An advance directive is a record of a person’s wishes for future medical treatment and care. In cybersecurity terms, it is highly sensitive personal data: it can reveal health status, family decision-making, legal authority, and end-of-life preferences. Because of that, it should be protected like other high-value clinical records with strict access control, logging, encryption, and role-based permissions.
In real healthcare environments, advance directives matter because attackers often target systems where records are shared across staff, departments, and family communication channels. A phishing compromise, misconfigured permissions, or overbroad sharing can expose the document to unauthorized readers. Defenders reduce that risk by limiting access to need-to-know users, separating patient records from general case notes, and auditing who views or exports the file. The goal is to prevent unnecessary disclosure while preserving accurate care decisions.