What are my obligations in protecting patient data?

The regulatory figures you need before anyone touches your patients’ data: health data is classed as sensitive under the Personal Data Protection Law with heightened requirements; any breach or unlawful access must be reported to SDAIA within 72 hours of becoming aware of it; fines reach SAR 5 million; and disclosing sensitive data with intent to harm carries up to two years’ imprisonment. Some entities regularly processing sensitive data are also required to appoint a data-protection officer as the liaison with SDAIA.

And what that translates into as binding technical decisions: permissions at the level of need rather than of job title (reception sees the appointment and the mobile number, not the diagnosis); an access log recording who opened each record, when, and what they changed, which cannot be deleted; encryption at rest and in transit; backups that have actually been restore-tested rather than merely scheduled; and a clear retention policy.

And the biggest practical risk in clinics is not an external breach but ordinary daily leakage: photographs of reports on staff phones, WhatsApp groups carrying patient names, Excel files sent by email, and one shared account used by three people so nobody knows who did what. Those four are addressed by the system and the policy together — and the system alone is not enough while the side channel stays open.

• 72 hours to report to SDAIA · fines to SAR 5m · up to 2 years’ imprisonment
• Permissions by need: reception does not see the diagnosis
• A non-deletable access log — who opened, when, what changed
• Backups actually restore-tested, not merely scheduled
• The biggest real risk: photos, WhatsApp and shared accounts — not hackers