Patient Confidentiality & UK GDPR Flashcards

What is a 'Caldicott Guardian'?

Answer: A senior NHS person responsible for protecting the confidentiality of patient information and enabling appropriate sharing

Every NHS organisation must appoint a Caldicott Guardian — usually a senior clinician or executive — to oversee and guide appropriate handling of patient information and enable justified sharing.

Under what circumstances can patient identifiable information be shared without consent for public health purposes?

Answer: Under specific statutory gateways such as Public Health (Control of Disease) Act 1984, Health Protection Regulations, or public health directions from Secretary of State

Statutory gateways (e.g., mandatory notification of infectious diseases, Public Health Act powers) allow sharing of identifiable patient data without consent to protect public health, provided disclosure is proportionate.

A healthcare professional receives a phone call from someone claiming to be the patient's spouse requesting health information. What is the correct response?

Answer: Do not disclose — verify the patient's identity and only share information with explicit patient consent or a valid legal basis

Being a relative does not automatically confer a right to patient information. UK GDPR requires a lawful basis for disclosure. Without patient consent or another legal gateway, sharing with relatives is a breach.

What is 'pseudonymisation' in the context of health data?

Answer: Replacing identifying fields with artificial identifiers so data cannot be attributed to a specific individual without additional information

Pseudonymisation replaces direct identifiers (name, NHS number) with a code. The data can only be re-identified with the separately stored key. It reduces privacy risk but is not the same as full anonymisation.

Which UK body oversees compliance with data protection law for healthcare organisations?

Answer: The Information Commissioner's Office (ICO)

The ICO is the UK's independent authority for upholding information rights. It has powers to investigate data breaches, issue fines, and enforce UK GDPR compliance across all sectors including healthcare.

What is a 'data breach' under UK GDPR?

Answer: A security incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access to personal data

A data breach includes any incident (accidental or deliberate) resulting in unauthorised access to, loss of, or destruction of personal data. Healthcare organisations must report serious breaches to the ICO within 72 hours.