IT for Healthcare — Hospitals, Clinics, Imaging
Healthcare in Türkiye runs on HBYS (Hospital Information System) software, with strict KVKK Article 6 obligations around special-category health data, integration with e-Nabız and MEDULA, and high uptime requirements. We layer Microsoft 365, security and compliance on top of HBYS without touching it.
Atop HBYS
HBYS unchanged; we layer M365 + security on top.
Special Category
KVKK Article 6 health data — Sensitivity Labels, DLP, audit.
PACS Friendly
Imaging archives respected; we don't touch DICOM workflow.
Breach Response
72-hour KVKK Kurumu notification runbook — pre-defined.
What makes this sector different
- HBYS is the operational core — touched only by its specialist vendor.
- KVKK Article 6 — special category data — health, biometric, genetic data with stricter processing rules.
- PACS / DICOM imaging — large file workflows requiring careful network and backup design.
- e-Nabız + MEDULA integration — operational, ongoing.
- Clinical staff workflows — fast, low-friction login (consider FIDO2 / passkey).
- High uptime expectation — downtime affects patient care.
Layered architecture
- HBYS untouched — we layer Microsoft 365 + security on top.
- Sensitivity Labels include a "Health — Special Category" tier.
- DLP rules block accidental external sharing of patient identifiers.
- Audit log retention extended for incident investigation.
- Breach response runbook for the 72-hour notification window.
Frequently chosen with this service
Licenses commonly selected on the same project — each product page has comparisons, FAQ and a quote/cart.
Frequently Asked Questions
No. HBYS is unchanged and stays with its specialist vendor. We layer Microsoft 365, identity, security and compliance on top without integrating into HBYS clinical workflows.
Sensitivity Labels include a "Health — Special Category" tier. DLP rules block external sharing of patient identifiers. Audit log retention extended. Lawful basis for processing reviewed per use case (explicit consent / medical necessity / public health).
Imaging workflows remain on PACS — we don't touch DICOM. We can ensure network performance to PACS endpoints, backup of imaging archives if not already managed, and identity integration for radiologist access.
Where workflow permits, FIDO2 / passkey is the right choice — fast tap-in login, phishing-resistant. For shared workstation scenarios we evaluate smart card or other appropriate factors.
KVKK Kurumu must be notified within 72 hours of becoming aware of a breach affecting personal data. We provide a pre-defined runbook covering containment, forensic preservation, notification drafting and customer/patient communication.
How Xen Bilişim delivers IT for Healthcare — Hospitals, Clinics, Imaging
- 1. Discovery: Stakeholder interviews, current-state inventory, compliance review and risk mapping; deliverable: written discovery report.
- 2. Plan: Target architecture, SKU/licence selection, migration plan and SLA scope documented; quote signed.
- 3. Implement: Phased rollout with pilot → full deployment; user training and runbook delivered; KVKK/ISO compliance evidence collected.
- 4. Operate: Continuous monitoring, quarterly health-checks, incident response and roadmap reviews — under MSP retainer or project-end transfer.
Typical end-to-end timeline: 4-6 weeks (varies by scope).