In 2026, the ANPD stopped being an advisory body and became a regulatory agency. Law No. 15.352/2026 granted functional, technical and financial autonomy to the National Data Protection Authority. In the Priority Topics Map for 2026-2027, published in December 2025, health data appears among the main enforcement focuses — alongside biometric and financial data. For clinics and private practices, the message is clear: the LGPD is no longer a matter for later.

What changed at the ANPD

The transformation of the ANPD into a regulatory agency expands its capacity to regulate, inspect and apply sanctions. The agency now has its own career track of regulation specialists and a dedicated budget. In practice, this means more enforcement actions, more detailed technical guidance and a higher likelihood that violations will be identified and punished. The health sector is among the priorities — not by chance. Patient data is sensitive, and leaks or improper handling cause concrete harm.

The Ministry of Health coordinates initiatives such as the National Health Data Network (RNDS), Meu SUS Digital and SUS Digital Profissional, all operating in compliance with the LGPD. The ANPD's institutional reinforcement strengthens the digital transformation of the SUS (Brazil's public health system) and, by extension, raises the standard expected of those who handle health data in the private sector.

Health data on the enforcement radar

The Priority Topics Map sets out four axes. Under the “Data Subjects' Rights” axis, the ANPD plans 40 enforcement actions over two years, with special focus on biometric, health and financial data. Ten activities are dedicated specifically to these types of processing. The actions include monitoring the adoption of adequate technical safeguards and verifying compliance with the LGPD.

For a clinic, this translates into: explicit consent when necessary, clear purposes for each processing activity, data minimization (collect only what is needed), security (encryption, access control), and transparency with the patient. Platforms that process health data on behalf of the clinic — such as scheduling systems, electronic medical records or AI agents on WhatsApp — must offer guarantees that they operate in compliance. The responsibility lies with the clinic, which chooses and hires these vendors.

What the clinic needs to have in order

You don't need a dedicated legal department. The essential thing is to document: which data is collected, for what purpose, under which legal basis, for how long it is kept and how it is protected. The Privacy Policy must be accessible and understandable. When the patient authorizes the use of their data for contact or for the clinic to send appointment reminders, this must be recorded. Tools that automate confirmations and rescheduling via WhatsApp handle contact and scheduling data — these are personal data, and in some cases sensitive when linked to a health context.

Choosing LGPD-ready vendors reduces the work. Encryption at rest and in transit, environment segmentation, audit logs and documented legal bases are indicators that the platform takes privacy seriously. The clinic doesn't need to master every technical detail, but it needs to know how to ask and to demand evidence.

AI and health data: extra attention

The ANPD Map includes a specific axis for “Artificial intelligence and emerging technologies,” with 20 enforcement actions. When a clinic uses an AI agent for service over WhatsApp, that agent processes messages, names, phone numbers and scheduling context. If the system transcribes audio or stores conversation history, the volume and sensitivity of the data increase. The recommendation is clear: check whether the vendor applies anonymization or pseudonymization when possible, whether data is retained only for as long as necessary and whether there are contractual clauses setting out each party's obligations.

Simplafy, which offers confirmation and rescheduling automation for clinics, operates with AES-256 encryption, segmented environments and documented compliance. Patient data does not leak into the training of generic models; it stays within the clinic's context. This kind of safeguard should be the expected standard when evaluating any tool that touches patient data.

The timing is for preparation

The ANPD is not going to knock on every clinic's door tomorrow. But the Priority Topics Map sets the direction: health data is at the top of the list. Those who have already organized themselves have an advantage. Those who left it for later may be caught in an inspection or in an incident that exposes the lack of controls. The cost of compliance is lower than the cost of a fine or of a leak that compromises patients' trust.

Want to see how it works in your clinic? Try it free for 10 days at simplafy.com.br/saude — no credit card.

References used to produce this content: