# Data Protection & Information Security in Healthcare, legally led > Legally led compliance & security for hospitals, practices, EPR communities and MedTech: FADP, EPRA, EU AI Act, NIS2/critical-infrastructure reporting, ISO 27001/42001, from one partner. - Source: https://www.sidd.swiss/en/services/healthcare - Language: en - Last updated: 2026-10-20 - Publisher: SIDD Institute for Data Protection and Data Security, a brand of Priverion GmbH, Zugerstrasse 32, 6340 Baar (ZG), Switzerland Healthcare sector · legally led compliance & security In healthcare, security is first a legal and governance question. We lead it juristically, not just technically: FADP, EPR law, EU AI Act, NIS2/critical-infrastructure reporting, ISO 27001/42001, one partner for hospitals, clinics, practices, EPR communities and MedTech. legally led (Dr. iur., CIPP/E) DE · FR · EN independent, no in-house SOC business **Responsible for this mandate** **Dr. Dominic Staiger** LL.M., Dr. iur., CIPP/E · Attorney at Law (New York) · Solicitor (UK) [LinkedIn](https://www.linkedin.com/in/dominicstaiger/) ## Why healthcare organisations must act now Health data is especially sensitive. Healthcare organisations face a dense wave of regulatory obligations across 2026–2028. Cyberattacks on healthcare providers have risen worldwide and in Switzerland, hitting operations, patient safety and reputation. At the same time, legal requirements for data protection, reporting duties and AI are tightening. We bundle these topics into one legally led mandate, instead of isolated, one-off technical measures. ## Regulatory deadlines 2026–2028 at a glance Orientation, not legal advice. We verify dates and scope case by case. Some timelines are still politically in motion. | Regulation | What it requires | Timing | Status | | --- | --- | --- | --- | | **FADP** | DPIA for health data, breach notification to the FDPIC, technical and organisational measures | since 1 Sep 2023 | in force | | **Critical-infrastructure reporting (ISG/BACS)** | Reporting relevant cyber incidents to the BACS within a short deadline | since 2025 | in force (verify detailed deadlines) | | **EU AI Act (medical AI)** | High-risk obligations for diagnosis, triage and decision-support AI | deadlines 2026/2027, under revision | verify dates (Digital Omnibus) | | **EU NIS2** | Risk management and reporting duties for healthcare entities with an EU footprint | depending on national transposition | only with an EU establishment | | **EPR Act revision** | Modernisation of the electronic patient record, broader connection | in preparation | planned | | **EU Cyber Resilience Act** | Security and vulnerability duties for connected products | staggered 2026–2027 | verify dates | ## Our healthcare focus areas Dive into the topic relevant to you: ### EU AI Act for medical AI High-risk compliance for diagnosis, triage and decision support. ### NIS2 & critical-infrastructure for hospitals Reporting duties, board responsibility and readiness. ### ISO 27001 / ISMS Certification-ready ISMS tailored to healthcare data flows. ### EPR & EPR Act revision Data-protection and security readiness for connection and the future. ### Ransomware readiness Tabletop exercises, playbooks and governance, before the incident. ### Data residency & cloud Microsoft 365, US access risk and Swiss hosting in hospitals. ## Why SIDD in healthcare In healthcare, law and governance drive the risk. That is exactly where our focus lies. ### Legally led Your mandate is led by doctorate-level lawyers with CIPP/E, backed by an in-house technical team. So we assess processing, data-processing agreements and DPIAs on solid legal and technical ground. ### Swiss professional secrecy Where a SIDD lawyer advises in a legal capacity, your information may be covered by professional secrecy under Art. 321 of the Swiss Criminal Code, in addition to contractual confidentiality. We clarify the exact scope per mandate. ### AI governance depth With three dedicated AI services (AI Officer, AI Governance Check, AI Security) we cover the EU AI Act for medical AI, a field that purely technical security providers barely serve. ### Multilingual & independent We advise in German, French and English, relevant for French-speaking Switzerland and EU parent companies. Because we do not sell an in-house SOC, our recommendations stay independent. ### Audit-ready evidence We maintain records of processing, DPIAs and measures in our Swiss Priverion Platform. In case of a regulator request, the evidence is available as maintained tooling. ### Fixed-fee entry You start with a fixed-fee Healthcare Compliance baseline assessment with a board-ready report and then decide on an ongoing mandate. ## Sector experience For a Swiss healthcare platform (Openmedical AG) we aligned data protection with the FADP: a platform data-flow analysis, new data-processing agreements with the extensive customer base, plus penetration tests and vulnerability scans to assess technical risk. - Complete data-flow analysis of the healthcare platform - Data-processing agreements with thousands of customers - Penetration tests and vulnerability scans of the platform Our tool: LexCommand ## Why we work with LexCommand, our own Swiss legal AI LexCommand is our in-house, citation-backed legal AI for the law of Switzerland, Germany, Austria and the EU. Developed and run sovereignly in Switzerland by Priverion GmbH, the company behind SIDD. We do not just preach data sovereignty and provability, we built them into our own tool, alongside the [Priverion Platform](https://www.sidd.swiss/en/priverion-platform). ### Sovereign in Switzerland The AI runs self-hosted on Swiss infrastructure, with no external cloud LLMs. As an independent Swiss company with no foreign parent, we process your documents in an environment we control. ### No citation, no claim Every legal statement traces back to a retrievable primary source, or it does not appear at all. That makes our recommendations auditable and verifiable, instead of merely sounding plausible. ### From effort to judgement LexCommand takes over searching, cross-checking and sourcing. That shortens turnaround times and frees our senior advisors for judgement and client dialogue, with no loss of diligence. ### Three disciplines, one picture We look at data protection, information security and AI security on a shared source base with a framework crosswalk. So you see overlapping obligations in one consolidated picture, instead of three isolated analyses. For the Healthcare Compliance baseline assessment, concretely: LexCommand maps your overlapping duties from the FADP, EPR law, EU AI Act, NIS2/critical-infrastructure reporting and ISO 27001/42001 into one crosswalk, in the version valid at each deadline, so every statement in the board-ready report traces to a retrievable primary source. Temporally deterministic (as of today or any reference date), with jurisdiction isolation (CH/DE/AT/EU) and a citation verifier at the end of every answer. ## Frequently asked questions ### Are you a managed-SOC provider? No. We are a legally led governance, compliance, assessment and readiness partner. We coordinate 24/7 monitoring with specialised providers, which keeps our advice independent. ### How does a mandate start? With a fixed-fee Healthcare Compliance baseline assessment: a multi-regulatory gap analysis with prioritised measures and a board-ready report. ### Do you work in French for French-speaking Switzerland? Yes. We advise throughout in German, French and English, including cantonal specifics and EU parent companies. On this page - Why now - Deadlines 2026–2028 - Topics & pages - Why SIDD - Reference - LexCommand - FAQ --- This document is the Markdown rendition of the page linked above. Please cite the HTML URL.