Patient Confidentiality & UK GDPR Flashcards

A healthcare professional is asked by the police to provide patient information relating to a violent crime investigation. What should they do?

Answer: Balance public interest against patient confidentiality; disclose only what is necessary under a relevant statutory gateway or court order, or where there is serious ongoing risk

Police requests for patient data require a legal basis. Disclosure is permitted under specific statutory gateways, court orders, or where there is serious risk of harm. Routine disclosure on request without legal basis is a breach.

What is the purpose of an NHS Data Security and Protection Toolkit?

Answer: An annual self-assessment for NHS and social care organisations to demonstrate compliance with data security and protection standards

The NHS Data Security and Protection (DSP) Toolkit is an annual online self-assessment that NHS and social care organisations must complete to demonstrate they meet data security and information governance standards.

Under UK GDPR, what is the maximum fine that can be imposed on an organisation for a serious data protection breach?

Answer: Up to £17.5 million or 4% of global annual turnover, whichever is higher (equivalent of EU GDPR €20m/4% rule)

UK GDPR (post-Brexit retained EU law) maintains the maximum fine of up to £17.5 million or 4% of global annual turnover for the most serious violations — equivalent to the EU's €20 million cap.

What does the 'right to erasure' (right to be forgotten) allow a patient to request?

Answer: Deletion of their data where it is no longer necessary, consent is withdrawn, or processing is unlawful — subject to exceptions for health records retained for legal or safety purposes

The right to erasure applies in specific circumstances. Clinical records often cannot be erased due to legal obligations (retention policies) and patient safety considerations. Healthcare organisations can refuse erasure on these grounds.

A care home asks a community occupational therapist for a patient's full clinical records. What must happen before sharing?

Answer: Verify the care home has a legitimate need, a data sharing agreement is in place, and share only relevant information proportionately

Data sharing with care homes requires a legitimate basis (direct care), proportionality (only necessary information), and ideally a formal data sharing agreement. Sharing more than necessary is a breach.

What is a 'data protection impact assessment' (DPIA) and when must one be completed?

Answer: A systematic assessment of risks to individuals' privacy from new data processing activities — mandatory before introducing processing likely to result in high risk

A DPIA (under UK GDPR Article 35) is mandatory before implementing any new processing that is likely to result in high risk to individuals — including new health IT systems, large-scale processing, or systematic monitoring.