You share your symptoms, treatments and medical history with your doctor. Your data then embarks on a journey that you cannot track or trace. It may leave the surgery’s computer and be transferred to an IT service provider’s system. This provider may host the data on its own servers, back it up elsewhere or use a cloud provider. Other subcontractors may also be involved. At least 24 companies work with doctors in Luxembourg. As for the patient, they have no record enabling them to trace this entire chain.
Nor does the State. In their reply to the Socialist MP 
This response follows the cyber-attack that affected BMS Engineering’s infrastructure from 22 August onwards. This Luxembourg-based IT service provider works with medical practices. The incident temporarily deprived practitioners of their tools and access to certain patient data. BMS Engineering informed the eSanté Agency on 27 August. The agency checked its own systems and the interfaces with the software in question. Its national platform was not affected. The government’s response does not conclude that the service provider was at fault.
No pre-defined control architecture
However, it highlights a problem that goes beyond this particular company. In Luxembourg, a company can offer to host doctors’ patient records without first having obtained a licence, authorisation or certification specific to health data.
The General Data Protection Regulation does, however, impose obligations on doctors and the organisations they engage. They must ensure the confidentiality, integrity and availability of information. They must also be able to restore access to data following an incident. However, the European regulation does not prescribe any standardised architecture. It does not lay down a general rule requiring backups to be physically isolated. It does not specify their geographical distance from the main server. Nor does it prescribe a standard timeframe for data recovery following an attack.
Measures must be proportionate to the risk. The CNPD may monitor compliance with them. However, the Government points out that such monitoring takes place, where applicable, after the activity has commenced. No prior or periodic review is automatically carried out under the General Data Protection Regulation.
The Luxembourg law transposing the European NIS2 Directive introduces additional cybersecurity obligations. It automatically applies to medium-sized and large enterprises operating, in particular, in the healthcare, cloud computing, data centre or IT service management sectors. Small and micro-enterprises do not automatically fall within its scope. However, the Luxembourg Regulatory Authority may designate one of them as a critical entity. NIS2 does not introduce any additional authorisation requirements before a service provider begins to provide its services.
The misunderstanding regarding the shared care record
For patients, another misunderstanding may arise from the certificates issued by the eSanté Agency. The agency publishes a list of software programmes certified as compliant for connection to the Shared Care Record. This certification might lead one to believe that the software’s overall security has been verified. This is not the case. The certificate verifies the software’s data exchanges with the national platform. It does not cover ‘the intrinsic quality, security or robustness’ of the programme. Nor does it cover the hosting infrastructure, backups or business continuity.
A software programme may therefore be authorised to interface with the Shared Care Record even though the infrastructure on which its users’ records are hosted has not received any specific public certification. Furthermore, the certificate is not subject to any mandatory periodic renewal. New tests are carried out whenever the software or the connection rules change in a way that could affect its compliance.
The doctor remains responsible for choosing their partners. Where a service provider wishes to pass data on to another data processor, they must obtain prior written authorisation, either general or specific. In the case of general authorisation, the healthcare professional must be informed of the addition or replacement of a company. They must also be provided with the necessary information regarding the company’s location, its role and the safeguards it provides. In theory, therefore, every doctor should be able to ascertain the chain of subcontractors to which they have consented. However, no authority currently collates all these chains to provide a national overview.
Encryption does not render these obligations unnecessary. Encrypted medical data remains personal data. The rules concerning information, data processing by third parties and transfers outside the European Union continue to apply.
France and Germany require prior certification
France has opted for a more stringent framework. Any organisation that stores, in digital form, data collected during prevention, diagnosis or treatment activities must obtain certification as a health data host, known as HDS. The certification is based on a documentary audit and an on-site audit. It is valid for three years and is reviewed annually.
Since 16 May 2026, all hosting providers concerned must comply with the second version of the framework. This requires that physical hosting take place within the European Economic Area. It also imposes greater transparency where data may be accessible from a third country or by a company subject to non-European legislation. This certification does not guarantee that no attacks will occur. It does, however, require the hosting provider to demonstrate, before commencing operations and on a regular basis thereafter, that it complies with a common set of security rules.
Germany has also introduced regulations governing the use of cloud services for certain health and social data. From July 2025, the systems concerned must, in principle, hold a certificate based on the C5 security catalogue of the German Federal Office for Information Security, or provide equivalent evidence.
The Luxembourg Government acknowledges that a scheme similar to the French model could be introduced by the legislature. However, its response does not mention any plans, decisions or timetable.
