BPO
Healthcare administration
Healthcare administrative support under the heightened regime health data requires, without inventing obligations that do not exist.
In summary: appointment scheduling, coverage verification, billing and patient support for medical centres and insurers. Health data is a special category under GDPR Article 9 and staff accessing it are bound by the duty of secrecy in Law 41/2002.
Healthcare administrative work is ordinary in content and extraordinary in regime: scheduling an appointment is not complex, but the mere fact that a person appears registered to receive care is already health data.
That changes the service design from the outset, and it is worth being equally clear about what the rules require and what they do not, because a fair number of invented obligations circulate in this area.
What is included
Administrative support, never clinical.
- Scheduling, confirming and rescheduling appointments
- Coverage and authorisation verification with insurers
- Billing and administrative case management
- Patient support in Spanish and other languages on administrative matters
- Waiting list management and appointment reminders
- Role-limited access to strictly the data each function requires
What is not included
The boundary with clinical activity is absolute.
- Any form of clinical advice, guidance or triage
- Interpretation of results, reports or clinical records
- Decisions on treatment, clinical priority or medical referral
- Access to clinical data beyond what the administrative function requires
- Legal advice on your obligations as controller
Where it is delivered from
Usually from Spain or Poland, inside the European Economic Area. That is the default recommendation for this service, not because a legal localisation requirement exists, but because it reduces the complexity of the transfer analysis and is usually what your own patients and insurers expect.
Delivering from the Latin America corridor is legally possible with standard contractual clauses and a transfer impact assessment, given this is special category data. It is worth assessing case by case rather than assuming.
Health data: what the rules actually require
Health data is a special category under Article 9 of the GDPR, and its processing is prohibited unless one of the exceptions in paragraph 2 applies. The management of health care systems and services is expressly covered by Article 9.2(h).
Paragraph 9.3 adds a requirement that bears directly on an external team: processing must be carried out by a professional subject to secrecy, or by another person also subject to an obligation of secrecy under Member State law or rules established by competent national bodies. In Spain that anchor exists: Article 16.6 of Law 41/2002 subjects all staff accessing clinical record data in the exercise of their duties to the duty of secrecy, and Article 16.4 limits management and administrative staff to data related to their own functions.
On data location, it is worth being explicit because this is where exaggeration is most common: Spanish law contains no obligation to host health data in Spain or in the European Union. Neither the LOPDGDD, nor Law 41/2002, nor Royal Decree 311/2022 establishes such a requirement. What applies is Chapter V of the GDPR on international transfers. We recommend delivery inside the European Economic Area for operational prudence and patient expectation, and we would rather call that our recommendation than present it as a legal requirement.
On retention, Law 41/2002 requires clinical documentation to be kept for a minimum of five years from discharge for each episode of care. Some autonomous communities set longer periods for particular document types, so the period applicable to your centre is worth confirming with your advisors.
On impact assessments and data protection officers: an assessment is required for large-scale processing of special categories and is the controller's obligation, with the processor required to assist. Appointing an officer is mandatory for healthcare establishments legally obliged to keep clinical records, and may also be mandatory for a provider in its own right depending on its core activity.
This is general information about the rules and not legal advice. We work alongside your advisors.
Frequently asked questions
Does Spanish law require health data to be hosted in Spain or the EU?
No. That obligation does not exist in the LOPDGDD, in Law 41/2002 or in the National Security Scheme. What applies is Chapter V of the GDPR. We recommend delivery inside the European Economic Area, and we say that as our recommendation rather than a legal requirement.
Can administrative staff access health data?
Yes, within limits. Article 9.3 of the GDPR admits staff subject to an obligation of secrecy, and Law 41/2002 subjects all staff accessing clinical records in the exercise of their duties to that duty, limiting management staff to data related to their functions.
Do you give any clinical guidance?
Never, under any circumstances. The service is exclusively administrative. Any enquiry of clinical content is referred to the centre's healthcare staff, and that rule forms part of the team's initial training.
How long must clinical documentation be kept?
Law 41/2002 sets a minimum of five years from discharge for each episode of care. Some autonomous communities set longer periods for certain documents, so your centre's specific period is worth confirming with your advisors.
Do we need an impact assessment?
It is required for large-scale processing of special categories, and it is your obligation as controller. Our role is to assist you with information about the processing we carry out on your behalf.
Is patient consent required for this processing?
Not necessarily. Article 9.2(h) covers the management of health care services as an exception. Worth adding that Article 9.1 of the LOPDGDD, which prevents certain processing resting on consent alone, does not include health data in its list.
Need healthcare administrative support?
Tell us appointment volume and the type of administration, and we will assess the delivery model and data handling first.