Hospitals and healthcare
Data protection for hospitals – patient data under control
Hospitals, clinics and care homes process health data on a large scale – in the clinical information system, specialist systems, file storage and mailboxes. Espresso shows where this data is stored, answers access requests from patients and deletes once the retention periods have expired. Everything runs in your own data centre.
What makes it challenging for healthcare
Almost everything is sensitive
Health data is subject to stricter requirements – and to professional secrecy.
Many systems
Clinical information system, laboratory, radiology, billing and HR – plus file storage and mailboxes.
Cantonal requirements
Retention of patient records and data protection at public hospitals are regulated at cantonal level.
Access requests from patients
Patients ask to see their data – in full and on time.
How hospitals use Espresso
- Data Discovery Patient data outside the clinical information system Find findings, lists and exports in file storage, databases and Microsoft 365 – including in scanned documents. Go to the module
- Subject Request Access requests from patients Verify identity, query systems, prepare the response from your template – always keeping an eye on the deadline. Go to the module
- Privacy Register Register and retention periods Systems, locations of patient data and retention periods under cantonal law in one place. Go to the module
- Data Deletion Deletion once periods expire Connected systems delete data that is due in the right order – with confirmation and a log. Go to the module
- Privacy Delivery Summarising medical reports with AI Under professional secrecy, only in pseudonymised form: the AI sees no patient data, and the response gets the original values back. Go to the module
- Privacy Delivery Test data for clinical systems Realistic test data without real patients for updates and migrations. Go to the module
The framework for healthcare
Which data protection law applies depends on who runs the institution. Health data enjoys special protection everywhere.
| Rule | What it means |
|---|---|
| FADP | For hospitals and institutions organised under private law. Anyone who processes health data on a large scale keeps a record – regardless of size (Art. 24 DPO). |
| Cantonal data protection law | For public-law hospitals and institutions of the cantons and municipalities. |
| Cantonal health laws | Obligations to keep and retain patient records. |
| Professional secrecy | Duty of confidentiality of doctors and other healthcare professionals (Art. 321 SCC). |
Overview without any claim to completeness; does not replace legal advice in individual cases. As of: 6 October 2026.
Getting started
See where patient data is stored
The assessment scans selected sources in your environment and shows within six weeks where patient data is stored outside the core systems.
Frequently asked questions
Does Espresso run in our own data centre?
Yes. Espresso runs in your own data centre – or, if you prefer, with an operating partner of your choice. No patient data goes to the vendor.
Which data protection law applies to our hospital?
Public-law hospitals are generally subject to cantonal data protection law, those organised under private law to the FADP. The processes – register, access requests, erasure – are the same in both cases.
Can our clinical information system be connected?
For access requests, Espresso automatically searches applications with a supported database or REST interface; for the others, the system owners check. Deletion takes place in the system itself, orchestrated via an open interface.
Does Espresso recognise health data?
Data Discovery detects indications of sensitive categories such as health, as well as insurance and AHV numbers. Custom search patterns add patient and case numbers.
Related topics
- Requests Data subject access requests Deadline, identity verification and content: answering data subject access requests in full under the FADP and the GDPR. Read more
- Find Finding personal data Where personal data is stored in file storage, databases and Microsoft 365 – and how to find it reliably. Read more
- Fundamentals Running data protection software yourself Why data protection software often needs to run in your own data centre or your own cloud. Read more
See Espresso in 30 minutes
We will show you the cockpit with sample data – and discuss where you should start.
Request a demoor write directly to info@espressodataprivacy.com