# Health Data PIA Template

## 1. Organisation Information

| Field | Value |
|-------|-------|
| Organisation name | |
| Healthcare sector | Hospital / Clinic / Research / Pharma / Digital Health / Wearables |
| DPO name | |
| Caldicott Guardian (UK) | |
| HIPAA applicable | Yes / No |

## 2. Processing Activity Description

| Activity ID | Description | Data Categories | Sensitivity Tier | Subject Count |
|---|---|---|---|---|
| | | | Tier 1 / Tier 2 / Tier 3 | |
| | | | | |

## 3. Lawful Basis and Art. 9 Exception

| Activity | Art. 6 Lawful Basis | Art. 9(2) Exception | Evidence |
|----------|-------------------|--------------------|---------|
| | | | |
| | | | |

## 4. HIPAA PHI Assessment (if applicable)

- [ ] Covered entity or business associate
- [ ] BAA in place with all processors
- [ ] Minimum necessary standard applied
- [ ] De-identification method: Safe Harbor / Expert Determination / N/A
- [ ] 18 HIPAA identifiers removed (if Safe Harbor)

## 5. Necessity and Proportionality

| Question | Assessment |
|----------|-----------|
| Can the purpose be achieved with less data? | |
| Can anonymised/pseudonymised data serve the purpose? | |
| Is the data retention period justified by clinical/legal/research need? | |
| Have data subjects been consulted on acceptability? | |

## 6. Access Control Assessment

| Control | Implemented | Evidence |
|---------|------------|---------|
| Role-based access control (RBAC) | Yes / No | |
| Principle of least privilege | Yes / No | |
| Two-factor authentication | Yes / No | |
| Audit logging (who, what, when) | Yes / No | |
| Break-glass procedure | Yes / No | |
| Log monitoring | Daily / Weekly / Monthly / None | |
| Anomaly detection | Yes / No | |

## 7. Risk Assessment

| Risk | Likelihood | Severity | Risk Level | Mitigation |
|------|-----------|----------|------------|-----------|
| Unauthorised access to patient records | | | | |
| Re-identification of de-identified data | | | | |
| Cross-border transfer exposure | | | | |
| Insider threat (non-treating staff access) | | | | |
| Ransomware targeting health sector | | | | |

## 8. Mitigation Measures

| Measure | Status | Owner | Target Date |
|---------|--------|-------|-------------|
| Encryption at rest | | | |
| Encryption in transit | | | |
| Pseudonymisation | | | |
| Access control tightening | | | |
| Staff training | | | |

## 9. Residual Risk Assessment

| Processing Activity | Residual Risk | Acceptable | Prior Consultation Required |
|---|---|---|---|
| | Low / Medium / High / Critical | Yes / No | Yes / No |
| | | | |

## 10. Documentation and Sign-Off

- [ ] DPIA documented per Art. 35(7)
- [ ] DPO advice obtained and documented
- [ ] Caldicott Guardian sign-off (UK NHS)
- [ ] CMIO sign-off
- [ ] Review schedule defined: _______________

| Role | Name | Date | Signature |
|------|------|------|-----------|
| DPO | | | |
| Caldicott Guardian | | | |
| CISO | | | |
| Clinical Lead | | | |