Health data. Essential trust.

Your activity,
its real flows.

The sensitivity of data requires linking professional confidentiality, authorizations, traceability, availability, backup, sharing and patient information. Technical service providers, laboratories, insurers, platforms and remote supports must be included in this analysis, particularly when data or access crosses a border.

RGPD Conseil Maroc works on data protection governance, formalities, contracts, procedures and evidence. The mission does not constitute a medical audit, nor a safety certification, nor an exhaustive analysis of all the health regulations applicable to the establishment.

Scoping starts with the facts: systems, teams, people involved, data, customers, suppliers and countries. The obligations are then qualified separately with regard to the GDPR and Moroccan law 09-08. This method avoids applying a generic response to processing activities that have neither the same purpose nor the same level of risk.

Triggers
most common.

A mission may begin before a launch, during a negotiation or after a gap appears.

New system

Patient file, laboratory, imaging, appointments, teleconsultation or accommodation.

External sharing

Laboratory, specialist, insurer, partner, support or recipient platform.

Incident or control

Undue access, sending error, loss, ransomware or need to demonstrate measures.

A journey
in four stages.

Decisions and limits are made visible at each stage.

Map

Admission, care, examinations, sharing, billing, archiving and possible research.

To prioritize

Sensitive data, access, volumes, vulnerable audiences, availability and transfers.

Secure

Roles, contracts, procedures, authorizations, traceability and continuity.

Control

Access reviews, incidents, new services, suppliers and documentation.

What the documents
Don't always show.

These situations are points of analysis, not automatic conclusions.

Internal curiosity

Technically possible access does not mean that it is necessary for support.

Misdirected sharing

Email, messaging or printing can expose a file to the wrong recipient.

Technical service provider

Maintenance, hosting or support may provide access to sensitive data.

Availability

Protection includes the ability to restore and continue activity, not just privacy.

Rights and third parties

A file may contain information about relatives or professionals to be protected.

Critical incident

Qualification must be rapid, documented and coordinated with the medical and technical teams.

Measures that
teams can apply.

Each check must have a responsible person, frequency and proportionate proof.

Authorizations by function

Limit access based on role, department, support and administrative needs.

Traceability

Protected logs, targeted reviews and procedure for handling abnormal access.

Secure sharing

Channels, recipients, verification, appropriate encryption and printing rules.

Supervised suppliers

Contracts, confidentiality, support, processors, country and end of service.

Documented continuity

Backup, restoration, responsibilities and coordination with technical specialists.

Response to incidents

Sorting, limitation, retention of facts, risk analysis and notification decisions.

What RGPD Conseil Maroc
Leave it to your teams.

The final scope depends on maturity, risks and elements already available.

Health mapping

Patient journey, systems, exchanges, actors, data and countries.

Priority register

Sensitive treatment, purposes, bases, durations and measures.

Access Matrix

Clinical, administrative, technical and external profiles.

Incident procedure

Qualification, roles, escalation, evidence and communications.

Service provider review

Hosting, maintenance, laboratory, insurance and platforms.

Control plan

Access, sharing, accounts, backup, deletion and periodic testing.

GDPR and law 09-08,
I didn't confuse them.

The same activity may fall within both frameworks for different reasons.

EU

GDPR

Roles, responsibilities, information, rights, security, subcontracting and transfers outside EEA.

MA

Law 09-08

Treatment in Morocco, rights, security and formalities of declaration or authorization.

↔

International flows

Access, hosting, recipients, mechanism, context and additional measures.

✓

Evidence

Contracts, registers, decisions, controls, training, incidents and actions followed.

Start small.
Maintain if necessary.

The amounts are confirmed after scoping; no fictitious pricing is published.

DIAGNOSIS

Starting point

Targeted interviews, review of available elements, major risks and sectoral roadmap.

Fixed price · after scoping TARGETED MISSION

Priority base

Agreed deliverables, corrections, review meeting and operational transfer to internal managers.

From — on estimate ACCOMPANYING

Continuous management

Volume, deadlines, meetings, controls, new projects and contract overruns.

Subscription · on quote

Advise, structure
and advance.

RGPD Conseil Maroc provides GDPR advice, law 09-08 and operational assistance. The client organization retains its decisions, responsibilities, budgets, validations and technical actions. No mission guarantees absolute compliance, absence of sanction or a favorable decision from an authority.

• Penetration tests, forensic investigations and certifications are carried out by competent experts.
• Reserved legal consultations and litigation are directed to a lawyer.
• Sectoral regulations excluding data protection remain outside the scope unless expressly stated.

Incidents and rights →CNDP formalitiesGDPR responsibilities

Specific responses.
Contextualized decisions.

These answers present general principles. Processing, roles, countries and contracts should be reviewed before any conclusion.

Does health data still require CNDP authorization? −

Health data belongs to sensitive categories and requires careful qualification of the applicable regime. The answer depends on the processing, its basis, who is responsible and any specific provisions. RGPD Conseil Maroc prepares the analysis and the appropriate file without promising the CNDP’s decision.

Can all medical personnel check all files? +

Access must match the role and need for support or administration. Rights that are too broad increase the risk of unjustified consultation. An authorization matrix defines the profiles, while traceability and reviews make it possible to verify their use.

Does RGPD Conseil Maroc certify the security of medical software? +

No. RGPD Conseil Maroc examines privacy governance, available evidence, contracts, access and procedures. A certification, intrusion test, architectural review or in-depth technical analysis must be carried out by competent specialists.

How to respond to a request for access to the file? +

Proportionately verify identity, locate information, consider third party rights, prepare secure delivery and retain proof of response. The rules specific to medical access or care records must also be confirmed with competent legal and medical professionals.

What to do after a sending error containing medical data? +

The organization must act immediately: limit access if possible, identify recipients and data, preserve the facts, assess the consequences and determine communication or notification obligations. RGPD Conseil Maroc coordinates the privacy analysis; technical investigations or medical decisions remain with the competent teams.

Does the offer cover all health regulations? +

No. It covers the protection of personal data and the coordination of GDPR/law 09-08 obligations within the agreed scope. The rules of medical practice, health records, insurance or sectoral authorization must be checked separately.

Your sector deserves A concrete scoping.

Present your tools, data, customers, suppliers, countries and deadlines. RGPD Conseil Maroc will indicate the first useful perimeter.

Keep reading

• Serve your mission. Protect your people.
• Convert customers. Keep their trust.
• Welcome guests. Control their data.
• Protect the people behind every HR record.