Healthcare administration

Because the data is health data, which the General Data Protection Regulation treats as a special category, with processing prohibited save under strict conditions. Transferring it to a country without an adequacy decision requires an impact assessment that, done honestly, does not reach a favourable conclusion.

We could write that assessment and propose a cheaper model. We do not, because it would be an assessment we would not want to defend to the supervisory authority, and because the client is the controller and is who answers if it is challenged.

This makes the service more expensive than an equivalent offshore model in another sector, and we say so upfront. The honest comparison is not with an operation in the Philippines but with the internal cost of doing the same work in Portugal, and it is in that comparison that the service justifies itself.

Least-privilege access with full logging of who accessed which record and when, because with health data access traceability is as important as the access itself. Without logs, it is impossible to answer a data subject request or demonstrate compliance in an inspection.

Encryption in transit and at rest, with key management inside the European Economic Area, and separation between production and training environments. Training people on real patient data is a practice that persists and has no defence.

And team training specific to health data, with a contractual and disciplinary duty of confidentiality. The measure that most reduces risk in this service is not technical but the clarity that any access not justified by a concrete task is a serious breach and is detectable.

Through controlled access to your system's administrative module, with a profile limited to what the role requires. The team does not need access to clinical information to book appointments, and granting broader access than necessary is the most common configuration error in this service.

Profile configuration is design-phase work rather than transition work, because it involves your data protection officer and frequently the clinical system vendor. Leaving it to launch week is how you end up with generic profiles nobody revisits afterwards.

Where the system lacks adequate administrative separation, we say so and propose alternatives, including not proceeding. A service that only works by granting clinical access to administrative staff is not a service we should be selling.

With training specific to health data before first access rather than afterwards, and with a signed contractual and disciplinary duty of confidentiality. The measure that most reduces risk here is not technical: it is the clarity that any access not justified by a concrete task is a serious breach and is detectable in the log.

With training on the sector's administrative vocabulary, which is dense and specific. Someone who cannot distinguish the terms used by health subsystems and insurers makes routing errors that look trivial and have direct financial consequences for the provider.

And with a rule we repeat in every training session: when in doubt about whether something is clinical information, it is. The team escalates rather than deciding, and the cost of escalating too often is substantially lower than deciding wrongly once.