Garante per la protezione dei dati personali (Italy) - 616/2026
Italian DPA fines University Health Agency for improper access to patient records.
Italy's Garante per la protezione dei dati personali (DPA) investigated a complaint regarding unauthorized access to a patient's electronic health records. The University Health Agency of Friuli Centrale was found to have inadequate data protection measures, including insufficient access controls and logging, and an inappropriate automatic computer lockout period. The DPA emphasized data minimization and limiting access to patient data strictly to those involved in direct care.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Garante per la protezione dei dati personali?
Get an email when a new story names Garante per la protezione dei dati personali, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe University Health Agency of Friuli Centrale failed to adequately restrict access to electronic health records, allowing unauthorized individuals to view sensitive patient data. Insufficient logging meant the organization lacked the visibility needed to detect, investigate, and respond to unauthorized access events in a timely manner. An improperly configured automatic screen lockout period further compounded the risk by leaving workstations exposed in clinical environments. This case illustrates that healthcare organizations must treat access control and audit logging as foundational safeguards — not optional additions — especially given the sensitivity of health data under GDPR and sector-specific regulations. Without enforcing the principle of least privilege and maintaining robust audit trails, organizations cannot demonstrate accountability or effectively contain breaches.
What helps against this
How we list vendors- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- Log management and security data pipelines
Security logs are so expensive to collect and keep that teams drop the ones they need when an incident happens.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.