Health data is especially sensitive and long-lived. Diagnoses, genomic data and mental-health notes outlast IT cycles and vendor contracts. The same patient's data is also shared between providers, labs, insurers, pharmacies and researchers, each with precise purpose limits.
PastWipe™ reduces the usable value of stolen or exfiltrated data outside approved conditions and records each control decision as evidence. It complements existing clinical-system security, identity, DLP and monitoring.
What makes health data different
- Special sensitivity and longevity: records remain sensitive for decades.
- Complex sharing: many parties need subsets of the same record for different purposes.
- Tight regulation: special-category data rules (for example GDPR and UK GDPR) and sector requirements apply.
- Proof requirements: auditors and courts expect evidence of who accessed what, when, under which purpose and role.
How PastWipe applies
- Purpose and consent binding: requests are evaluated against declared purpose, legal basis and minimisation rules, then released in least-privilege form.
- Validation at the point of use: requests from outside approved identities, devices or environments are denied, restricted or degraded.
- Evidence by design: each access decision can become a signed, tamper-evident record that DPOs and auditors can review.
Example workflows
- Research dataset: a pseudonymised dataset is usable only within the approved research environment and time window. Access from elsewhere is denied and recorded for the DPO and ethics committee.
- Vendor or lab exchange: results shared with an external lab are usable only for the declared purpose. If the lab is compromised, the security state for that route can be changed.
- Clinical exports: reports exported from a clinical system are released only to approved clinicians' devices.
Designed to support evidence for…
- special-category data handling and accountability under GDPR and UK GDPR
- security and incident obligations that apply to health organisations
PastWipe maps to these obligations as a source of evidence. Regulatory evidence
Scope an evaluation · Contact PastWipe · Enforcement and evidence scope