Data protection for medical practices and therapists: what the Swiss FADP requires
By Advisorn · updated on 26 October 2026
In brief
A medical or therapy practice processes almost nothing but health data, which the FADP treats as sensitive personal data (Art. 5 let. c FADP). On top of the duties of every business, stronger security measures, professional secrecy (Art. 321 Swiss Criminal Code) and stricter rules for disclosing data to third parties therefore apply. Patients have a right of access to their medical records.
The typical data
- medical history, diagnoses, reports, images and treatment notes;
- patients' identity and contact details and AHV number;
- health insurance details and invoices listing the services;
- correspondence with other doctors, laboratories and hospitals;
- data of the practice's staff.
Sensitive personal data
All health data is sensitive personal data: disclosing it to third parties without justification breaches privacy (Art. 30 para. 2 let. c FADP), the security measures must match this risk (Art. 8 FADP), and an organization that processes it on a large scale loses the exemption from the record of processing activities (Art. 24 Data Protection Ordinance) and must as a rule carry out a data protection impact assessment (Art. 22 FADP).
Professional secrecy
Doctors, dentists, pharmacists, psychologists, nurses, physiotherapists, occupational therapists, midwives and other health professions are bound by professional secrecy (Art. 321 Swiss Criminal Code). It also applies towards their own providers: whoever runs the software or the archive must be bound to secrecy by contract and have access to the data only as far as necessary.
Software, cloud and communication
- the provider of the practice software is a processor: a contract under Art. 9 FADP is needed;
- check where the data is stored and who accesses it for support;
- for e-mails with patients and colleagues use encrypted channels, not ordinary e-mail for reports and diagnoses;
- messages through private chat apps are not suitable for patient data.
How long to keep the medical record
Cantonal health laws set how long a patient's record must be kept, and the period varies from canton to canton. Claims for bodily injury, however, become time-barred after twenty years (Art. 60 para. 1bis CO), and many practices keep the record for that long. After that period the data must be destroyed or anonymised (Art. 6 para. 4 FADP).
Related questions
- What is sensitive personal data?
- What data security measures does the new FADP require?
- Can Microsoft 365 or Google Workspace be used under the new FADP?
- How to answer a request for access to personal data, and within what time?
- Data security breach: when and how to notify the FDPIC?
- How long may personal data be kept?
Useful templates
- Privacy notice template for customers and contractual partners
- Technical and organisational security measures (TOMs) template
- Data processing agreement template (Art. 9 FADP, Art. 28 GDPR)
- Employee confidentiality undertaking and instructions template
- Data security breach procedure template (data breach)
- Data protection impact assessment (DPIA) template
The other sectors
General information, not advice on your case: for your case the text of the law is what counts, and for a sector with rules of its own, those rules too.