Haga Ziekenhuis

Haga Ziekenhuis (Hague Academic Hospital) failed to implement adequate access controls and audit logging for electronic patient records, violating GDPR Art. 32 and Dutch medical confidentiality obligations. The AP's investigation, triggered by media reports that dozens of hospital staff had unlawfully accessed the records of a high-profile patient without clinical justification, found systemic failures in role-based access controls and alert mechanisms. The hospital was ordered to implement corrective measures within four months under threat of additional periodic penalties.