HCPC Patient Confidentiality & UK GDPR 2

Question 1

What is a 'Caldicott Guardian'?

Accepted Answer

A senior NHS person responsible for protecting the confidentiality of patient information and enabling appropriate sharing

Answer

Every NHS organisation must appoint a Caldicott Guardian — usually a senior clinician or executive — to oversee and guide appropriate handling of patient information and enable justified sharing.

Question 2

Under what circumstances can patient identifiable information be shared without consent for public health purposes?

Accepted Answer

Under specific statutory gateways such as Public Health (Control of Disease) Act 1984, Health Protection Regulations, or public health directions from Secretary of State

Answer

Statutory gateways (e.g., mandatory notification of infectious diseases, Public Health Act powers) allow sharing of identifiable patient data without consent to protect public health, provided disclosure is proportionate.

Question 3

A healthcare professional receives a phone call from someone claiming to be the patient's spouse requesting health information. What is the correct response?

Accepted Answer

Do not disclose — verify the patient's identity and only share information with explicit patient consent or a valid legal basis

Answer

Being a relative does not automatically confer a right to patient information. UK GDPR requires a lawful basis for disclosure. Without patient consent or another legal gateway, sharing with relatives is a breach.

Question 4

What is 'pseudonymisation' in the context of health data?

Accepted Answer

Replacing identifying fields with artificial identifiers so data cannot be attributed to a specific individual without additional information

Answer

Pseudonymisation replaces direct identifiers (name, NHS number) with a code. The data can only be re-identified with the separately stored key. It reduces privacy risk but is not the same as full anonymisation.

Question 5

Which UK body oversees compliance with data protection law for healthcare organisations?

Accepted Answer

The Information Commissioner's Office (ICO)

Answer

The ICO is the UK's independent authority for upholding information rights. It has powers to investigate data breaches, issue fines, and enforce UK GDPR compliance across all sectors including healthcare.

HCPC Registration Practice Test

HCPC Registration Practice Test

HCPC Patient Confidentiality & UK GDPR 2