Foot scans and 3D printing: Protect health information in the workshop too
Measurement and CAD files can identify patients. Manage attribution, manufacturing recipients and transfers throughout the production workflow.
Révision éditoriale :
Le texte de cet article est disponible en anglais dans cette version du site.
Contexte et sources
An order number does not necessarily make a file anonymous. Linkable measurement or manufacturing information may be personal health data. Pseudonymisation and anonymisation are different concepts. [1]
Foot shapes and gait measurements are not automatically special-category biometrics. The GDPR distinguishes health data from biometric processing for unique identification. Health-related measurements need protection without being labelled a fingerprint. [1]
Security covers workshop computers, accounts, transfers and recipients. Determine whether an external manufacturer acts as processor or in another role from the actual responsibilities, not from a standard contract alone. [2], [3]
Portée et limites
Assess medical-device requirements for the actual manufacturing process separately. No universal retention period for every CAD file or automatic approval of a transfer method is asserted.
En termes simples
Fictional example: A practice sends a numbered scan through an approved route while keeping identity mapping separately protected. The parties still treat the file as linkable data restricted to the agreed job.
Recommandations pratiques
Our recommendation: Define necessary measurements and identifiers, recipient roles, uses and retention. Include workshop computers in updates, backup and access management.
Test transfers using artificial files and identify residual copies in mailboxes and portals. Set retention from applicable requirements. Verify reliable attribution as well as file readability; workshop location does not reduce the sensitivity of patient information.