עברית 1-700-722-111 Talk to us
Regulation

Amendment 13 - what it means for your clinic

Amendment 13 to the Israeli Privacy Protection Law came into force in August 2025 and applies to anyone holding medical data. This page turns it into a list of things you can actually do, without alarm and without legalese.

Talk to us 1-700-722-111
Background

What changed

Amendment 13 extends the Privacy Protection Law of 1981. It widens the enforcement powers of the Privacy Protection Authority, extends the duty to inform people whose data is collected, and defines medical data as information of special sensitivity.

For a clinic or an imaging centre the practical meaning is three things: know what data you hold and where, control who reaches it, and be able to prove both.

Worth saying plainly: this page is a practical explanation, not legal advice. For legal questions speak to a lawyer. What we do is the technical and operational side.

Checklist

Seven things you can check today

Go through the list. Any item you cannot answer is usually the one that needs work.

  • MappingDo you know where the medical data sits? A server in the clinic, the cloud, a physician's laptop, an off-site backup, and possibly your software vendor as well.
  • OfficerHas a data protection officer been appointed? The law requires it of certain bodies, and even where it does not, one named person should own the subject.
  • PermissionsWho reaches patient data? And above all: what happens when someone leaves. An access left open is the single most common finding we make.
  • NotificationDo patients know what is collected and why? The duty covers the purpose, who the data may be passed to, and what their rights are.
  • RightsCan you handle an access or deletion request? That needs a procedure, an owner and a response time. And a reasoned answer if a request is refused.
  • SecurityIs the data encrypted and backed up? In transit, at rest, and in the copy that lives outside the clinic. Plus two-factor authentication on every remote connection.
  • RecordsAre the procedures written down? Who approves access, what happens during an incident, and who reports to whom. Without a document nothing can be proved.
Where the IT provider fits

Which part of this is ours

The legal part belongs to you and your lawyer. We are responsible for what makes compliance possible in practice.

We map where the data sits, build the permission structure, separate the equipment network from the office network, run encryption and two-factor authentication, manage the backup and test it, and produce the records you can show a regulator. Our company has an information security officer and a data protection officer, and that is part of the service rather than a paid extra.

What we do not do: write you a legal opinion, or make declarations on your behalf.

Common questions

What we get asked about the amendment

Does a small clinic have to comply too?
The Privacy Protection Law applies to anyone holding personal data, and size does not exempt you. Some duties, such as appointing an officer, depend on the kind of body and the volume of data - that is a question for a lawyer. The technical side, however, is identical: permissions, encryption, backup and records are needed at any size.
The data is held by our software vendor. Is it still my responsibility?
Yes. Whoever the data belongs to remains its owner even when it is stored with a vendor. So it matters what your vendor agreement says, where the servers are, and what happens to the data on the day you stop working together.
How long does it take to get ready?
A survey and mapping usually take one to two weeks. Technical gaps are closed in priority order, with anything genuinely urgent handled immediately. An average clinic reaches an orderly state within one to three months.
What happens if there is a security incident?
You need a procedure prepared in advance: who is identified as handling it, what is disconnected, who reports and to whom, and how it is documented. We build that procedure and rehearse it, so that on the day you are not inventing it.
Privacy compliance for businessThis page describes what is added when there are imaging studies and connected equipment. The general overview is on the SrvIT site.
Read it on srvit.co.il
Related
Medical data securityProtecting patient dataBackup and recoveryBackup and recoveryWhat it costsTransparent costs
Contact

Want to know where you stand?

A survey gives you a list of gaps ranked by risk, and you decide what gets closed and when.

Your message opens a tracked ticket in our service desk. We reply within one business day.
Call1-700-722-111WhatsApp072-2788080
Email
SrvIT sitesrvit.co.il