The electronic patient record connects practices, pharmacies, hospitals and communities, and places high demands on data protection, consent and identity security. We make you ready today and factor in the planned EPR Act revision: nFADP/EPRA alignment, consent logic, DPIA and Trusted-Third-Party stewardship.
For EPR communities, practices, ambulatory groups, pharmacies, hospitals and cantonal e-health programmes
The electronic patient record pools especially sensitive health data across organisational boundaries, and sets clear expectations for consent, identity and confidentiality.
The EPR rests on patients' voluntary, informed consent and on a differentiated access concept with confidentiality levels. Anyone who uploads or retrieves documents must be securely identified, able to demonstrate the legal basis for access and to document the processing.
For connected providers this means: nFADP-compliant processing of health data, clean data-processing agreements with IT and platform partners, a maintained record of processing activities, and technical and organisational measures that match the protection requirement.
We therefore treat the EPR not as a pure IT project but as a governance task: who may do what, on which legal basis, with which consent, and how you demonstrate it to patients, the community and supervisory bodies.
A comprehensive revision of the EPR Act is planned, or in preparation. It aims at broader and more binding connection. Details and timing are still politically in motion.
Today many small and mid-sized practices and ambulatory providers are not yet connected to the EPR. The planned revision points towards broader, partly more binding participation and a modernisation of the technical and organisational foundations, which increases the preparation effort for organisations not yet connected.
We deliberately name no fixed entry-into-force date and no guaranteed deadline: legislative processes shift and detailed rules are still open. What we provide is dated, case-specific orientation, and a readiness foundation that holds regardless of the exact timing.
The advantage of acting early: those who have already cleanly set up data flows, consent logic, identity connection and contracts can meet a future connection duty calmly and without rush, instead of retrofitting under time pressure.
We combine current obligations with forward-looking design, legally led, technically robust and tailored to your size.
We assess your processing of health data against the nFADP and the EPR framework: legal bases, confidentiality levels, retention, data-subject rights and the duties of a connected provider or community.
We design and document an audit-ready consent and access logic: voluntary, informed consent, confidentiality levels, withdrawal and logging, so you can evidence it to patients and supervisory bodies.
For EPR connection and new data flows we support your data-protection impact assessment: risk assessment, measures and documentation, as audit-ready evidence rather than a formality.
As an independent Trusted Third Party we can act as steward for health data and cryptographic keys, for example to separate roles, escrow keys or serve as a neutral party between partners in a community.
We draft and review data-processing agreements with platform, hosting and IT partners, clarify responsibilities within the community and ensure a clean contract chain around the EPR connection.
In a data-protection and IT-security workshop we enable your team in handling the EPR: obtaining consent correctly, justifying access cleanly, recognising and reporting incidents, practical and tailored to your roles.
EPR Readiness, compact for small practices
Fixed fee
Template-based and affordable for solo practices and small ambulatory providers preparing for connection.
EPR Readiness, standard
Fixed fee
In-depth readiness for practice groups, pharmacies and ambulatory providers with more complex data flows.
EPR Readiness, community & hospital
on request
For (root) communities, cantonal e-health programmes and hospitals with many connected providers.
The EPR touches several compliance topics. We think them together:
External data-protection advisor for ongoing support of health-data processing.
Certification-ready ISMS that carries EPR data flows and security requirements.
Swiss hosting, access risk and cloud governance for health data.
All SIDD services for hospitals, practices, communities and MedTech.
Our tool: LexCommand
LexCommand is our in-house, citation-backed legal AI for the law of Switzerland, Germany, Austria and the EU. Developed and run sovereignly in Switzerland by Priverion GmbH, the company behind SIDD. We do not just preach data sovereignty and provability, we built them into our own tool, alongside the Priverion Platform.
The AI runs self-hosted on Swiss infrastructure, with no external cloud LLMs. As an independent Swiss company with no foreign parent, we process your documents in an environment we control.
Every legal statement traces back to a retrievable primary source, or it does not appear at all. That makes our recommendations auditable and verifiable, instead of merely sounding plausible.
LexCommand takes over searching, cross-checking and sourcing. That shortens turnaround times and frees our senior advisors for judgement and client dialogue, with no loss of diligence.
We look at data protection, information security and AI security on a shared source base with a framework crosswalk. So you see overlapping obligations in one consolidated picture, instead of three isolated analyses.
For your EPR readiness, concretely: LexCommand backs every statement in the nFADP/EPRA alignment and the DPIA with the primary source at its exact location, surfaces overlapping duties from the nFADP and the EPR framework side by side, and provides dated orientation on the version in force despite the still-moving EPR Act revision.
Temporally deterministic (as of today or any reference date), with jurisdiction isolation (CH/DE/AT/EU) and a citation verifier at the end of every answer.
Yes. Many practices are not yet connected. The planned EPR Act revision points to broader participation. With our template-based compact assessment you lay a clean foundation today, without much effort, and are prepared should connection become more binding.
We deliberately name no guaranteed date. The total revision is planned, or in preparation, but content and timing are still politically in motion. We give you dated, case-specific orientation and build readiness that holds regardless of the exact timing.
As an independent Trusted Third Party we can act as a neutral steward for health data and cryptographic keys, for example to separate roles, escrow keys or mediate as a neutral party between partners in a community. We define the exact scope per mandate.
Processing health data is especially high-risk. New data flows from an EPR connection may trigger a data-protection impact assessment. Whether and to what extent we assess case by case, and support you in producing it as audit-ready evidence.
Yes. We advise throughout in German, French and English, including cantonal specifics of the e-health programmes.
We start with a fixed-fee EPR Readiness Assessment: nFADP/EPRA alignment, consent logic and prioritised measures, documented board-ready.