Practices and law offices: professional secrecy does not stop at the server door
Health data, case files, notarial deeds: what the law obliges you to protect, your mail system must protect too.
Your situation
Doctors, lawyers, notaries, psychologists: you are bound by professional secrecy and you process sensitive data under Swiss law, the category with the heaviest sanctions. The Federal Office for Cybersecurity explicitly names medical practices among the targets of 2025. And yet, in most practices I review, mail, calendar and documents run through a US provider chosen by default, and the practice software's backup has never been restored.
Risks specific to you
- Exchanges with patients or clients by unencrypted mail, on a server subject to the CLOUD Act.
- Practice software whose backups nobody can locate or restore.
- Locums, trainees and assistants sharing a single account.
- Dictation or a case summary handed to a free AI assistant.
What I do first
The restore test on the practice software and the access review, because a practice that loses its files closes. Then encrypted Swiss mail (Proton or Infomaniak depending on your use) for exchanges with patients and peers, and a document-sharing space that replaces attachments. Then an AI policy and a workshop on what is actually useful: letters, summaries, preparing hearings or consultations, with tools that retain nothing.
A typical path
A 9-person law office in Champel. IT Audit Express, then access review (one account shared by the whole secretariat since 2018), mail migration to Proton in three weeks, AI policy signed, half-day workshop on drafting. What the client remembers most is the one-page response plan pinned up in the managing partner's office.
Book an IT Audit ExpressFrequently asked questions
Our practice software imposes its own hosting.
Often, and sometimes in Switzerland: the dependency review checks and documents it. The rest, mail, calendar, documents, dictation, belongs to you and can be brought home. I deal with what weighs most first.
Proton or Infomaniak?
Proton if end-to-end encryption and confidentiality of exchanges come first (lawyers, psychologists). Infomaniak if you want a complete suite, shared calendars and video included, at lower cost. I recommend one or the other based on your use, with no commission.
What does the law say about AI for a practice?
Swiss data-protection law applies as soon as personal data enters the tool, and professional secrecy comes on top. In practice: no identifying data in a consumer tool, and a business tool configured to retain nothing. For legal interpretation, your professional body and your lawyer are the reference.