GDPR and Medical Practices
The EU General Data Protection Regulations (GDPR) came into force in May 2018, raising the standards for Data Protection compliance for private medical practices.
As you may already be aware, the increased responsibilities can place a significant burden on already busy staff and practice managers, because they take decisions on how practices will continue to change and evolve, and to ensure they meet the data protection laws.
High-Risk categories of data
Private medical and GP practices are data controllers for their patient and staff data. Therefore, it is crucial that practice managers and owners understand their legal obligations under the data protection act.
Furthermore, it is clear that medical practices have to process significant amounts of personal data. Consequently, the provision of medical services, by their very nature, means that the processed personal data is high-risk data. This data is called Special Category Data in the data protection regulations.
So, the bar for processing this data is ‘high.‘
Besides, practices have a legal requirement to maintain patient health records, so they must process special category data as part of their daily business.
These records naturally contain sensitive medical information, possibly also including child data and possibly even data relating to sexual preferences. So, the associated risks with processing these categories of data are high.
As a result, your practice is responsible for all the personal data which must be securely collected, stored, and processed to provide the medical services to patients.
Data Security and Privacy
Data Protection compliance covers both data security and data privacy, and often medical practices understand the need for effective security that covers their physical or digital practice data.
However, we find that organisations do not fully understand data privacy and it is this aspect of the data protection regulations which may trip up medical practices.
There are many aspects to consider with data privacy. Fundamentally, your practice must continually review, record and update your data processing activities.
It is, therefore, crucial to record and maintain records of:
- the data you have
- why you have it
- where it came from
- what you do with it
- how long you keep it
- where it is stored
- who has access to it
- an appropriate lawful basis for using it
Additionally, this must be demonstrable if ever asked for by a patient, Information Commission’s Office, or any other regulatory authority.
Accountability and evidence
A major change in the new regulations is the principle of Accountability. This means that medical practices must be able to demonstrate how they are compliant with GDPR.
In our experience, this is a challenge for many organisations.
At Data Protection 4 Business, we have taken the time to build services and technology solutions to help medical practices demonstrate accountability.
A medical practice that can produce evidence demonstrating compliance, will meet the Accountability principle under the data protection regulations. During an audit, the ICO (Information Commissioners Office) will first look for evidence of compliance with the regulations. So, it is really important that this is in place.
Inevitably, they will expect to see a record of processing activities, training of staff, security measures for data and records of consent, as a minimum first step.
Therefore, it is vitally important that staff are trained regularly and that there are records of this training.
We provide role-based easy to use online training for your teams in a range of GDPR topics. These topics cover data breaches, subject access requests and consent.
Our solutions for medical practices
We offer a range of services to support practice managers and owners with their data protection responsibilities.
- Online training
- Outsourced Data Protection Officer (DPO)
- Annual reviews/audits
- Consultancy services to set up compliance structures
- Technology solutions to record and demonstrate compliance
Whether your practice requires a dedicated DPO or a review of existing compliance operations, we can help.
We also offer solutions to reduce the risks of non-compliance and reduce the time staff spend on maintaining compliance records. Consequently, this results in cost and time savings for your practice.
Commitment to the medical practice community
We partner with Designated Medical who provide a range of integrated, flexible and remote support services to help your private practice grow.
Similarly, both Data Protection 4 Business and Designated Medical believe in doing things by the book and have combined our expertise to support your teams with data protection compliance.
Why not read our 6 part series in the Independent Practitioner Today which covers a range of topics to help medical practices maintain compliance with data protection law.
Therefore, in this unique series, we discuss:
- Why you need a data privacy and security culture in your practice
- Top 5 priorities for GDPR compliance
- What does the new ICO guidance on website cookies mean for your practice
- Common data handling mistakes and how to avoid them
- Getting to grips with consent
- Brexit and Data Protection
We are small enough to care yet large enough to offer a wealth of knowledge and solutions to our clients.
FOR UNCOMPLICATED GUIDANCE AND SUPPORT, CONTACT US!
Collaboration with the wider community
We are members of the International Association of Privacy Professionals, Data Protection Forum, Information & Records Management Society and the National Association of Data Protection Officers.
We attend industry events arranged by the ICO and World Data Protection Forum. Equally, we also are proud to be engaged with the Data Engineering and AI communities working together with them to build privacy solutions into our digital and AI futures.
Therefore, through our network of partners and associated specialist companies we can offer our clients:
- Legal advice on GDPR –revision of contracts and HR requirements.
- Technology companies providing software solutions for compliance.
- Specialist sector partners to build online training courses for medical practices, clubs, tech start-ups.
- IT Security & Cyber Security protection.
- Insurance protection for GDPR and Data & Cyber Breaches.
In the UK, the Data Protection Act 2018 came into force on 25th May 2018 and this replaced the Data Protection Act 1998 and broadly adopted the GDPR framework.
The Privacy and Electronic Communications Regulations (PECR) and the e-Privacy Directive in the EU, govern digital communications. Therefore, these regulations apply to businesses, limited companies, partnerships, sole traders, sports clubs and charities who process personal data.
Be Data SMART. Be Compliant.
Data Protection is here to stay.
