How to report a personal data breach

Before you click anything else:

• take a screenshot of whatever alarmed you,
• note the date, the time, the device, and exactly what you did before the event,
• do not click suspicious links, do not reply to suspicious messages, do not give data out over the phone.

What to do depends on what happened:

• Suspected access to your account — change the password and sign out on every device you use. Settings → Account → Sign out ends the current session; for a lost device, report it to Heltio support so that access can be revoked at the authentication provider.
• Records sent to the wrong person — write to the recipient asking them not to open the message, to delete it, and to confirm that they have.
• A lost laptop or phone with Heltio signed in — change the password immediately from another device and turn on the PIN lock on the others.

If you are neither the clinic administrator nor the data protection officer, your job is to pass the matter on, not to report it yourself. A report has legal consequences for the clinic as controller.

Write to iod@heltio.pl — the address of Heltio's data protection officer, published in the privacy policy and in the site footer. In the message give:

• the date and time you noticed the event,
• what it consists of,
• how many patients it may concern,
• which data it concerns (contact, medical, billing),
• what you have already done,
• who in the clinic knows about it.

Do not paste PESEL numbers, the text of notes, or any other patient data into the message. A description and identifiers we can find the records by are enough.

The breach register is kept by the clinic as controller — the GDPR requires it whether or not the event has to be reported to the supervisory authority. Heltio does not keep it for you and does not supply a template; use the one in your clinic's GDPR documentation.

In the settings you will find what Heltio does provide: Settings → GDPR & Privacy with the Records of Processing Activities to download, the Deletion Requests list, the Data subject requests and the GDPR contact email field the patients can see.

The notification to the supervisory authority is filed by the clinic, through the form on the authority's website, within the deadline counted from becoming aware of the breach. Separately, you judge whether the breach poses a high risk to the patients — if it does, they have to be told as well.

With medical data the answer to that question is almost always yes. If you are in doubt, take it to the data protection officer before the deadline runs out, not after.