Introduction
This document sets out the arrangements in the practice for the confidentiality of patient data and its protection.
All patient information is considered to be confidential and we comply fully with GDPR. All employees have access to this information in relation to their role and have signed a confidentiality agreement. Information may be shared, in confidence, with other NHS organisations in the interests of patient care.
Please note that it is the reserved right of the practice to record all telephone calls for the purposes of patient and staff care, security, and dispute resolution. Recordings and their use will be at the partners’ discretion and will also comply with the practice’s GDPR policy.
The Organisation’s Responsibilities
The organisation will do its upmost to ensure that the confidentiality of patients is protected, alongside the need to identify the best way to help them.
The organisation accepts its responsibility as data controller for all patient data in its care, whether in electronic or paper form. It will ensure that employees fully understand their responsibilities with regard to confidential data. The employees will undertake GDPR training as part of their induction and will sign a written acceptance that they understand the responsibilities they are undertaking towards the security of patient data.
The organisation will also ensure that arrangements are in place for the confidential disposal of any paper waste generated by employees.
The organisation will monitor and record when it is passing ownership of data to an individual (e.g. for project work or research and development) and this may be individually and specifically authorised by the Caldicott Guardian. The individual may then need to be separately registered under the Data Protection Act 1998. The practice will always fully comply with all aspects of data security as required by GDPR.
The organisation will strictly apply the rules of confidentiality and in general will not release patient information to a third party without proper valid and informed consent, unless this is within the statutory exempted categories such as in the public interest. In such cases, the release of the information and the reasons for it will be individually and specifically documented and authorised by the responsible clinician.
The organisation will ensure that it and its suppliers maintain regular security updates including anti-virus software as necessary.
Responsibilities of Staff
Staff will ensure that patient confidentiality is respected. Initial patient contact will endeavour to ascertain the best way to assist without being overly intrusive. This means that staff will need to ask questions that are sufficiently detailed in order that patient’s needs are identified and met efficiently and effectively. However, they must take care to ensure that sensitive information is not overheard by others.
Staff will never disturb a clinical consultation without warning the clinician (and the patient). They will knock and wait for permission to enter a room where there is a closed door. Urgent screen messages can also be sent via the database.
Staff will ensure that their access to patient records takes place in a manner which is necessary and proportionate for the purposes of providing care to patients.
Patient information, where required, will be transmitted to partner agencies such as hospitals and social services etc. Staff must ensure that any such transmissions are conducted in a safe manner and the information given is proportionate to the purpose of the transmission. This may include clarifying who the third party is and why the data is required, checking the identity of the recipient and the channel (address or email address) by which the information is to be transferred.
Staff will not ‘research’ the data of patients known to them. This includes family, friends, acquaintances and patients ‘in the public eye’. If they are aware of a medical need of a family member or friend, they must pass the enquiry to a colleague or manager.
The practice will invoke disciplinary proceedings to protect patient confidentiality. Staff must ensure that there is ‘no conflict of interest’ and if they are unsure they must ask a manager.
Protecting Patient Data against Viruses and Malware
Data is vulnerable to loss or corruption caused by viruses. Malware may seek to harvest confidential data and use it illegally. Staff will ensure that they use the computers provided by the practice in a safe and appropriate manner. Viruses and malware may be introduced from memory sticks and other storage media but mainly obtain access to systems by direct links via email and web browsing.
Staff must:
- Delete any email that asks for their password details.
- Not open attachments that come from unrecognised sources, but delete the entire email.
- Ensure that their computer is fully turned off at least once a week to allow for security updates to take place.
- When browsing, to minimise risk, only access ‘safe’ mainstream sites.