Most sectors in Albania are still waiting to find out how the data protection regime will be enforced against them. Healthcare is not waiting. It already knows.

During 2025 the Commissioner carried out 15 administrative investigations in the health sector. Not in hospitals, and not in the public system: 8 of them were in dental clinics and 7 in medical laboratories. In February 2026 the Commissioner's office followed up by convening representatives of exactly those two groups to go through the findings and, in its own framing, to strengthen "a culture of responsibility and transparency in data handling, particularly regarding special categories such as health data."

Read that back slowly, because it tells you something about how this regulator works. It did not begin with the largest controller it could find. It picked a category of small and mid-sized private providers, inspected fifteen of them, and then held a meeting to tell the rest of the category what it found. If you run a clinic, a dental practice or a laboratory in Albania, you are not on a distant horizon of enforcement risk. You are in the segment the Commissioner has already chosen to work through.

There is a second reason this sector is ahead of the others. Health data has its own instrument. Instruction No. 02, dated 30 April 2025, "On the protection of personal health data" was issued under Law No. 124/2024, which is aligned with the GDPR, and it repealed the older Instruction No. 49 of 2020. It is a sector rulebook rather than general commentary, and it is far more specific than the law itself about what a provider has to do, down to the channels you may use to send a result to a patient. A great deal of the advice circulating in Albania about "GDPR for clinics" does not mention it at all.

This article covers what makes health data legally different, what Instruction 02/2025 actually requires, the processing a typical Albanian clinic or laboratory runs whether or not it has written it down, and then, module by module, how PrivaxisOS is used to carry each of those obligations and leave the evidence behind.

One timing note, stated up front. The impact assessment duty (Art. 31 / GDPR Art. 35) and prior consultation (Art. 32 / GDPR Art. 36) sit among the provisions deferred to early 2027. That changes nothing practical here. Everything else in this article, including Art. 9, the record-keeping duty, data subject rights, security, breach notification, the DPO duty and the whole of Instruction 02/2025, applies now.

Why health data is legally different

Under Art. 9 of Law 124/2024 / GDPR Art. 9, processing sensitive data is prohibited as a starting position, and becomes lawful only where one of the conditions in Art. 9(2) is met. Health data sits squarely inside that prohibition. So does genetic data, which matters for laboratories.

The condition that makes ordinary clinical work lawful is Art. 9(2)(ë). It is worth stating precisely, because an adviser trained on the GDPR will reach for "Article 9(2)(h)" out of habit, and that letter does not appear in Art. 9(2) of the Albanian law at all. The paragraph's ten conditions are lettered in the Albanian alphabet, a, b, c, ç, d, dh, e, ë, f, g, so the healthcare condition that corresponds to GDPR Art. 9(2)(h) is (ë). Note the neighbours: (e) is substantial public interest and (f) is public health, so a dropped diacritic lands on a different legal basis entirely. Art. 9(2)(ë) permits processing that

"is necessary for preventive medicine purposes or in the context of occupational health, for the assessment of the working capacity of the employee, for medical diagnosis, for the provision, treatment or management of health or health care services on the basis of the law, or pursuant to a contract with a health professional, and provided that the processing is made by employees subject to professional secrecy or an employee under its responsibility or another person subject to professional secrecy."

Three practical consequences follow, and each one overturns something clinics commonly believe.

Your legal basis is almost never consent. Clinics routinely put a consent tick-box at the bottom of an intake form and treat it as the licence for everything that follows. It is the wrong instrument. Art. 9(2)(ë) already makes diagnosis and treatment lawful; layering consent on top does not add protection, it adds a liability, because consent under Art. 8 / GDPR Art. 7 must be freely given and can be withdrawn at any time. A patient who withdraws "consent" to their own clinical record creates a problem you invented for yourself. Consent has a real and narrow role in a clinic, covering marketing, research participation, publishing a case photograph, or sharing a record with someone who has no legal right to it. Treating it as the basis for treatment itself obscures exactly the cases where it genuinely matters.

The condition attaches to people, not systems. Art. 9(2)(ë) is only satisfied where the processing is carried out by someone bound by professional secrecy, or working under the responsibility of such a person. That is why a receptionist's confidentiality undertaking, an IT contractor's terms and the access rights of a billing clerk are not administrative housekeeping. They are load-bearing parts of your legal basis. If an unbound person can open clinical records, the condition that makes the processing lawful is not satisfied for that access.

A clinic is very likely to owe a DPO. Art. 33(1)(c) / GDPR Art. 37(1)(c) requires the controller to designate a data protection officer where "the core activities of the controller or the processor lead to processing on a large scale of sensitive data or criminal records." A clinic's or laboratory's core activity is processing health data, so there is no argument to be had about the "core activities" limb. The only live question is "large scale", which the law does not define. A sole practitioner is generally accepted not to meet it; a hospital plainly does; a laboratory running thousands of results a month, or a multi-site dental group, sits much closer to the hospital end of that spectrum than most of their owners assume. This is a question to answer deliberately and write down rather than leave unexamined. Note also that Art. 33(2) lets a group of commercial companies appoint a single DPO who is easily accessible from each group member, which is how a multi-clinic group should normally solve it. Our guide to the DPO obligation under Law 124/2024 works through the criteria in full.

What Instruction 02/2025 actually requires

The instruction applies to all natural and legal persons operating in the public or private health system, to the bodies responsible for supervising health care, and to processors acting on their behalf. Its most useful provisions, in the order they will bite:

Prove it, on demand (Art. 2.1 and 2.2). Controllers and processors must respect the data protection principles and must be able to prove to the supervisory authority that processing complies. This is the accountability principle restated inside the health sector, and it is the sentence that decides what an inspection feels like.

Minors and legal representatives (Art. 2.4). Where a patient is a minor who is not in a position to give consent, it is given by the legal representative, meaning the parent or legal guardian. Dental and paediatric practices should have this reflected in how records are opened and who may collect results.

Genetic data (Art. 3). Genetic data is sensitive data processed only in the cases provided in Art. 9 of the law. It may be collected only where appropriate protective measures exist and where the law provides or consent has been expressed; it may be processed for prevention, diagnosis or treatment of the data subject or a member of their biological family, or for scientific research, and used only for those purposes. The data subject has the right to be informed about their genetic data, and the controller must guarantee access in the most appropriate form and manner. Any laboratory offering genetic or prenatal testing is operating directly on this article.

How results may be transmitted (Art. 4.4). This is the provision most likely to be breached in Albania this week. The rules apply to electronic medical records and to the electronic addresses used to share and exchange health data, and in every case the most appropriate and secure route must be chosen. The instruction then says, in terms, that personal addresses and applications such as WhatsApp must not be used for that sharing. Sending a laboratory result to a patient's WhatsApp from a staff member's personal phone is not a grey area, an efficiency or a courtesy. It is the specific practice the instruction names.

Who may receive health data (Art. 4.6 to 4.8). Data may go only to controllers or processors authorised by law to access it, or where the patient consents to that sharing. Insurers are authorised to access health data only to the level a special law provides, or to the level the patient has consented to, applying appropriate protective measures (4.7). Employees are not authorised recipients of an individual's health data, except under the conditions the instruction sets for processing in the employment context (4.8). The occupational-health request, "send us the results for our employee", has a clear answer, and it is usually no.

Prior information when data moves between professionals (Art. 4.1 and 4.2). Where health data is shared by different health professionals for the purpose of administering care to one individual, the patient must be informed in advance, except where that is impossible because of necessity and urgency. Where the sharing rests on consent, the consent can be withdrawn at any time.

Retention (Art. 5). Health data must not be kept in a form allowing identification for longer than necessary; the retention period is set in accordance with the specific legislation under which the controller operates, read together with the data protection law; and once the period ends the data is destroyed or anonymised. Note what this does not do: the instruction sets no number of years itself. This is an open item every provider has to close against Albanian health legislation and its own professional rules rather than by guesswork, and it is the most common gap we expect in a sector where "we keep everything forever" is the default.

Information duty (Art. 7). Patients must be informed before collection or at first contact, in clear and appropriate language that allows them to understand the intended processing fully, and through the legal guardian where the patient is unable to receive the information directly. Where processing is carried out by automated means, the controller must guarantee transmission in a structured, interactive and machine-readable format when data is transferred to another controller.

Confidentiality and security (Art. 8). Processing is lawful only where carried out by health professionals under a duty of professional secrecy and confidentiality, or by other persons subject to an equivalent duty (8.1); security measures must be reviewed periodically (8.2); and 8.3 then lists seven required controls. They are lettered in the Albanian alphabet, which is worth stating because it is the second easy miscitation in this area:

  • (a) preventing access by any unauthorised person to the installations used for processing, meaning entry control;
  • (b) preventing unauthorised entry into data processed in the information system, and any unauthorised consultation, modification or deletion;
  • (c) preventing use of automated processing systems by unauthorised persons through data transmission equipment, meaning usage control;
  • (ç) guaranteeing the ability to check and verify the individuals or entities to whom health data may be communicated through transmission equipment, meaning communication control;
  • (d) guaranteeing the ability to check who has had access to the system and which health data was entered into it, when and by whom, meaning data entry control;
  • (dh) preventing unauthorised reading, copying, modification or deletion of health data during communication and transmission of the database, meaning transmission control;
  • (e) protecting the data by making security copies, meaning backups.

Finally, 8.4 requires public and private controllers and processors of medical documentation to draft internal regulations reflecting the principles set out in data protection legislation and in the instruction. A written internal rulebook is not optional.

Research (Art. 9). Research processing needs appropriate safeguards; data must be anonymised where the research purpose permits and pseudonymised at the identification-sharing stage where it does not; a withdrawing participant's data must be destroyed or anonymised in a way that does not compromise the scientific validity of the research, with the participant informed; and results must not be published in a form that allows the data subject to be identified.

Mobile devices (Art. 10) must carry appropriate security measures guaranteeing verification of the person concerned and encryption during transmission. International transfers (Art. 11) follow Arts. 39 to 42 of the law, which correspond to GDPR Arts. 44 to 49, together with the sub-legal acts the Commissioner approves. Non-compliance is sanctioned under Art. 94 of the law (Art. 12.2), the Albanian equivalent of GDPR Art. 83, whose upper tier is denominated in lek at ALL 2,000,000,000 or 4% of total annual worldwide turnover, whichever is higher.

Read Art. 8.3 and Art. 5 together and you have the shape of the problem. The instruction demands an access log, a retention rule and a documented internal regulation, for data that most Albanian clinics hold in a practice-management system nobody has configured for any of those things, plus a paper archive, plus a shared inbox, plus at least one phone.

The processing a clinic or laboratory actually runs

Before any tool helps, the inventory has to be honest. This is the realistic set of processing activities for a mid-sized Albanian private clinic or diagnostic laboratory. Most providers, asked to list their processing, name the first four and stop.

  1. Patient registration and identification. Art. 9(2)(ë), with Art. 7 covering contact data. The ID number is usually collected out of habit rather than necessity.
  2. Appointment booking by phone, walk-in, website or social media message. Art. 9(2)(ë) or contract. The symptom typed into a web form is health data the moment it arrives.
  3. Clinical record and treatment history. Art. 9(2)(ë). Access is rarely restricted by role.
  4. Laboratory and imaging results. Art. 9(2)(ë). The transmission channel is the exposure, under Instruction 02/2025 Art. 4.4.
  5. Referral to, and results from, external laboratories. Art. 9(2)(ë) plus an Art. 26 processor or joint controller analysis. Often there is no written agreement at all.
  6. Samples or images sent abroad for analysis or second reading. Arts. 39 to 42 and Instruction 02/2025 Art. 11. Frequently undocumented, and it needs a transfer impact assessment.
  7. Genetic and prenatal testing. Art. 9(2)(ë) plus Instruction 02/2025 Art. 3. Purpose limitation is strict, and there is a biological-family dimension.
  8. Billing, invoicing and insurance claims. Art. 9(2)(ë), with insurer access bounded by Instruction 02/2025 Art. 4.7. Insurers routinely receive more than they are entitled to.
  9. CCTV in reception, corridors and waiting areas. Art. 7 legitimate interest plus Instruction 03/2025. Retention is 72 hours where the site is continuously monitored, otherwise 30 days at most.
  10. Telephone call recording. Art. 7 or consent. Usually no notice and no retention rule.
  11. Messaging with patients through an SMS gateway or a consumer app. This is the Art. 4.4 problem, and also a processor relationship.
  12. Website, booking widget, analytics and advertising pixels. Consent for non-essential trackers, plus Instruction 04/2025 on direct marketing. An ad pixel on a page about a treatment leaks a health inference.
  13. Reviews, testimonials and before-and-after photographs. Explicit consent. Patient images are health data in context.
  14. Marketing to past patients through recall campaigns and promotions. Consent, Instruction 04/2025, and protections for under-18s. Recall for clinical follow-up and marketing are not the same purpose.
  15. Employee and applicant data, and occupational health. Art. 9(2)(b) for the employment and social security limb, with Instruction 42 on job candidates and Instruction 11 on private-sector employees. Staff health records are often held alongside patient records.
  16. Clinical trials of medicines, where applicable. Instruction 18, which remains listed in force. Rarely mapped to the privacy programme.

Items 5, 6, 9, 11 and 12 are where the inspections land, because they are the ones that involve somebody outside the building.

Five failures that show up in this sector

Results travel over consumer messaging. Named in Instruction 02/2025 Art. 4.4. The fix is a channel decision, a processor agreement for the gateway you do use, and a staff rule that survives the busiest Friday.

Everyone can see everything. One shared login for reception, or a system with no role separation, defeats both Art. 9(2)(ë), which ties lawfulness to people under professional secrecy, and Instruction 02/2025 Art. 8.3(b) and (d). The Commissioner does not need forensics to find this. They ask who can open a record and watch the answer.

The external laboratory relationship is undocumented. A clinic sends samples to a reference lab and receives results back, for years, on a commercial arrangement that never mentions data protection. Art. 26 / GDPR Art. 28 requires a written contract carrying the mandatory terms, with sub-processors authorised in writing. If samples or images leave Albania, Arts. 39 to 42 apply on top. Our guide to managing processors under Law 124/2024 sets out the clause set.

Retention is "forever." Art. 5 of the instruction requires a period set against the legislation governing your activity, then destruction or anonymisation. "We have never deleted anything" is an answer that also tells the inspector how large your breach would be.

CCTV runs on nobody's authority. Instruction 03/2025 requires a documented internal decision approving camera types and positions and the exact zones monitored, prohibits cameras in exclusively private spaces, sets retention at 72 hours where the site is continuously monitored by personnel and 30 days at most otherwise, and requires standard signage. Waiting-room cameras in clinics are usually installed by a security contractor and inherited by nobody. We covered this in detail in the cameras you already installed.

Module by module: how PrivaxisOS carries this

What follows is the application of each module to this sector specifically: the processing it holds, the article or instruction it evidences, and the artefact it leaves behind for an inspection.

1. Record of processing, under Art. 27

The sixteen activities above are the register. The ROPA module turns them from a document someone built once into entries with owners: the laboratory manager owns items 4 to 7, the finance lead owns item 8, the practice manager owns 9 to 11, marketing owns 12 to 14, HR owns 15. Each entry carries the purpose, the legal basis, and here the basis field has to be able to express Art. 9(2)(ë) rather than a GDPR-shaped list, the data categories including the sensitive flag, the recipients, any transfer outside Albania with its safeguard, the retention period, and the security measures.

Two sector-specific points. First, the small-organisation exemption in Art. 27 does not apply to you: it is lifted where the processing is likely to result in a risk to rights and freedoms, where it is not occasional, or where it includes sensitive data or criminal records, and a clinic fails all three tests regardless of headcount. A twelve-person dental practice owes the same register as a hospital. Second, the retention field is where the open question from Instruction 02/2025 Art. 5 gets closed, per activity, with the legislation relied on recorded next to the number, which is exactly the form an inspector's question takes. The register every inspection starts with goes through the Art. 27 fields one by one.

The approval workflow matters more here than in most sectors, because the person who knows what happens to a sample is not the person who will answer for it. Draft by the business unit, review and lock by the DPO, annual cycle, export for the Commissioner.

2. Data subject rights, under Arts. 12 to 21 and Instruction 02/2025 Art. 6

Patients are the most likely group in Albania to exercise rights early, because the thing they want, a copy of their own record, is concrete and they have always felt entitled to it. Instruction 02/2025 Art. 6 restates the right to know whether their data is being processed, to receive information without delay in an understandable form, to access it, and to obtain correction or deletion of data that is inaccurate, untrue, incomplete or processed contrary to law, with legal reasons required for any refusal and a right of appeal to the Commissioner.

The DSR module handles the mechanics, including a public request form in Albanian, email verification, a tracking page and the internal queue with the 30-day clock from Art. 12 / GDPR Art. 12 and the extension to a 60-day total notified inside the first 30. The sector-specific value is in the decision patterns it forces you to record:

  • Access to a clinical record engages third-party data almost every time, because family history names relatives and referral letters name other clinicians. The response is redaction, documented, not refusal.
  • Erasure is usually refused in part. Where health legislation sets a retention period, the record stays; the marketing list entry goes. The correct outcome is partial fulfilment with the legal ground for each half recorded, and any refusal notified within 30 days with reasons and complaint routes.
  • Portability rarely applies. Art. 18 / GDPR Art. 20 attaches to data the subject provided where processing rests on their approval or on a contract and is carried out by automated means, which puts a clinical record held under Art. 9(2)(ë) on the basis of law outside it. Patients still get their data under the access right, but the distinction determines the format you owe and whether a competitor clinic can demand a direct transfer.
  • Minors and representatives. Instruction 02/2025 Art. 2.4 puts consent with the legal representative where the minor cannot give it, and the module records who made the request in what capacity, which is the question that gets asked afterwards.
  • Identity verification is not friction here, it is the control. A request for someone else's medical record, fulfilled, is a sensitive-data breach caused by your own hand, and under Art. 29 / GDPR Art. 33 you would then be notifying the Commissioner within 72 hours about a failure of your own process.

Our guide to the 30-day clock covers the grounds for refusal and the traps in them.

3. Privacy assessments, under Arts. 31 and 32

A clinic or laboratory meets the high-risk indicators without effort: large-scale processing of special-category data is the business model, and CCTV adds systematic monitoring on top. The assessments that earn their keep in this sector:

  • DPIA on a new system or site. Adopting or replacing a clinic-management or laboratory information system, opening a new site, introducing patient portals or online results, or launching any genetic or prenatal testing service under Instruction 02/2025 Art. 3.
  • DPIA on CCTV across reception and treatment areas, assessed against Instruction 03/2025: zones, camera positions, the internal approving decision, retention at 72 hours or 30 days, and signage.
  • Vendor risk assessment on the reference laboratory, the practice-management vendor, the imaging or teleradiology provider, the SMS gateway, the cloud host and the billing bureau, evidencing the "sufficient guarantees" test in Art. 26(1) / GDPR Art. 28(1) before signing.
  • Transfer impact assessment on samples, images or records sent abroad for analysis or second reading, under Arts. 39 to 42 and Instruction 02/2025 Art. 11.
  • Security risk assessment built directly on the Art. 8.3 control set in Instruction 02/2025, used as the questionnaire: premises access, system access, usage, communication, access logging, transmission and backups.

That last one is the one to notice. Instruction 02/2025 Art. 8.3 is written as a list of seven controls. Turning it directly into an assessment template gives you an assessment whose structure mirrors the instrument the Commissioner will assess you against, which is a materially stronger position than a generic security questionnaire. The assessment is assigned across the people who actually hold the answers, the IT contractor, the laboratory manager and the practice manager, and comes back as one scored, dated, attributed record.

Where residual risk stays high after mitigation, Art. 32 / GDPR Art. 36 prior consultation applies. The Commissioner gives an opinion no later than 60 days from receiving the request, extendable by no more than a further 45 days where the intended processing is complex, with the reasoned extension notified within the first 30. For a clinic planning a new site or a patient portal, that is a project-plan item rather than a formality. Impact assessments under Article 31 works through the triggers.

4. Vendors and processors, under Art. 26

The health-sector vendor list is longer and more sensitive than most controllers expect, and it is the list an inspector asks for first after the register. The vendor module holds each processor with its written contract, the nine mandatory Art. 26(3) / GDPR Art. 28(3) terms mapped, the sub-processors authorised in writing under Art. 26(2), the location of processing and the linked assessment.

For this sector the register should specifically capture the reference laboratory; the clinic or laboratory information system vendor and whoever hosts it; imaging, PACS and any teleradiology reader; the SMS or messaging gateway used to notify patients, which after Instruction 02/2025 Art. 4.4 is a compliance control as much as a supplier; the billing or accounting bureau; the insurer-facing intermediary, bounded by Art. 4.7; the website and booking-widget provider; and the IT support contractor who can reach the clinical system, whose confidentiality undertaking is part of your Art. 9(2)(ë) basis.

The point the module makes structurally is the one that defeats clinics: HR signs the payroll bureau, the lab manager signs the reference lab, the owner signs the software, and nobody holds the whole picture. Art. 26 liability does not distribute the same way the signatures did.

5. Website scanning

Clinic websites are an unusually sharp risk, for a reason that has nothing to do with Albania specifically: the page a visitor is reading is itself a health inference. A third-party advertising or analytics tag on a page about fertility treatment, oncology or dental implants transmits the fact that an identifiable browser viewed that page. Special-category data inferred from behaviour and disclosed to a processor nobody assessed reads the same way under Art. 9 / GDPR Art. 9 as it does anywhere else, with Instruction 04/2025 on direct marketing sitting alongside it.

The web scan module scans each domain and reports the cookies set and their purpose, the third-party trackers present and where they send data, and a risk score per domain. For a clinic the specific things to look for are the advertising pixel on treatment pages, the embedded booking widget that sets its own cookies, the chat widget that receives symptom descriptions, the analytics install with advertising features switched on by default, and the tag an agency added two years ago that nobody documented. Verifying consent behaviour, meaning whether a given tracker fires before the visitor has agreed, is a separate capability still in development; what the scan evidences today is what is actually set and sent, which is the inventory the rest of the analysis depends on.

6. Compliance intelligence

Instruction 02/2025 Art. 2.1 and 2.2 require the controller to be able to prove compliance to the supervisory authority. Art. 8.4 requires internal regulations to exist as a written rulebook. Art. 8.2 requires security measures to be reviewed periodically, a duty that is invisible unless something records that the review happened.

The compliance hub is where those three meet: one view across the register's completeness, requests open and their time remaining, assessments in progress and overdue reviews, vendor agreements missing, and scan findings outstanding, with a compliance score that comes out of the operational record rather than being assembled by hand for a meeting. Given that the Commissioner has inspected fifteen providers in this sector and convened the rest to discuss what it found, the ability to answer "where do we stand today" without a two-week scramble is not an abstract benefit.

7. The platform underneath, and the clause that maps to it exactly

Instruction 02/2025 Art. 8.3(d) requires the controller to guarantee the ability to check who has had access to the system and which health data was entered into it, when and by whom. That is an audit-logging obligation written into Albanian health-sector secondary law, in almost the exact words a product specification would use.

Against the Art. 8.3 list, the platform layer carries role-based permissions, so the DPO sees everything while a business-unit liaison sees only their area and an assessment participant sees only their questionnaire, answering 8.3(b) and (c); audit trails on every meaningful action with user, timestamp and context, answering 8.3(d); and visibility controls that keep internal notes internal while the patient sees the status they are entitled to. Tenant isolation, Albanian-by-default public pages so no patient is asked to read English to exercise a legal right, and notifications against deadlines complete the picture. The same controls are what Art. 28 / GDPR Art. 32 asks of you at the level of the law itself.

Two controls in 8.3 are explicitly not the platform's to satisfy and should be assigned elsewhere in the programme: 8.3(a), physical access control to the premises where processing occurs, and 8.3(e), security backups. A module map that quietly implies software closes every control is the kind of claim that fails in the room.

A ninety-day sequence for a clinic or laboratory

Weeks 1 and 2. Decide the Art. 33 question in writing: are your core activities large-scale processing of sensitive data, and is a DPO therefore mandatory? Record the reasoning either way. Inventory the sixteen activities above against your reality and open the register.

Weeks 3 to 5. Close the retention question from Instruction 02/2025 Art. 5 per activity, against the health legislation governing you. Write the internal regulation Art. 8.4 requires. Fix the transmission channel problem in Art. 4.4: decide the route, contract the gateway, tell the staff, and write it into the regulation.

Weeks 6 to 8. Put every processor under an Art. 26 contract, starting with the reference laboratory and the system vendor. Run the transfer assessment on anything leaving Albania. Run the security assessment against the Art. 8.3 control set.

Weeks 9 to 12. Stand up the patient-facing rights route in Albanian and run a live test through it. Bring CCTV into line with Instruction 03/2025: the internal approving decision, the zones, the retention and the signage. Scan the website and deal with what is on the treatment pages. Then look at the compliance score and fix whatever it says is missing.

A short readiness check

Can you produce your register today, with the retention period for clinical records and the legislation it rests on written next to it? Do you know every person who can open a patient record, and is each of them under a duty of professional secrecy? Is there a written internal regulation, as Art. 8.4 requires? Is there an access log that would show who opened a given record last month? Can you name every organisation that receives health data from you, and produce an Art. 26 contract for each? Does anything leave Albania, and is there a transfer assessment for it? Could a patient ask for their record in Albanian without emailing a doctor personally, and would the answer arrive inside 30 days? And has anyone sent a result over WhatsApp this week?

If the last answer is yes, start there. The Commissioner has already written that one down.

If you want this run as a programme rather than a project, our DPO services cover the sector directly, and the sector pages set out how the same structure applies elsewhere.