# Data Protection Impact Assessment (DPIA) for Cloud-Based Health Organizations
## 3 Case Study: A Cloud-Based Hospital Information System
### Existing and Planned Controls (Procedual/Technical/Organizational)  
Having identified the Purposes of Processing and the data involved in each processing activity, it is necessary to decide if a DPIA is necessary on not. According to the GDPR _Article 35_[5]: \"... _Where a type of processing in particular using new technologies, and taking \begin{table}
\begin{tabular}{|c|c|} \hline \hline \multicolumn{2}{|c|}{**Personal Data**} \\ \hline Data Categories & Indicative Data \\ \hline Personal data & Business contacts’ personal data (name, surname, gender, postal address, telephone, e-mail, age group, education level) \\ Business contacts’ profiling data: \\ Personality-Attitude towards hospital, \\ Hierarchy level, Job title/ responsibilities, \\ Department/medical unit of work, Therapy \\ addressed/knowhow, Accessed route \\ addressed/practice, Infusion \\ method/practice/choice, Number of patients \\ treated/managed per year \\ \hline \end{tabular}
\end{table} 
Table 4: Data processed under business development. \begin{table}
\begin{tabular}{|c|c|} \hline \hline \multicolumn{2}{|c|}{**Personal Data**} \\ \hline Data Categories & Data \\ \hline Personal data & Patients’ personal data (First name, Last name, Date of birth—age, Gender, Phone number, Email address, Login email, Mobile phone) \\ Healthcare professionals’ personal data (First name, Last name, Specialty, Phone number, Email address, Login email, Mobile phone) \\ Patient portal users’ personal data (First name, Last name, Phone number, Email address, Login email, Mobile phone, Relation to patient) \\ Sales staff/Distributors’ sales staff (First name, Last name, Phone number, Email address, Login email, Mobile phone) \\ Activity Log of access/actions of users related & to a patient therapy \\ Users (i.e., Healthcare professionals, staff, personal data (First name, Last name, Phone number, Email address, Login email, Mobile phone) \\ Social Categories of Personal Data & phone) \\ \hline Data Categories & Data \\ \hline Special categories of personal data & Patients’ health data: Treatments (pain management, chemotherapies) \\ Treatment information: Start date, \\ Prescriptions, Administered medications, \\ Infusion data (e.g., volume delivered, pump alarms), Clinical observations (e.g., pain level) \\ \hline \end{tabular}
\end{table} 
Table 5: Data processed in patients care-services. into account the nature, scope, context and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons, the controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing operations on the protection of personal data..... A data protection impact assessment referred to in paragraph 1 shall in particular be required in the case of: (a) a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated processing, including profiling, and on which decisions are based that produce legal effects concerning the natural person or similarly significantly affect the natural person; (b) processing on a large scale of special categories of data referred to in Article 9(1), or of personal data relating to criminal convictions and offences referred to in Article 10; or (c) a systematic monitoring of a publicly accessible area on a large scale.\"_. Taking into account the criticality of the data processed by the hospital for the \"Provision of Patients Care-Services (PP4)\" purpose of processing, it is necessary to perform a privacy impact assessment study, as the hospital carries out the processing of special categories of personal data on a large-scale (guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is \"likely to result in a high risk\" for the purposes of Regulation 2016/679 (4 October 2017)), which could be characterized as a high risk processing. This is not the case for the remaining purposes of processing.