Health data protection for practices

Two quick questions so we only show what's relevant to your practice. These aren't scored.

1. Do you run a nursing home or other residential care centre registered with HIQA?
2. Does the practice take part in health research, or share patient data for research, registries or studies beyond direct care?

Patients can ask for their records, and many other people will ask for them too. Get the process right once.

1. Can the practice answer a patient's request for a copy of their records within one month, free of charge? Practice manager
2. Do you keep a log of access requests showing the date received and the date answered? Practice manager
3. Before releasing records to solicitors, insurers, employers or family members, do you check you have the patient's signed authorisation or another clear legal basis? Practice manager
4. How do you send referrals, results and letters to hospitals, labs, other practices and the HSE? Practice manager
5. Do staff know when they can and can't share information with a patient's family, carers or representatives? Medical director
6. Do you offer video or phone consultations, or online booking and messaging? Medical director

From the help text

Patients have a right to their records under Article 15 GDPR. You generally can't charge, and you have one month (extendable by two months for complex requests). Information can only be withheld in limited cases, for example where specific health regulations allow it after consulting the relevant clinician because it's likely to cause serious harm. 'Yes' means a written procedure and a named person who handles requests.

Most health data problems start with everyday habits. Check your staff, software and suppliers.

1. Do all staff, locums and students sign a confidentiality agreement and get a short data protection briefing when they start? Practice manager
2. When did staff last receive data protection training or a refresher briefing? Practice manager
3. Does each person log in to the practice software with their own account, with access limited to what their role needs? Practice manager
4. Do you check the practice software's audit trail for inappropriate access, for example staff looking up family, neighbours or well-known patients? Practice manager
5. Do you have a data processing agreement with every supplier that handles patient data, such as your practice software vendor, IT provider, cloud backup, transcription, SMS reminders and shredding company? Practice manager
6. Which of these security measures are in place? Tick all that apply. IT provider
7. Does the practice use CCTV? Practice manager

From the help text

Everyone who can see patient records needs to know their duty of confidence. 'Yes' means signed agreements on file and an induction briefing for every new starter, including temporary staff.

Letters to the wrong address and lost files happen. Knowing what to do takes the panic out of it.

1. Does the practice have a written breach plan, including how to decide whether to report to the Data Protection Commission within 72 hours and when to tell patients? Knock-out Data protection lead
2. Do you keep a log of every breach and near miss, including ones you decided not to report? Data protection lead
3. Do staff double-check names, addresses and patient identifiers before sending letters, results or emails? Practice manager
4. Are paper records and charts kept in locked, access-controlled storage, and never left in corridors, cars or unattended areas? Practice manager
5. I confirm these answers reflect how the practice works today, and the practice manager and a clinical lead have reviewed them. Medical director

From the help text

Health data breaches are often high risk, so many need reporting. 'Yes' means a written plan, a named person who makes the call and staff who know to tell them straight away.

Research uses of patient data have their own Irish rules. These questions apply because you said you take part in research.

Asked only if you answer “Yes” to: Does the practice take part in health research, or share patient data for research, registries or studies beyond direct care?

1. For each research project using identifiable patient data, do you have the patient's explicit consent, or a consent declaration from the Health Research Consent Declaration Committee? Medical director
2. Does each project have the safeguards the regulations require, such as ethics approval, a data protection impact assessment where needed, data minimisation and training for researchers? Medical director
3. Can staff tell the difference between clinical audit or service evaluation (part of care) and research (which needs its own legal basis)? Medical director
4. Is there a written agreement with each university, sponsor or research partner covering roles, data security and what happens to the data at the end? Practice manager

From the help text

The Health Research Regulations 2018 require explicit consent for health research unless an exemption or a consent declaration from the HRCDC applies. 'Yes' means you can show which applies for every current project.

Residents live with you, so their privacy matters in every room. These questions apply to HIQA-registered centres.

Asked only if you answer “Yes” to: Do you run a nursing home or other residential care centre registered with HIQA?

1. Are residents' records kept, updated and retained in line with the Health Act 2007 regulations for designated centres, and available for HIQA inspection? Person in charge
2. Where is CCTV or other monitoring used in the centre? Person in charge
3. Do you ask residents (or their representative) before using their photos in newsletters, social media or displays? Activities coordinator or Person in charge
4. When family members ask about a resident's care, do staff check whether the resident has agreed or the person has a recognised legal role? Person in charge

From the help text

The care and welfare regulations set out the records a designated centre must keep and for how long. 'Yes' means the person in charge has checked your records against the regulations in the last year.