HCPC Patient Confidentiality & UK GDPR 4

Question 1

How does UK GDPR apply to deceased patients' records?

Accepted Answer

UK GDPR does not apply to deceased persons' data, but common law duty of confidentiality and Access to Health Records Act 1990 still offer some protection

Answer

UK GDPR only protects living individuals. However, a common law duty of confidentiality persists after death, and the Access to Health Records Act 1990 gives limited rights to certain representatives to access deceased patients' records.

Question 2

What is 'consent' as a lawful basis for processing health data under UK GDPR?

Accepted Answer

Freely given, specific, informed, and unambiguous agreement by the patient to their data being processed for a specific purpose — and withdrawable at any time

Answer

UK GDPR consent must be active, specific, informed, and freely given. It must be as easy to withdraw as to give. Pre-ticked boxes or bundled consent for multiple purposes do not meet the standard.

Question 3

A physiotherapist discovers their colleague has accessed a celebrity patient's records without clinical justification. What should they do?

Accepted Answer

Report as a data breach through the organisation's information governance team and line management; this may also be a conduct concern

Answer

Unauthorised access to patient records is a data breach and a professional conduct concern. It must be reported internally through information governance and escalated to management. ICO reporting follows if required.

Question 4

What is a 'fair processing notice' (privacy notice) in the context of NHS health data?

Accepted Answer

Information provided to patients explaining how their data will be used, who it may be shared with, and their data rights — required under UK GDPR transparency obligations

Answer

UK GDPR's transparency principle (Article 13/14) requires organisations to provide clear, accessible privacy notices explaining how patient data is collected, used, stored, and shared, and patients' rights.

Question 5

Under the Data Protection Act 2018, which organisation can access identifiable patient data without consent for approved medical research?

Accepted Answer

Organisations with approval from the Health Research Authority (HRA) and a legal gateway under DPA 2018 Schedule 2/3 (substantial public interest)

Answer

Research access to identifiable data without consent requires HRA approval, a robust legal gateway under DPA 2018, and adherence to Caldicott Principles and data minimisation standards.

HCPC Registration Practice Test

HCPC Registration Practice Test

HCPC Patient Confidentiality & UK GDPR 4