Patient Confidentiality & UK GDPR Flashcards

What does 'storage limitation' mean under UK GDPR?

Answer: Personal data must not be kept for longer than necessary for the purpose for which it was collected — subject to retention schedules for health records

UK GDPR requires that personal data is retained only for as long as necessary. Healthcare records are subject to specific retention schedules (NHS Records Management Code) that define minimum and maximum retention periods.

What is a 'data sharing agreement' and why is it used in healthcare?

Answer: A formal document setting out the terms, purposes, legal bases, and safeguards for sharing patient data between organisations

Data sharing agreements define: what data is shared, why, who is responsible, what safeguards are in place, retention arrangements, and breach reporting procedures. They provide governance and accountability for inter-organisational sharing.

Under UK GDPR 'accountability' principle, what must healthcare organisations be able to demonstrate?

Answer: That they comply with all UK GDPR principles through documented policies, training, DPIAs, and governance structures

UK GDPR's accountability principle (Article 5(2)) requires data controllers to demonstrate compliance through documented policies, staff training, DPIAs, data protection governance, and breach management procedures.

How does UK GDPR's 'accuracy' principle apply to electronic patient records?

Answer: Records must be kept accurate and up to date; inaccuracies must be corrected promptly — patients have a right to request rectification

UK GDPR requires that personal data is accurate and kept up to date. Patients can request rectification of inaccurate records. Healthcare organisations must have processes to identify and correct data quality issues.

What is the role of a Data Protection Officer (DPO) in an NHS trust?

Answer: To advise on UK GDPR compliance, monitor data protection activity, conduct or support DPIAs, and act as contact point for the ICO and data subjects

NHS trusts must appoint a DPO (mandatory under UK GDPR for public authorities). The DPO provides independent expert advice on compliance, oversees data protection activities, and liaises with the ICO and patients.

What is 'anonymisation' and how does it differ from pseudonymisation in the context of patient data?

Answer: Anonymisation irreversibly removes all identifying information so re-identification is not possible; pseudonymised data can still be re-identified with a key — anonymised data falls outside UK GDPR

Truly anonymised data — where re-identification is not possible — falls outside UK GDPR as it is no longer personal data. Pseudonymised data retains the possibility of re-identification and remains personal data subject to GDPR.