How did you address issues related to certification and processing of medical data (152-FZ) in a medical startup?

In a medical startup, to comply with the requirements of Federal Law 152-FZ (on personal data), I paid special attention to the protection and processing of medical data. The main steps included:

• Implementing data encryption both during transmission (e.g., TLS) and storage (e.g., AES).
• Establishing role-based access control to ensure only authorized personnel have access to personal data.
• Implementing data activity auditing to track access and changes.
• Working with the legal department and certification bodies to obtain necessary permissions and confirm compliance.
• Using specialized platforms and services certified for handling medical data.

For example, when developing a mobile app for patients, we implemented two-factor authentication and encryption of local data, as well as trained staff on handling personal data.