Inspect information movement across every supplier
Map where data is stored, processed, displayed, and exported. Include video, messaging, support, analytics, payment, and integration vendors as relevant. A product can use several services behind a single interface, each with different access and contractual arrangements.
The ICO special-category framework requires an appropriate lawful basis and condition for health-data processing. Apply that assessment to the actual supplier chain, purposes, and sharing. Do not accept a generic security badge as an answer to every privacy question. ICO: special category data rules
Review permissions with safe accounts representing the intended roles. Test what support employees and external partners can view, change, and download. Confirm how access is removed when somebody leaves or their responsibilities change.
Inspect notifications and diagnostic logs for unintended medical detail. A system may protect its main clinical screen while sending sensitive information to an ordinary email or tracking tool. Make the information flow understandable before signing a contract that will be difficult to replace after patients depend on it.