Health practices: the four exposures, where every page can reveal a patient's health
Almost everything a practice handles online is health data, down to which page a patient reads and which slot they book. That raises the stakes on all four exposures, and regulators have fined individual doctors and dentists, not only hospitals.
the range of fines from the CNIL, France's data protection regulator, on individual doctors and dentists since 2020, mostly not named, for medical images left open online, weak security and patients refused their own file.
CNIL, checked 8 Nov 2026CNIL fine on Hôpital Privé de la Loire in 2026, after an attacker came in through a login used by outside users, including doctors in private practice, with no two-step login (a code from a phone as well as the password).
CNIL, 3 Sep 2026had the Meta Pixel passing details of conditions, appointments and treatments to Facebook, the press reported in May 2023; 17 said they had removed it.
PA via BreakingNews.ie, 28 May 2023What each one looks like in your business
Email in your name
A patient receives an email from your practice's address: a consultation fee is unpaid and must be settled today, through a link. You never sent it. Your domain (the name after the @ in your address) has no DMARC setting, the public instruction that tells mail servers what to do with fakes, so the patient's mailbox had no instruction to turn it away. And because you already email appointment reminders, it looks routine.
- We found no regulator that fines a practice for a missing DMARC record as such. The risk is fraud against your patients, laboratories and colleagues in your name, and, if a fake email leads to stolen data, the general duty to keep data secure.
- The UK's National Cyber Security Centre says SPF, DKIM and DMARC (three public email settings that list who may send in your name, prove a message is yours and say what to do with fakes) make it difficult for criminals to send email as you, and that every domain needs them, including those on Google or Microsoft 365 (NCSC, 7 Oct 2019).
- In France, the CNIL and the Ordre des médecins, the doctors' professional body, ask for secure health messaging between professionals and, where ordinary email is used, an encrypted attachment with the password sent another way (CNIL and CNOM, Jun 2018).
Tracking before consent
Your agency installs the Meta Pixel across the site for an implant campaign. It now runs on the gum disease page, the dentures page and the booking confirmation, sending Meta the page address, the visitor's IP address (which identifies their internet connection) and, with advanced matching on, their email and phone number in coded form. Even if the visitor accepted the cookie banner, that is health data sent to an advertiser.
- The EU Court of Justice has held that where data collected from website visits can reveal health, it is special category data, the most strictly protected kind under the GDPR (the EU data protection law), whatever the stated purpose of collecting it (Court of Justice of the EU, 4 Jul 2023).
- Sweden's regulator fined two pharmacies SEK 37 million and SEK 8 million in 2024, although their pixels sent data only for customers who had accepted marketing cookies (IMY (Swedish data protection authority), 29 Aug 2024; IMY (Swedish data protection authority), 29 Aug 2024).
- Small fines happen too: in 2024 the CNIL fined a training body for health professionals €15,000 under its simplified procedure, a fast-track fine for smaller cases, partly over cookie information and consent (CNIL, checked 8 Nov 2026).
Customers with disabilities
The practice moves to online booking only, and the phone message now says book online. A patient who uses a screen reader (software that reads the page aloud) cannot get past the date picker, a patient with low vision cannot read the pale grey slot times even with the page enlarged to 200%, and anyone who cannot use a mouse gets stuck on the cookie banner. Older and disabled people are a large share of a practice's patients, and booking is often the only way to a slot.
- The European Accessibility Act, the EU law that requires most online shops and many online services to work for people with disabilities, covers a closed list of services, and healthcare is not on it. Microenterprises providing services, with fewer than 10 people and no more than €2 million in turnover or balance sheet total, are exempt (EUR-Lex, 17 Apr 2019).
- Whether booking a medical appointment online is an e-commerce service (selling to consumers online) under the Act is not settled. EU consumer law treats healthcare contracts separately (EUR-Lex, checked 8 Nov 2026), and we found no official guidance.
- Equality law reaches further: in the UK the Equality Act 2010 applies to anyone providing a service to the public (Equality Act 2010, checked 8 Nov 2026), and the Dutch equal treatment law for disability and chronic illness (Wgbh/cz) names healthcare (wetten.overheid.nl, version from 1 Jan 2026).
Payment and site security
Your old site still shows some pages without the padlock, over plain HTTP that is not encrypted. The contact form asks patients to describe their symptoms and sends them through a plugin (an add-on) nobody has updated, and the deposit page for a private treatment loads code from six other companies. Meanwhile your staff log in to the local clinic's patient system with a password alone.
- In 2020 the CNIL fined two doctors €3,000 and €6,000: thousands of medical images on their own servers could be reached from the internet, unencrypted, and the breach was not notified (Le Monde du Droit, 7 Jan 2021).
- In 2026 it fined Hôpital Privé de la Loire €500,000. The attacker came in through the login used by outside users, including doctors in private practice, with no VPN (a private, encrypted connection) or two-step login, and one account reached every patient's file (CNIL, 3 Sep 2026).
- A practice that takes card payments falls under the card industry's security rules (PCI DSS, set by the card companies and applied through your contract with your bank) like any merchant, even when the payment page is the provider's own (PCI Security Standards Council, checked 8 Nov 2026).
Does the European Accessibility Act apply to you?
Probably not, for most practices. Healthcare is not one of the services the Act lists, and small practices are exempt; a larger clinic's or pharmacy's online shop is another matter.
Since 28 June 2025 the Act has covered a closed list of services to consumers, including e-commerce services: services at a distance, through websites and apps, at a consumer's request, with a view to concluding a consumer contract (in short, selling to consumers online). Healthcare is not on the list. Microenterprises providing services are exempt: fewer than 10 people and no more than €2 million in annual turnover or balance sheet total (EUR-Lex, 17 Apr 2019). Whether online booking of a medical appointment counts as an e-commerce service is not settled. EU consumer law excludes healthcare contracts from its own rules (EUR-Lex, checked 8 Nov 2026), the Act does not refer to that exclusion, and we found no official guidance on medical booking.
Likely in scope
- A clinic, group practice or pharmacy with 10 or more people, or above €2 million, that sells products or paid services to consumers online: a pharmacy webshop, skincare or whitening kits, rehabilitation equipment, paid online programmes.
Likely outside it
- A practice information website: the team, opening hours, directions, treatments described.
- A practice with fewer than 10 people and no more than €2 million in turnover or balance sheet total, whatever it does online.
- A UK practice, unless it sells into the EU.
The Act is not UK law. The Equality Act 2010 applies to anyone providing a service to the public and requires reasonable adjustments, changes that let disabled people use the service (Equality Act 2010, checked 8 Nov 2026); whether an NHS GP practice's own website also falls under the public sector accessibility rules was not confirmed in our sources (GOV.UK, updated 30 Sep 2024).
Our reading of the directive and the regulators' guidance, not legal advice. If your case sits close to the line, ask a lawyer.
Checks you can do in a minute
Can someone send email as your practice?
Run the free email check on your practice's domain, or the test at internet.nl (internet.nl, checked 8 Nov 2026); in the UK the National Cyber Security Centre offers its own. Look for DMARC at p=quarantine (fakes go to spam) or p=reject (fakes are refused).
What loads before the patient chooses?
Open your site in a private window and leave the cookie banner alone. Press F12 to open the browser's developer tools, open the Network tab, reload, and type facebook, google or tiktok in the filter. Anything that appears loaded before the patient agreed.
What loads on booking and treatment pages?
Repeat the check on the booking page, the booking confirmation and one page about a condition. On a health site the safe answer there is nothing from an advertiser, even after consent.
Is your booking provider certified?
In France, ask your booking and software providers for their HDS certificate, the French certification for hosting health data. In the Netherlands, ask for their NEN 7510 certificate, the Dutch information security standard for care. In the UK, if you work with NHS data, check your own Data Security and Protection Toolkit status.
Does your contact form ask for symptoms?
If it has a free box for the reason for the visit, ask whether you need it. Then find out where the form's emails land: an ordinary mailbox full of symptoms is a store of health data.
Can a patient book without a mouse?
On your booking page, use only Tab, Shift+Tab and Enter to pick a slot and confirm it. Then zoom the browser to 200% and try again.
Padlock and certificate
Type http:// and your domain: you should land on https:// with no warning. Click the padlock and note when the certificate, which encrypts the connection, expires.
Does every login ask for more than a password?
Check the practice mailbox, the practice software and any login to a hospital or clinic system. The €500,000 French fine of 2026 began at a login used by outside users, including doctors in private practice, that asked for nothing beyond a password (CNIL, 3 Sep 2026).
What owners in this sector tell themselves
Email and Cookie Fix
Email Fix and Cookie Fix together: your email protected, and no tracking before visitors say yes. For businesses the accessibility law does not cover.
Keep it fixed: from €39 a month
Confirm it with a real scan
We read only what any visitor can see, and your domain's public settings: no login, no testing of your systems. You get a private report by email with screenshots, a score for each of the four exposures, and fixed prices.
The detail, for those who want it
The visitors said yes, and the data still leaked
Apoteket, a Swedish pharmacy, ran the Meta Pixel on its online shop: a small piece of code from Meta, the owner of Facebook and Instagram, that reports what visitors do, for advertising. It ran only for customers who had accepted marketing cookies, and it was even kept off the prescription pages. But a setting called automatic advanced matching had been switched on by individual staff without a risk assessment, by the company's own account to the regulator. For more than two years it sent Meta customers' names, email addresses and phone numbers, in coded (hashed) form, along with purchases such as STI tests, contraception and pregnancy tests. In August 2024 the Swedish data protection authority found a breach of the duty to keep personal data secure and fined Apoteket SEK 37 million, and a second online pharmacy, Apohem, SEK 8 million for a similar pixel leak (IMY (Swedish data protection authority), 29 Aug 2024; IMY (Swedish data protection authority), 29 Aug 2024).
Consent to cookies did not make the pixel safe: on a health site, the page a person visits can itself be health data.
What applies, market by market
Medical secrecy
Every patient has a right to the confidentiality of information about them, under article L1110-4 of the Code de la santé publique (Légifrance, version in force since 4 Aug 2021). Revealing secret information is punishable by one year in prison and a €15,000 fine, under article 226-13 of the Code pénal (Légifrance, checked 8 Nov 2026). To our knowledge, no one has decided whether a tracking pixel that reveals a consultation breaches the secret.
Online booking and hosting
The practice stays data controller for booking data, the one legally responsible for it, even when a platform runs the booking; the platform is its processor, acting on its behalf under a contract the practice must check. Patient files or booking data hosted by a provider must be with an approved or certified health data host, known as HDS (CNIL and CNOM, Jun 2018).
Health data between professionals should travel by secure health messaging (MSSanté, the secure email system for French health professionals). Where ordinary email is used, encrypt the attachments and send the password another way, by phone or SMS (CNIL and CNOM, Jun 2018).
Doctors' websites
Since a 2020 decree (article R4127-19-1 of the Code de la santé publique), doctors may give fair information about their skills and practice online, without testimonials or comparisons. According to the medical insurer MACSF, obtaining a listing that puts a doctor first in search results, for payment or otherwise, remains forbidden (MACSF, 20 Feb 2026).
Decisions and rulings in this sector
| Market | Date | Who decided | Against | Outcome | Why | Source |
|---|---|---|---|---|---|---|
| FR | Dec 2020 | CNIL | Two doctors in private practice (not named) | €3,000 and €6,000 | Thousands of medical images on their own servers open on the internet, unencrypted; the breach was not notified | Le Monde du Droit |
| FR | Apr 2022 | CNIL | A laboratory software publisher (not named) | €1,500,000 | Its duties as a data processor, handling data on the laboratories' behalf, acting beyond their instructions, and security of the patient data it held | CNIL |
| FR | May 2023 | CNIL | A health and well-being website (not named) | €380,000 | Cookies placed without consent, consent for health data from online tests, and security | CNIL |
| FR | Jan 2024 | CNIL (simplified procedure) | A dental surgeon (not named) | €5,000 | Data security, and a patient's right of access to health data not respected | CNIL |
| FR | Sep 2024 | CNIL (simplified procedure) | A training body for health professionals (not named) | €15,000 and an order to comply | Cookie information and consent, the right to have data deleted, no proper contract with its data processor, and security | CNIL |
| FR | Feb 2023 to Feb 2026 | CNIL (simplified procedure) | At least nine GPs, other doctors and dental surgeons (not named) | €3,000 to €5,000 each, often with an order to comply | Mostly patients refused access to their medical file, and practitioners not answering the CNIL | CNIL |
| FR | Jul 2026 | CNIL | Hôpital Privé de la Loire | €500,000 and an order to finish its security measures | An attacker entered through the login used by outside users, including doctors in private practice, with no VPN (a secure private connection) or two-step login (a code as well as the password); 524,867 patients affected | CNIL |
| UK | Dec 2019 | ICO | Doorstep Dispensaree, a pharmacy supplying care homes | £275,000 and an enforcement notice (as reported) | About 500,000 documents with names, NHS numbers and medical information left in unlocked containers in a rear courtyard | The Pharmaceutical Journal |
| UK | Mar 2025 | ICO | Advanced Computer Software Group, an IT supplier to the NHS | £3,076,320, agreed without appeal (as reported) | Ransomware (an attack that locks files and demands money) entered in 2022 through a customer account without two-step login; NHS 111 disrupted and data of 79,404 people taken | Tech Monitor |
| NL | Feb 2021 | Autoriteit Persoonsgegevens | OLVG, an Amsterdam hospital | €440,000, not appealed (as reported) | From 2018 to 2020, too few measures to stop unauthorised staff viewing medical records, and too few checks on who viewed which file | NOS |
| EU | Jul 2023 | Court of Justice of the EU (C-252/21) | Meta Platforms and Others v Bundeskartellamt | Ruling on how the law is to be read | Data collected from website and app visits that can reveal health is special category data, the most protected kind under the GDPR, whatever the stated purpose | Court of Justice of the EU |
| EU | Oct 2024 | Court of Justice of the EU (C-21/23, Lindenapotheke) | A dispute between two pharmacists in Germany | Ruling on how the law is to be read | What customers enter when ordering pharmacy-only medicines online is health data, even without a prescription | Court of Justice of the EU |
| EU | Aug 2024 | IMY, Swedish data protection authority | Apoteket AB, a pharmacy | SEK 37 million | Meta's tracking code (the Meta Pixel), with its advanced matching option, sent sensitive purchases and coded (hashed) contact details to Meta, only for customers who had accepted marketing cookies; still a security failure | IMY (Swedish data protection authority) |
| EU | Aug 2024 | IMY, Swedish data protection authority | Apohem AB, an online pharmacy | SEK 8 million | Meta's tracking code (the Meta Pixel) sent more contact and purchase data than intended, for customers who had accepted marketing cookies; a security failure | IMY (Swedish data protection authority) |
Questions worth asking
Your answers stay on this page. Each one shows why it matters.
Does advertising code (Meta Pixel, Google Ads, TikTok) load on your pages about conditions, treatments or booking?
How do patients book an appointment?
How do you send results, letters or documents to patients and colleagues?
Does logging in to your mailbox, practice software and any hospital or clinic system ask for more than a password (a code, an app or a card)?
How large is the practice, and does it sell anything to patients online?
answers point to something worth fixing.
The full assessment scores all four exposures and builds your list for the next 30 days.
Not legal advice. A lawyer should confirm: whether a tracking pixel that reveals a consultation breaches French medical secrecy; whether a French doctor's paid search ads or retargeting fall under the ban on paid priority listing, a point we found only in a secondary source, the medical insurer MACSF, and what the equivalent rules are for dentists, physiotherapists and pharmacists; whether online booking of a medical appointment is an e-commerce service under the European Accessibility Act for practices above the microenterprise thresholds, country by country; whether an NHS GP practice's own website falls under the public sector accessibility rules; how far the Dutch equal treatment act reaches a practice website; and, for pharmacies selling online, the national authorisation, logo and hosting rules.