Poland’s data protection authority is stepping up inspections of healthcare organisations following the cyberattack affecting MyDr, a technology provider used by medical facilities. The Office for Personal Data Protection (UODO) says additional inspections will be carried out before the end of 2026, with a focus on how providers secure sensitive patient data and manage risks connected with external IT systems.
The decision reflects growing concern over the concentration of medical data in shared digital platforms. Healthcare records belong to a particularly sensitive category of personal information, and a breach can have consequences far beyond the exposure of basic contact details.
The MyDr incident triggered a broader response
UODO had already opened an inspection of MyDr itself. The authority is examining the technical and organisational security measures used by the company, the risk analysis behind those safeguards and whether controls were tested regularly.
The final scale of the incident has not been definitively established. UODO previously referred to media reports suggesting that around 12,000 healthcare entities may have been connected with the system and that data relating to millions of people could potentially have been involved. The authority stressed that early public estimates did not amount to a confirmed final count.
The MyDr investigation will now sit within a broader programme of healthcare inspections. Hospitals, clinics and other medical providers may face questions about their own controls as well as the way they monitor third-party technology suppliers.
Healthcare has been under closer scrutiny since 2025
The healthcare sector was already part of UODO’s inspection plans before the latest incident. Sector-level inspections began in 2025, when security of personal data was one of the main areas of attention. In 2026, the authority had also been reviewing issues such as the use of video surveillance.
A series of incidents involving medical information has now pushed patient-data protection higher up the priority list. The authority plans to conduct additional inspections focused on technical security, organisational procedures, risk assessment and incident response.
External IT providers do not remove the healthcare provider’s responsibility
One of the most important practical lessons from the incident is that outsourcing a system does not outsource responsibility for data protection. Under GDPR, the healthcare organisation acting as data controller still has duties to assess risk, report qualifying breaches and, where required, inform affected individuals.
That means hospitals and clinics need to understand not only what happens inside their own systems, but also how critical vendors store, process and protect patient data. Contracts, supplier assessments, access controls and incident-notification procedures are all part of the risk framework.
UODO may examine much more than cybersecurity software
In practice, an inspection can extend beyond firewalls, encryption or authentication. Regulators may examine whether the organisation has documented its risk analysis, tested recovery procedures, assigned responsibility for incidents and maintained clear processes for working with external service providers.
The authority’s decision therefore has implications for management as well as IT departments. Cybersecurity failures involving health data can quickly become governance, legal and reputational issues.
Some other inspection plans have been moved to 2027
To increase resources devoted to healthcare, UODO has shifted part of its previously planned sector work. Inspections of online delivery platforms related to personal-data processing in digital intermediation services have been moved to the first and second quarters of 2027.
Other planned inspections remain in place, including reviews involving authorities that process information in large-scale EU systems such as the Schengen Information System and Visa Information System. UODO is also continuing work on public-information bodies, anonymisation practices and the legal basis for processing personal data in marketing.
Medical data security is becoming a board-level compliance issue
The broader message for healthcare providers is clear: patient-data protection is increasingly being assessed as an organisational system rather than a narrow IT function. Institutions need to know where data are stored, who has access, which suppliers are involved, how risks are evaluated and how quickly the organisation can react if a breach occurs.
The MyDr incident has accelerated that scrutiny. For Polish healthcare organisations, the remaining months of 2026 are likely to bring more regulatory attention to security controls, supplier governance and evidence that data-protection procedures work in practice — not only on paper.
Source: Office for Personal Data Protection (UODO) information and the original ManagerPlus report.
