules on accreditation and on contractual agreements do refer to organisational models and internal control systems, and in public tender procedures the Model usually appears as a scoring advantage in the technical tender rather than as a condition of participation: these are points to be checked against the legislation of the Region concerned and against the individual tender documents, not a matter that can be generalised. Beyond the formal duty the substance remains: without a Model adopted before the event, effectively implemented and overseen by an autonomous Supervisory Body, the entity has no instrument with which to defend itself against the charge, and for an accredited facility disqualification penalties weigh more heavily than financial ones.
Access must be limited to the staff taking part in the care process, for the time and to the extent necessary, with profiles differentiated by role and department and with the possibility for the patient to object to the inclusion of individual episodes of care. Demonstrating it rests on three elements: authorisation profiles aligned with the actual organisational structure, access logs retained for the period defined, and periodic sample checks with documented outcomes and action taken on anomalies. Without the third element the first two are not enough in the event of an inspection or a complaint.
Italian Legislative Decree 138/2024 places the healthcare sector among the highly critical ones and includes healthcare providers, but qualification as an essential or an important entity depends on size, on the nature of the activity and on specific criteria set out in the decree: the answer is not the same for every facility and has to be checked case by case. If the scope is confirmed, what follows is registration on the ACN platform within the annual deadlines provided, proportionate risk management measures and notification of significant incidents according to the stages and timescales laid down, beginning with a prompt early warning.
Through three distinct pieces of work. The first is technical: segmentation of the networks between administrative systems, clinical systems and medical devices, management of privileged accounts, updates, backups kept separate from the production network and recovery actually tested through exercises, not merely described in a procedure. The second is organisational: paper-based continuity procedures for triage, medicines administration, the operating theatre and the laboratory, with defined responsibilities and trained staff. The third concerns handling the event itself: a single procedure that holds together notification to the Garante of a breach involving health data, notification of the incident to the ACN where due, communication to patients and the information flows to the Supervisory Body.
For public bodies the appointment is always compulsory. For private facilities the duty arises where large-scale processing of health data is a core activity (Article 37 of the GDPR): for a hospital, a private clinic, a residential care facility or a diagnostic laboratory that condition is as a rule met, whereas for very small outpatient practices the volume and the regularity of the processing have to be examined. In every case the assessment has to be put in writing, including where it leads to no appointment being made, and the contact details of the designated DPO must be notified to the Garante and set out in privacy notices and in the record of processing activities.
Related services
Compliance with EU Regulation 2016/679 and the Italian Privacy Code: assessment, record of processing, DPIA, policies and training.
Find out moreAn outsourced data protection officer: independence, specialist expertise and continuous oversight of compliance with data protection obligations.
Find out moreAlignment with EU Directive 2022/2555 and Italian Legislative Decree 138/2024: scope, gap analysis, security measures, governance and incident notification.
Find out moreTechnical security testing of networks, applications and infrastructure: we find vulnerabilities before an attacker does.
Find out moreOrganisation, Management and Control Models under Italian Legislative Decree 231/2001, predicate offence risk assessment and support for the Supervisory Body (OdV).
Find out moreLet’s talk
Tell us your business priorities: in a first meeting with no obligation we look at your context and propose a concrete way forward, with clear timescales and measurable results.