Healthcare providers handle some of the most sensitive personal information: patient health records. This data receives special protection under UK law, with requirements beyond standard data protection compliance.

If you provide healthcare or social care services, you must understand three overlapping frameworks that govern patient data:

UK GDPR and Data Protection Act 2018 - Legal framework for all personal data processing
Common law duty of confidentiality - Legal duty arising from the patient-provider relationship
Caldicott Principles - NHS standards for handling patient-identifiable information

Failure to protect patient data can result in ICO fines up to £17.5 million, professional misconduct proceedings, loss of CQC registration, and civil claims from affected patients.

Health data as special category data

Under UK GDPR Article 9, health data is 'special category data' that requires additional safeguards. Health data includes:

Physical or mental health conditions
Medical history and clinical notes
Test results and diagnoses
Medication records
Information about disabilities
Genetic data and biometric data used to identify someone

To process health data lawfully, you need BOTH:

A lawful basis under Article 6 (such as legitimate interests, contract, or public task)
A special category condition under Article 9 (typically health or social care purposes)

UK GDPR and Data Protection Act 2018 - Health Data

Health data is 'special category data' under UK GDPR requiring additional protections. Healthcare providers must have lawful basis and special category condition for processing health data, implement appropriate security, and comply with Caldicott Principles.

Health data as special category data

Health data (data concerning physical or mental health) is special category data under Article 9 UK GDPR. Processing requires both:

Lawful basis: Usually legitimate interests or contract (for private providers) or public task (for NHS)
Special category condition: Usually Article 9(2)(h) - health or social care purposes

The Caldicott Principles

Eight principles governing confidential information in health and care:

Justify the purpose for using confidential information
Use minimum necessary confidential information
Access to confidential information should be on a strict need-to-know basis
Everyone with access should be aware of their responsibilities
Comply with the law
The duty to share information for individual care is as important as the duty to protect confidentiality
Inform patients about how their information is used
Inform patients of their rights (access, rectification, erasure)

Key requirements

Privacy notices: Inform patients how their data is used
Consent: Obtain explicit consent where required (e.g. non-essential uses)
Data security: Encrypt data, control access, secure disposal
Data sharing: Formal agreements (Data Sharing Agreements) for sharing with third parties
Retention: Retain records for minimum 8 years (adults), 25 years (children), permanently (maternity records)
Subject access requests: Respond within 1 month
Data breaches: Report to ICO within 72 hours if high risk

Caldicott Guardian

NHS organisations and care homes must appoint a Caldicott Guardian (senior person responsible for protecting confidentiality and enabling information sharing).

Step 1: Register with ICO as data controller (£40-£2,900 annual fee depending on size)
Step 2: Appoint Data Protection Officer if processing large scale special category data
Step 3: Appoint Caldicott Guardian (NHS and care homes)
Step 4: Publish privacy notice explaining how patient data is processed
Step 5: Implement technical and organisational security measures (encryption, access controls, staff training)
Step 6: Establish Data Sharing Agreements with any organisations you share data with
Step 7: Implement process for handling Subject Access Requests within 1 month
Step 8: Maintain data breach register and report notifiable breaches to ICO within 72 hours
Step 9: Conduct Data Protection Impact Assessments for new processing activities
Step 10: Retain records in line with NHS Records Management Code of Practice

ICO health sector guidance

The Caldicott Principles

The Caldicott Principles are the foundation of patient data protection in UK healthcare. Originally introduced in 1997 and updated in 2020, these eight principles must guide every decision about using or sharing patient-identifiable information.

Principle 1 - Justify the purpose: Every proposed use or transfer of patient-identifiable information must be clearly defined, scrutinised and documented, with continuing uses regularly reviewed.
Principle 2 - Use minimum necessary information: Patient-identifiable information should only be used when absolutely necessary. De-identified or anonymised data should be used where possible.
Principle 3 - Use on a strict need-to-know basis: Access to patient-identifiable information should only be available to those who need it, and only as much access as they need for their role.
Principle 4 - Everyone must understand their responsibilities: Action should be taken to ensure that those handling patient-identifiable information understand their responsibilities and obligations.
Principle 5 - Comply with the law: Every use of patient-identifiable information must be lawful. Someone must be accountable for ensuring this.
Principle 6 - The duty to share can be as important as the duty to protect: Health and social care professionals should have the confidence to share information for safeguarding and to protect patients, while maintaining confidentiality appropriately.
Principle 7 - Inform patients about how their data is used: Patients should be informed of how their confidential information is used, and open and transparent about choices they have.
Principle 8 - Support patients' rights: Patients' rights to access their data, have it corrected, and in some circumstances erased, must be respected and upheld.

The common law duty of confidentiality

Healthcare providers have a common law duty of confidentiality arising from the patient-provider relationship. Patients reasonably expect information shared in confidence will not be disclosed without consent.

The duty can only be breached with patient consent, a legal duty to disclose, or an overriding public interest. You can share without explicit consent when:

Required by law - Court orders, notifiable diseases, safeguarding
Direct care purposes - Sharing with other healthcare professionals involved in the patient's care
Overriding public interest - To prevent serious harm to the patient or others

Document your decision: Record your reasoning whenever sharing patient information without explicit consent.

Appointing a Caldicott Guardian

NHS organisations and most CQC-registered providers must appoint a Caldicott Guardian - a senior person responsible for protecting patient confidentiality and enabling appropriate information sharing.

Caldicott Guardian Appointment

Caldicott Guardian Appointment - Hospital/large healthcare organisation

Regulator: Nhs England
Typical fee: No fee (senior appointment)
Timeline: Must be in place
Frequency: ongoing
Legal basis: Health and Social Care Act 2012; Data Security and Protection Toolkit

NHS organisations and large private healthcare providers must appoint senior Caldicott Guardian responsible for protecting patient confidentiality. Named senior person (board-level) accountable for information governance. Must complete annual Data Security and Protection Toolkit assessment (NHS suppliers/partners). Caldicott Principles apply to all patient-identifiable information sharing decisions.

The Caldicott Guardian ensures the Caldicott Principles are applied, advises on lawful uses of patient information, and reviews data sharing agreements. This should be a senior clinician or nurse at board level with authority to influence policy.

Data Protection Officer requirements

Many healthcare providers must also appoint a Data Protection Officer (DPO) under UK GDPR. This is a separate role from the Caldicott Guardian (though one person can hold both roles if qualified).

Record retention for health records

Healthcare records must be retained for minimum periods set out in the NHS Records Management Code of Practice. These periods apply to all healthcare providers, not just NHS organisations.

Adult health records: Retain for 8 years after last treatment or 8 years after death if patient died whilst in your care
Children's records: Retain until the patient's 25th birthday (or 26th if treatment continued after age 17), or 8 years after death
Maternity records: Retain for 25 years after birth of last child
Mental health records: Retain for 20 years after no further treatment, or 8 years after death
Oncology and radiotherapy records: Retain for 30 years after treatment
Records of patients involved in clinical trials: Retain for 15 years after trial completion
GP records: Retain for 10 years after death or permanent emigration; transfer to new GP if patient moves practice

Secure destruction: When retention periods expire, records containing patient information must be destroyed securely. Paper records should be shredded or incinerated. Electronic records must be permanently deleted using appropriate software or media destruction.

Data security requirements

Healthcare providers must implement appropriate security measures to protect patient data. Key requirements include:

Encryption - Encrypt patient data at rest and in transit
Access controls - Role-based access ensuring staff only see data needed for their role
Audit trails - Log all access to patient records
Staff training - Mandatory information governance training, refreshed annually
Clear desk policy - No patient information left visible when unattended
Incident reporting - Clear procedures for reporting data security incidents

NHS contractors must complete the Data Security and Protection Toolkit (DSPT) annually to demonstrate compliance.

Handling data breaches

Healthcare data breaches are particularly serious because of the sensitive nature of health information. You must report breaches to the ICO within 72 hours if they pose a risk to patients.

UK GDPR data breach notification requirements

72-hour breach notification requirement under UK GDPR Article 33. Pure data reference.

UK GDPR requires data controllers to report certain personal data breaches to the ICO and, in some cases, to the individuals affected.

ICO notification deadline: Within 72 hours of becoming aware of the breach
Clock starts when: You have 'reasonable certainty' a breach has occurred, not when you know full details
When notification required: If the breach is likely to result in a risk to people's rights and freedoms
When notification NOT required: If breach is unlikely to result in any risk to individuals - but must still record internally
Individual notification: Required without undue delay if risk to individuals is HIGH
Legislation: UK GDPR Articles 33 and 34

Required notification content (Article 33(3))

Nature of the breach (what happened)
Categories and approximate numbers of individuals affected
Categories and approximate numbers of records affected
Name and contact details of your DPO or other contact point
Likely consequences of the breach
Measures taken or proposed to address the breach and mitigate harm

Phased reporting: If full information unavailable within 72 hours, report what you know and provide details later 'without undue further delay'
Internal record-keeping: ALL breaches must be documented (whether notified to ICO or not) for audit purposes
Penalty for notification failure: Up to £8.7 million or 2% of global annual turnover (whichever is higher)

Report a breach to the ICO

When assessing breach risk, consider: sensitivity of the data (mental health, sexual health, HIV status are particularly sensitive), volume of records affected, and potential for harm. Significant data security incidents may also need reporting to CQC as a statutory notification.

Data sharing agreements

Healthcare often requires sharing patient information with other providers. Formal data sharing agreements should cover: purpose and lawful basis, security measures, retention periods, and breach notification procedures.

Processor agreements: If another organisation processes data on your behalf (e.g., cloud hosting), you need a formal data processing agreement under UK GDPR Article 28.

Practical compliance steps

Use this checklist to ensure your healthcare practice meets data protection requirements:

Register with ICO and pay data protection fee

Most healthcare providers fall into Tier 2 (£78/year). Register before you start seeing patients.
Appoint Caldicott Guardian (if required)

NHS organisations and larger CQC-registered providers must appoint a senior Caldicott Guardian.
Appoint DPO if large-scale health data processing

Required for hospitals, larger GP practices, care home groups. Can be outsourced.
Create healthcare-specific privacy notice

Inform patients how their health data is used. Display in waiting areas and on website.
Implement appropriate security measures

Encryption, access controls, audit trails, staff training, secure disposal procedures.
Establish data sharing agreements

Formal agreements before sharing patient data with other organisations.
Set up breach reporting procedures

Clear process to assess and report breaches to ICO within 72 hours if required.
Complete Data Security and Protection Toolkit

NHS contractors and those connecting to NHS systems must complete annual DSPT assessment.
Train all staff in information governance

Mandatory training on confidentiality, data protection, and security. Refresh annually.
Review retention periods and implement secure destruction

Ensure records are kept for required periods then securely destroyed.

Business Context Testing

Content Graph

Guvnor

Data protection for healthcare providers

Health data as special category data

The Caldicott Principles

The common law duty of confidentiality

Appointing a Caldicott Guardian

Data Protection Officer requirements

Record retention for health records

Data security requirements

Handling data breaches

Data sharing agreements

Practical compliance steps

Register with ICO and pay data protection fee

Appoint Caldicott Guardian (if required)

Appoint DPO if large-scale health data processing

Create healthcare-specific privacy notice

Implement appropriate security measures

Establish data sharing agreements

Set up breach reporting procedures

Complete Data Security and Protection Toolkit

Train all staff in information governance

Review retention periods and implement secure destruction

Compliance Assistant

🧪 Business Context Testing

◉ Content Graph

Health data as special category data

The Caldicott Principles

The common law duty of confidentiality

Appointing a Caldicott Guardian

Data Protection Officer requirements

Record retention for health records

Data security requirements

Handling data breaches

Data sharing agreements

Practical compliance steps

Register with ICO and pay data protection fee

Appoint Caldicott Guardian (if required)

Appoint DPO if large-scale health data processing

Create healthcare-specific privacy notice

Implement appropriate security measures

Establish data sharing agreements

Set up breach reporting procedures

Complete Data Security and Protection Toolkit

Train all staff in information governance

Review retention periods and implement secure destruction

Related guides in Data Protection

Business Context Testing

Content Graph