Patient Confidentiality & UK GDPR Flashcards

What is the NHS's 'National Data Opt-Out' and how does it affect patient data?

Answer: Allows patients to opt out of their confidential health data being used for research and planning beyond direct care by NHS Digital/NHS England

The National Data Opt-Out (replacing the previous Type 2 Opt-Out) allows patients to prevent their confidential NHS data being used for planning and research purposes. It does not affect direct care.

How should a healthcare professional handle a request from a journalist for information about a patient?

Answer: Decline and refer to the communications department; no patient information can be disclosed to media without explicit patient consent and legal basis

Media requests for patient information must be declined and referred to appropriate communications teams. Patient confidentiality applies equally regardless of public interest in the person. Explicit consent and legal basis are required.

A healthcare professional emails patient information to the wrong recipient accidentally. What steps must follow?

Answer: Report as a data breach internally (DPO/IG lead) immediately; assess risk of harm; notify affected patient(s) if risk is significant; consider ICO reporting if criteria met

Misdirected emails are reportable data breaches under UK GDPR. Internal reporting to the DPO is required immediately. If there is risk of harm to the patient, they should be notified. ICO reporting required if criteria for notification are met.

What is the purpose of encrypting patient data on portable devices?

Answer: To protect patient confidentiality if the device is lost or stolen, reducing the risk of a reportable data breach

Encryption ensures that even if a portable device containing patient data is lost, the data cannot be accessed without the encryption key, significantly reducing the risk of a reportable data breach.

Which piece of legislation gives patients in England the right to access their health records?

Answer: UK GDPR (right of access) supplemented by the Access to Health Records Act 1990 for records pre-dating GDPR

UK GDPR provides the primary right of access (Subject Access Request) for living patients. The Access to Health Records Act 1990 applies to records created before the GDPR era and to requests by deceased patients' representatives.

What is a 'legitimate interests' lawful basis and can it apply to patient health data?

Answer: Legitimate interests (Article 6(1)(f)) can be a lawful basis for standard data processing, but health data (Article 9) usually requires a specific Schedule condition — legitimate interests alone is insufficient for health data

Legitimate interests may ground standard personal data processing but is insufficient alone for special category (health) data, which requires both an Article 6 basis and an Article 9 condition (e.g., health care purposes, research with safeguards).