HCPC Patient Confidentiality & UK GDPR

Question 1

What is the legal basis for processing patient health data under UK GDPR?

Accepted Answer

Explicit consent, or another lawful basis under Article 9 (substantial public interest, vital interests, healthcare purposes, etc.)

Answer

Verbal consent alone is always sufficient

Answer

Health data may be processed freely without any legal basis

Answer

Only NHS organisations may process health data

Question 2

Under UK GDPR, what rights does a patient have regarding their personal health data?

Accepted Answer

Right of access, rectification, erasure (in limited circumstances), restriction, data portability, and to object to processing

Answer

Only the right to access their records

Answer

No rights — NHS controls all health data

Answer

Only the right to erasure

Question 3

What is a 'Subject Access Request' (SAR) in the context of health records?

Accepted Answer

A formal request by an individual for copies of all personal data held about them by an organisation

Answer

A request by a clinician to access a patient's records

Answer

A request for a second clinical opinion

Answer

A request from a solicitor for medical reports

Question 4

How long do NHS organisations typically retain patient health records under Records Management Codes of Practice?

Accepted Answer

8 years after last treatment (adults); 8 years after 18th birthday for children; longer for certain specialties

Answer

3 years only

Answer

Indefinitely with no review

Answer

1 year post-treatment

Question 5

A patient requests that their GP does not share their records with the hospital they are being referred to. What should the healthcare professional advise?

Accepted Answer

The patient has the right to restrict sharing; however, clinicians must explain that restriction may affect the quality and safety of care they receive

Answer

The patient has no right to restrict sharing between NHS organisations

Answer

All NHS records sharing is automatic and patients cannot restrict it

Answer

Only a court order can restrict record sharing

Question 6

What is the 'Caldicott Principles' framework and who does it apply to?

Accepted Answer

Eight principles for protecting patient information across NHS and social care organisations, applicable to all staff handling patient data

Answer

A clinical coding framework for hospital records

Answer

An information technology standard for NHS systems

Answer

A framework for prescription management only