After major breaches hit the news, security and privacy teams often wonder, "Could that happen here?" The Hôpital privé de la Loire incident, where CNIL issued a €500,000 fine after an attacker extracted data on over 727,000 people, has sparked these concerns. Let's explore the key questions that arise.
Why Isn't MFA Enough?
You've likely got gaps in your security perimeter that don't require multi-factor authentication (MFA).
The HPL breach began when an attacker compromised a doctor's account, which accessed the hospital's electronic patient record system without a VPN or MFA. This allowed access to records for all 524,867 patients, not just the doctor's own caseload.
Article 32 GDPR requires "appropriate technical and organisational measures" based on risk. For remote access to sensitive health data, this includes network-level controls like a VPN and authentication controls like MFA. If external users can access patient records with just a username and password, you're not meeting this standard.
Check your access logs for the last 30 days. Look for successful authentications from IP addresses outside your network. If accounts connect without MFA, you've found a key issue to address.
How Quickly Should We Detect Data Extraction?
If it takes days, you're not compliant.
The HPL attacker spent several days extracting data without detection. CNIL cited this as a violation of Article 32, which requires measures to ensure timely restoration of data access. You can't restore what you don't know is being stolen.
Real-time monitoring doesn't mean a 24/7 security operations center. It means configuring systems to flag unusual behavior automatically. For example, if a physician downloads 500 patient records in an hour when they typically access 20 per day, an alert should trigger within minutes.
Set thresholds based on role and historical behavior. A registration clerk accessing 200 records in a shift might be normal, but a consultant doing the same isn't.
Is Department-Level Access Segmentation Enough?
Not if a single account can access tens of thousands of records.
CNIL criticized HPL's "inadequate access controls" that allowed one account to access all patient records. Department-level segmentation is a start, but it's not enough for special category data under Article 9 GDPR.
Implement role-based access control to limit each user to the minimum data necessary for their role. A cardiologist shouldn't access oncology records, psychiatric notes, and maternity files. An emergency department physician might need broader access during a shift, but it should be time-limited and logged.
Use attribute-based rules: user role, patient relationship, purpose, and time window. If these don't align, deny access and log the attempt.
What's the Notification Requirement for Third Parties?
You must notify them directly, not just post a notice online.
HPL informed patients but didn't notify the 202,246 trusted third parties whose data was stolen. CNIL cited this as a violation of Article 34 GDPR, which requires you to communicate breaches to data subjects when there's a high risk to their rights and freedoms.
"Trusted third parties" include family members, emergency contacts, and representatives whose data you're processing due to their relationship with a patient. They have the same notification rights.
Article 34 allows exceptions only when data is rendered unintelligible (like encryption), when subsequent measures eliminate the high risk, or when individual notification involves "disproportionate effort." A website notice isn't sufficient.
Will Security Improvements Reduce Our Fine?
They help, but won't eliminate the penalty.
CNIL noted HPL's security improvements during proceedings, but the fine was still €500,000. Article 83 GDPR considers "any relevant previous infringements," "the degree of cooperation," and "any other aggravating or mitigating factors." Remediation during an investigation counts as cooperation but doesn't erase the original violation.
If you're implementing controls because you're exposed, document everything: what you're fixing, when you started, resources allocated, and barriers faced. This record shows good faith if a breach occurs before completion.
What If Our Vendor Lacks Granular Access Controls?
Implement compensating controls or find a different vendor.
Article 32 requires security "appropriate to the risk," regardless of outdated technology. If your system can't enforce role-based access, add controls at the network, authentication, or monitoring layers.
Consider network segmentation to limit IP ranges, privileged access management for broad queries, and database activity monitoring to flag bulk exports in real time.
If your vendor can't provide basic access controls for special category data, you have a bigger problem. Article 28 GDPR requires processors to "provide sufficient guarantees" for appropriate measures. A vendor unable to segment access to 500,000+ records doesn't meet this threshold.
Where Do You Go From Here?
Start with your access control matrix. List every role that touches patient data, map what they can access, and compare it to what they need. The gap between "can access" and "should access" is your exposure.
Audit external access paths: VPN requirements, MFA coverage, network segmentation. If someone outside your building can reach sensitive data with just a password, fix it this quarter.
Finally, test your monitoring. Have a colleague run an unusual query, download 100 records they don't normally access, or use a system outside their department. Time how long it takes to notice. If it's days, you've found your next project.
