LGPD in Healthcare: The 5 Obligations Every Clinic Must Know

Electronic medical records hold health data — the most sensitive category the LGPD recognizes. Telemedicine widens the perimeter of data being processed. Health apps collect information in real time. And the ANPD has already signalled that healthcare is among its enforcement priorities.

If you run a clinic, a private practice, a laboratory or a hospital, these are the 5 obligations you need to know — and meet — right now.

1. Explicit consent for health data

Health data is classified as sensitive data under the LGPD, and the consent standard is far stricter. A generic notice on the registration form is not enough. The patient must consent freely, on an informed basis and unambiguously, for each purpose their data will serve: the electronic medical record, sharing with laboratories, use in research, marketing communications.

Consent must be documented and time-stamped, and the patient must be able to withdraw it at any moment — with no impact whatsoever on the care they receive.

2. Formal appointment of a DPO

Clinics processing health data at scale are required to have a formally appointed Data Protection Officer, registered with the ANPD. The DPO is the official channel between the clinic, its patients and the regulator.

For most clinics the most efficient route is an outsourced DPO (DPO as a Service) — no internal hiring cost, and dedicated legal expertise from day one.

3. Data mapping (ROPA)

Do you know exactly which patient data your clinic collects? Where it is stored? Who has access? How long it is kept? If the answer is "I am not sure", you have a problem.

Data mapping — the record of processing activities, or ROPA — is mandatory and must be kept up to date. It is the first document requested in any inspection.

4. Information security policy

Electronic medical records need access control. Telemedicine systems need encryption. Staff need training on what they can and cannot do with patient data.

The LGPD requires technical and administrative measures to protect data against unauthorized access, leaks and incidents. That includes strong passwords, backups, permission control and access logging.

5. Incident response plan

If a data breach happens — through an attack, human error or a system failure — you have a short window to notify the ANPD. Without a structured plan, meeting that window is impossible.

The incident response plan defines who triggers the protocol, what has to be communicated, how the breach is contained and how the event is documented. Having it ready is both a legal obligation and real protection for your clinic's reputation.

Summary: a quick checklist for your clinic

• Data consent form updated and signed
• DPO formally appointed (internal or outsourced)
• Data mapping (ROPA) complete and documented
• Information security policy in place
• Incident response plan structured

What happens if the clinic does not comply?

The ANPD can issue warnings, fines of up to 2% of revenue (capped at BRL 50 million per infraction), suspension of the database and publicization of the infraction — which hits your clinic's reputation with patients directly.

Compliance is not bureaucracy. It is protection for your business and for your patients.