Healthcare data leakage: testing exfiltration in hospitals and HDS hosting

A healthcare data leak is the unauthorised exit of medical or administrative information about patients outside the scope of the organisation or its hosting provider. For a hospital, a clinic or an HDS-certified host, the real question is not “do we have controls?” but “do these controls actually stop patient data from getting out?”. Only an active test, run with synthetic data, can answer it with evidence.

Why healthcare data gets out so easily

Healthcare data has two particularities. It is durable (a medical history cannot be “reset” like a password) and it sells well, which makes it a classic target for double extortion ransomware operations. ANSSI and the CERT Santé of the French Digital Health Agency regularly report healthcare organisations among the recurring victims of ransomware.

The finding from the field is simple: organisations have often invested in protection components, but rarely checked that they block anything in real conditions.

The framework: GDPR, the French Public Health Code and HDS certification

What the regulation says

• GDPR, Article 9: data concerning health belongs to the special categories of data, whose processing is prohibited in principle, subject to exceptions.
• GDPR, Article 32: the controller must implement measures appropriate to the risk and a process for regularly testing, assessing and evaluating their effectiveness.
• French Public Health Code, Article L1111-8: any hosting of personal health data on behalf of a third party must be carried out by a certified host (or an approved one for paper-based hosting).

What HDS certification covers

HDS certification is run by the French Digital Health Agency (ANS). It is based on the ISO/IEC 27001 standard, supplemented by healthcare-specific requirements. A new framework was published in 2024, with a transition period for hosts already certified: check with your certification body the exact deadline that applies to your scope. This framework notably strengthens the requirements on data location and transparency towards customers.

The audit looks at processes and a sample of evidence. The exfiltration test looks at the result. The two are complementary, not interchangeable. The logic is close to that of ISO 27001 control 8.12 on data leakage prevention.

Hospital or HDS host: different leakage surfaces

Scroll the table →

In a hospital, the main risk often comes from the trusted user in a hurry: the junior doctor who emails a report to a personal mailbox to finish it at home, the medical secretary who drops a file on a consumer file-sharing service. These are everyday leaks, without malice, but with the same legal consequences. At a hosting provider, the subject shifts towards the network, privileged accounts and subcontractors.

A concrete scenario: testing without touching a single patient record

Take a medium-sized hospital. The CISO has a DLP on email, a web proxy and a USB blocking policy. Management wants to know whether a patient file can get out.

1. Build realistic decoys. Generate synthetic files that look like real data: fictitious names, numbers in the format of the French social security number (NIR) but invalid, template reports, CSV exports of hospital stays. No real data is used. This is the principle of synthetic data in production.
2. Choose representative workstations. A shared care workstation, a medical secretary’s workstation, an administrative workstation, an application server.
3. Replay the channels one by one. Sending by email to an external address, dropping on a personal cloud, copying to removable media, web upload, typing into a generative AI assistant, network egress through less monitored protocols.
4. Record three outcomes per channel. Blocked, allowed but detected (alert to the SOC or the managed service provider), or passed without a trace. The third category is the one that matters.
5. Prioritise. Rank the gaps by the volume exposed, the ease of exploitation and the cost of the fix.

What to check before running a test in a healthcare organisation

• Written approval from management, the CISO and the DPO, with a precise scope.
• The SOC or managed service provider informed, or a deliberate decision to also test detection without their knowledge.
• Explicit exclusion of critical biomedical equipment and workstations in operating theatres.
• Exclusively synthetic data, identifiable as such if discovered.
• Egress destinations controlled by the test team, purged at the end.
• Test windows compatible with care activity.
• Success criteria defined before the test: what must be blocked, what must be detected.

A one-off test is not enough

A hospital information system changes constantly: a new teleconsultation application, a DLP software update, an email migration, a new vendor. A rule that worked in January can be ineffective in June without anyone noticing. That is why regularly replaying attack scenarios is worth more than an annual audit. It produces a posture measured over time, useful for the DPO in front of the CNIL, for the CISO in front of executive management, and for the host in front of its customers and its HDS auditor. For the general method, see our page on data exfiltration testing.

Frequently asked questions