Signal and Threema in care: Encryption is only part of approval
Encrypted messages do not automatically solve account management, device loss or record keeping. Assess the whole workplace workflow.
Révision éditoriale :
Le texte de cet article est disponible en anglais dans cette version du site.
Contexte et sources
Information security includes endpoints, local copies, notifications, administration and recipient selection as well as message encryption. The EDPB presents technical and organisational controls as complementary measures, not a single-feature guarantee. [1]
Resident information requires an appropriate legal basis, with additional conditions for health data. Establish the provider's role from the actual service rather than automatically classifying every provider as a processor. [2]
Where professional secrets are involved, authorised disclosure under section 203 of the German Criminal Code also requires assessment. Neither a consumer label nor a business label answers that question alone. [3]
Portée et limites
No current product-specific claim about Signal or Threema backups, phone-number requirements or administrative features is made here. Private devices are not universally prohibited by law, but need a viable controlled framework.
En termes simples
Fictional example: An encrypted care group retains a former employee after departure. The encryption works; access management fails.
Recommandations pratiques
Our recommendation: Test managed account creation, joining groups and removing access. Ask for a demonstration of leaver and lost-device handling. Decide explicitly on private devices, local storage and backups.
Remote deletion only helps when technically available and operationally usable. Set permitted information types and a documentation process. Reassess after changes to the plan or configuration. Approve a bounded workflow rather than endorsing a brand without conditions.