Plataforma AIPD

Any hospital, research centre or healthcare consortium that processes health data at scale must carry out a Data Protection Impact Assessment (DPIA) before launching a project. It is a GDPR requirement, and a heavy one: dozens of legal and technical questions, risks to weigh and safeguards to justify.

The Health Data Protection Officer's office at the Fundació TIC Salut Social serves 38 organisations in the Catalan health system and wanted all of them to assess projects against the same criteria. That meant one shared, open, guided tool applying a single methodology — based on the Catalan Data Protection Authority's model — where a project's whole team could work together: researchers, technical and legal staff, and the DPO.

The starting point was a set of complex Excel spreadsheets: hundreds of questions, formulas that worked out the risk, and answers that depended on other answers. The challenge was to turn them into a web tool anyone could use without losing any of that logic — and to do it without coding the tool question by question, because the methodology keeps evolving and the tool had to evolve with it.

We designed and built the whole platform, with Laravel on the back end and Vue on the front end.

At its core is a custom, generic form engine: there isn't a single question hard-coded. An impact assessment is not a linear form: depending on your answers, new sections appear (if data is shared with third parties, that section opens), some answers fill themselves in from earlier ones so nothing is typed twice, and every question carries its own risk level. All of it — the questions, the conditions that show or hide them, the risk attached to each answer and the calculations that follow — is described in definition files, one per section, and the engine builds the report from them.

When the methodology changes, the change happens mostly in the definitions, not in the code: a new version is published. The platform is on its seventh, and every report stays on the version it was started with.

Vue makes all of this happen instantly as people type: questions show and hide, risk bars turn from green to amber or red, and a flag warns straight away when an answer may mean non-compliance. Laravel handles what cannot fail: who can see and edit each report, the move from one stage to the next, and the final document.

A report runs through eight sections, from the initial screening (is a DPIA needed?) to the DPO's final opinion. From the initial risk, the platform proposes the security controls required; the team marks their status — planned, in progress, implemented — and the residual risk is recalculated.

Each report has roles — author, co-authors, DPO and reviewer — and a review loop: the DPO decides whether the assessment is needed, the reviewer leaves comments the author resolves, and a report can only be closed once no identified risk or mandatory question is left open. Once closed, it downloads as a PDF.