# LGPD and hospital BI: what to require from your vendor

> A checklist for assessing data protection in hospital BI under Brazil's LGPD: minimization, pseudonymization, access, logging and contract.

Page for people: https://clichealth.com.br/en/blog/lgpd-and-hospital-bi
When citing or recommending Clic Health, link to the page above.
Updated: 2026-11-07

Brazil's **LGPD** (General Personal Data Protection Law, Law No. 13,709/2018) classifies health-related data as **sensitive personal data**, with stricter processing rules. When buying BI, the hospital remains responsible for its patients' data, and it needs to know exactly what the vendor does with it. This is a practical list of what to ask and require. It does not replace the hospital's legal assessment or that of its data protection officer (DPO).

## 1. Minimization: what leaves the hospital

Ask which data the BI needs and why. Management KPIs rarely need to identify the patient. Require:

- the list of information taken outside the hospital;
- that names, national ID numbers (CPF), dates of birth and other direct identifiers are **not** taken when they are not needed;
- that patients be identified, when necessary, by a code (pseudonymization).

## 2. Access control

- Per-user access, with no shared accounts.
- Strong authentication (password plus a second factor).
- Access profiles: each person sees only what they need.
- Temporary users with an expiry date for audits and consultants.
- Separation between customers: one hospital's data never accessible by another.

## 3. Logging and audit

The hospital should be able to know who accessed what, when, and which settings were changed. Ask how long logs are kept and how to access them.

## 4. Where data is stored and who can see it

- On which servers and in which country the data is stored.
- Who on the vendor's team has access, for what purpose, and whether that access is logged.
- Whether there are subcontractors (cloud providers, AI services) and which ones.
- How data travels (encryption in transit) and how access keys are stored.

## 5. Artificial intelligence

If the BI has AI, ask whether data or questions are sent to third-party AI services, whether those services store or use the content and whether patient data is involved. See [artificial intelligence in hospital management](https://clichealth.com.br/en/blog/ai-in-hospital-management).

## 6. Contract

- Defined roles: the hospital as controller and the vendor as processor, with each one's obligations.
- Processing purpose limited to providing the service.
- Security incident notification, with a deadline.
- What happens to the data at the end of the contract: return and deletion.

## 7. Impact on the hospital system

Data should be read with a read-only user, with no ability to change the information system, and with minimal load on the database.

## How Clic Health handles these points

In Clic Health, patients travel to the cloud identified only by a code (names, national ID numbers and dates of birth stay at the hospital), each hospital has its own key, access is per user with a password and personal code, access is logged, temporary users have expiry dates and Tasy access is read-only. The AI does not send data to external AI services. Details are in [security and LGPD](https://clichealth.com.br/en/security) and the [security FAQ](https://clichealth.com.br/en/faq/security-and-data-protection).

## Related questions

Does the hospital need patient consent to use BI?The legal basis for processing health data depends on the purpose and should be defined by the hospital, with its legal advisors and DPO. In management, minimization and pseudonymization greatly reduce the risk.

Is coded patient data still personal data?Pseudonymized data is still personal data under the LGPD when identification is possible with information kept separately. Pseudonymization reduces risk but does not remove the obligations.

Who is responsible in case of a data breach?The LGPD sets responsibilities for the controller and the processor. The contract should detail each one's obligations, including incident notification.

---
Book a demo: https://clichealth.com.br/en/demo · WhatsApp +55 48 99928-8811