The GDPR treats health data as a special category. What it asks of the people in a healthcare organization and what to prove in an audit.