New obligations for companies aim to stop liability being shifted onto small clinics

Poland’s response to the MyDr cyberattack is turning toward the contracts that govern data processing. Deputy Digital Affairs Minister Dariusz Standerski said responsibility in one arrangement remained entirely with small medical practices, even though specialized private companies handled further processing.

Authorities have not confirmed a widespread data leak. Standerski said services continue to monitor the situation, while the number of affected clinics and patients remains based on the company’s previous statements. Police and prosecutors have provided no new information. Questions about who carried out the attack and how much ransom was demanded remain part of their investigation.

“

The data is not circulating online, and that is the most important information at this point.

Under existing law, data administrators must inform patients about an incident. In practice, that means private clinics and small practices must contact their patients after receiving information from MyDr. Standerski said clinics are notifying patients who provided email addresses, but reaching people who left only telephone numbers, no contact details or only a home address is more difficult. Some practices have had to send traditional letters.

The minister said the government had responded with a legislative package known as the “Cyber Five.” He said commercial agreements do not always distribute responsibility properly, as shown by the MyDr case. He also thanked people who followed the government’s call to protect their identities. More than 2.5 million new personal identification number, or PESEL, reservations were recorded over two weeks, bringing the total to about 11 million.

“

The system in this area does not work as it should.