# DPO for Healthcare Israel | Privacy for Clinics, Labs & Mental Health > DPO services for healthcare entities in Israel: private clinics, clinic networks, labs, diagnostic centers, mental health, physiotherapy, nursing and long-term care. Medical data is special-sensitive — clear DPO obligation, high security level, consent management, Amendment 13 + Patient Rights Law compliance. **Canonical:** https://dpoisrael.com/en/sectors/healthcare/ **Locale:** en-IL --- Special-sensitive data — high security # DPO for Healthcare. Privacy that cares. **Private clinics, clinic networks, labs, diagnostic centers, mental health, physiotherapy and nursing** hold special-sensitive data. **Amendment 13** + **Patient Rights Law** + 2017 Security Regulations — double regulation. Outsourced **DPO for clinic**, with understanding of EMR, Ministry of Health circulars, and the unique aspects of mental health and minors. ## DPO for Healthcare — what to know - **Data classification:** Special-sensitive — high security level - **Parallel laws:** Amendment 13 + Patient Rights + MoH circulars - **Retention:** 20 years adult, 7 years past 18 for minors - **International standard:** ISO 27799 (health) + ISO 27001/27701 - **Consent:** Explicit — no implied consent - **Small clinic retainer:** 5,500-9,500 ILS/month - **Clinic network retainer:** 11,000-20,000 ILS/month - **Lab / large network retainer:** 18,000+ ILS or GRC ## 10 databases every healthcare entity has | Database | Sensitivity | Note | | --- | --- | --- | | Electronic Health Record (EHR) | Special-sensitive | Anamnesis, diagnoses, medications, visits, history | | Lab results | Special-sensitive | Blood tests, genetics, imaging, biopsy | | Informed consent | High | Consent forms for treatment, surgery, research | | Mental health | Most-sensitive | Mental health treatment records, psychiatric diagnoses, counseling | | Minor patients | Most-sensitive | Data on minors — parental consent, age-specific rules | | Medical accounting file | Medium-High | Charges, insurance funding, supplemental insurance | | Digital imaging results | Special-sensitive | CT, MRI, X-ray, ultrasound — stored in PACS | | Appointment system | Medium | Treatment dates, treatment types (visible in lists) | | Home care monitoring | Sensitive | Nursing patients, terminal patients, palliative care | | Healthcare worker files | High | Professional licenses, criminal background, vaccinations, health status | ## Healthcare regulatory framework ### Amendment 13 — Category 5 **Processing sensitive data at scale**. Every clinic with 1,000+ patients, every lab, every health institute — must have a DPO. No "buts". ### Patient Rights Law (1996) Separate law defining medical confidentiality obligations. Supersedes Amendment 13 on medical data questions — sometimes even stricter. ### 2017 Security Regulations — high level Medical database = automatic high security level. Retention, encryption, access controls, audits — strict requirements. ### Informed consent Every medical data collection requires explicit consent. No "implied consent". Not just for treatment — also for data processing, research, third-party sharing. ### Medical research Research data requires specific consent, Helsinki committee, sometimes DPIA. Privacy + bioethics integration. ### Ministry of Health circulars Specific directives on medical records, retention, digital signatures, approved EMR software. ## Six issues unique to healthcare ### EMR vs. paper file Many Israeli clinics still combine digital systems with paper files. Each format with different security requirements, both requiring documentation. ### HMO data sharing Private clinics send tests to / receive from HMOs. Every flow requires DPA and consent management. ### Health apps & clinic Appointment scheduling apps, doctor chat, treatment monitoring environment. Each is a new database, sometimes triggering DPIA. ### On-call and remote access Doctors working from home, after-hours response, access via VPN. Distributed security, breach potential. ### Mental health — special case Mental health record = most sensitive. Emergency disclosure rules, therapist-patient confidentiality, sharing restrictions. ### Minor consent Who signs consent — parent, child, both? What info can be shown to parent and what not? Complex ethical-legal issue. ## Frequent questions from healthcare entities ### Small clinic — must have DPO? Small clinic (single family doctor, 500 patients) — below threshold. But specialist clinic, multi-disciplinary clinic, or clinic with 2,000+ patients — required. "Significant scale" is not just quantitative — also qualitative. Single physician with psychiatric data on 100 patients may count as significant scale by sensitivity. ### We are not an HMO — does Amendment 13 apply the same way? HMOs are public bodies = automatic DPO obligation in all cases. Private clinic = private body, but processing sensitive data at scale triggers the obligation. Practical difference: HMO has no "not required" state. Small private clinic — needs assessment. ### Is there a special medical privacy law? The Patient Rights Law (1996) is the core of Israeli medical confidentiality. Doesn’t override Amendment 13 — but adds layers. DPO must know both laws, sometimes coordinating between an obligation under Patient Rights and a different one under Amendment 13. ### What about digital health record? EHR software must be approved by Ministry of Health, and meet high security level under 2017 regulations. DPO supports selection, vendor agreements, and Privacy Impact Assessment. ### What to do with old files? Patient Rights Law and regulations require minimum 20-year retention for adult records, 7 years past age 18 for minors, sometimes longer. Controlled destruction process at end of period — requires documented procedure. ### Do you have healthcare experience? Yes. We work with private clinics, clinic networks, labs, diagnostic centers, and mental health professionals. [GRC + Privacy package](/en/services/grc-privacy) includes ISO 27001/27799 (the health standard) support, sometimes required by large clinics and HMO tenders. ### How much does it cost for a clinic? Small-medium clinic (1-5 physicians) — 5,500-9,500 ILS/month. Clinic network (10-30 physicians) — 11,000-20,000 ILS/month. Large lab / network — 18,000+ ILS/month or GRC package. ## Clinic managers, lead physicians, lab managers — let's talk. 30 minutes, free, return with initial risk and requirements understanding. [Book a call](/en/contact)