Protect patient data in a healthcare practice

These duties apply to any healthcare or social care provider in England that holds patient records, whether you are an NHS contractor or a private practice. Two further layers sit on top of data protection law: the common law duty of confidentiality, and the Caldicott Principles that guide how confidential health and care information is used.

Find a lawful basis for health data

To use health data you need a lawful basis under Article 6 as well as the Article 9 condition. Public bodies usually rely on public task for the Article 6 basis, and private providers usually rely on contract or legitimate interests. Genetic data and biometric data used to identify someone are separate special categories, and both are common in healthcare.

Tell patients how you use their data in a privacy notice, and record the basis you rely on for each use.

Keep patient information confidential

A common law duty of confidentiality arises from the relationship between a patient and the person caring for them. You may share confidential information with the patient's consent, where the law requires or permits it, or where an overriding public interest justifies it, such as preventing serious harm. Record your reasoning whenever you share without consent.

Appoint a Caldicott Guardian if you are in scope

A wholly private provider with no NHS or local authority contracts falls outside the guidance, though many appoint a guardian anyway.

Appoint a data protection officer if required

You must appoint a data protection officer (DPO) if you are a public authority, or if your core activities involve large-scale processing of special category data. NHS bodies are public authorities, and so are GPs, dentists, opticians and pharmacies providing NHS services, whatever their size. A private hospital or large care group will usually meet the large-scale test; a small private practice may not.

The DPO can be a member of staff or an outside service. They must report to the highest level of management and be free from conflicts of interest. Publish their contact details and tell the Commission who they are. The DPO is a separate role from the Caldicott Guardian, and one person can hold both only if the roles do not conflict.

Pay the data protection fee

Secure patient data and share it safely

Article 32 requires security that is appropriate to the risk, and health data is high risk. In practice that means:

• limiting access to staff who need it for their role;
• keeping an audit trail of who has viewed records;
• encrypting data you hold and send;
• training every member of staff;
• disposing of records securely when their retention period ends.

If another organisation handles data for you, such as a cloud host or a transcription service, you must have a written contract with it under Article 28. A written data sharing agreement with organisations you share data with is good practice rather than a legal requirement, and should set out the purpose, lawful basis, security measures and retention.

If you hold an NHS contract or use NHS systems, you will also be asked to complete the Data Security and Protection Toolkit, NHS England's annual self-assessment of your data security.

Keep and destroy records on schedule

Keep each type of record for the minimum period in the NHS Records Management Code of Practice, then destroy it securely. Paper records should be shredded or incinerated and electronic records permanently deleted. Keep a retention schedule so the periods are applied consistently.

Respond to patient requests

Patients can ask for a copy of their records. You must respond within one month of receiving the request, which you can extend by two further months if the request is complex or you have received a number of them from the same person. Tell the patient if you extend.

Report personal data breaches

Report a breach that is likely to risk people's rights and freedoms to the Commission within 72 hours of becoming aware of it. Health data raises the risk: records about mental health, sexual health or HIV status are particularly sensitive, and so is a breach affecting many patients.

Penalties

The Commission can fine up to £17.5 million or 4% of worldwide annual turnover, whichever is higher, for the most serious infringements, such as breaching the processing principles or patients' rights. Lower-tier infringements, such as failing to notify a breach, carry a lower maximum. Patients can also claim compensation, and a serious failure can lead to action by a professional regulator or by the Care Quality Commission.