<img src="https://certify.alexametrics.com/atrk.gif?account=b2hlr1ah9W20em" style="display:none" height="1" width="1" alt="">
    Login
    Get started

    6 ways to protect health data under GDPR

    Published on 27 Dec 2017 by Lynne Callister

    health data under GDPR

    Healthcare providers have been advised to strengthen their data protection controls before GDPR, following a series of breaches.

    Earlier this year, it was revealed that there were 9 data protection breaches involving Ipswich Hospital referred to the ICO over a 3-year period, with 5 instances of staff unlawfully accessing personal information.

    At least 4 members of staff were dismissed, with 3 facing disciplinary action. Other breaches included a letter being sent to the wrong patient, theft and a loss of records, and patient handover sheets being taken outside the hospital.

    According to the ICO's 2016/7 statistics, 41% of reported breaches are from the health sector - partly due to mandatory reporting.

    Tips to help strengthen existing controls in relation to health data under GDPR:

    1. Raise awareness of what is covered - make sure everyone is clear about what constitutes sensitive personal data (or special categories of personal data under GDPR). The definition is broad under GDPR and includes past, present and future physical or mental health, information from testing or examination of a body part or bodily substance, genetic and biological samples, information on diseases or risk, disability, medical history, clinical treatment, and so on.
    2. Remind everyone of the need for privacy - personal information cannot be shared or accessed byhealth data under GDPR anyone for any reason.
    3. Conduct a Data Protection or Privacy Impact Assessment - as we are all obliged to do whenever there are high risks to the rights or freedoms of data subjects. Remember, individual consent may not be enough and you may also need processing to be sanctioned by the data protection authority where risks are high.
    4. Only share information on a 'need to know' basis - if access is required to enable them to do their job. If additional access is required to information, this should be re-evaluated to establish the business case.
    5. Take extra care when sharing health data with third parties - make appropriate disclosures and get explicit consent in advance so data subjects understand who else will see their information and for what purpose. Decide how this information will be communicated.
    6. Ensure special categories of data are always adequately protected - use extra security measures (such as encryption) when sending information electronically.

    Want to know more about GDPR?

    As well as 30+ free compliance training aids, we regularly publish informative GDPR blogs. And, if you're looking for a training solution, why not visit our GDPR course library.

    If you've any further questions or concerns about GDPR, just leave us a comment below this blog. We are happy to help!

    Leave a comment

    Tick

    Free Trial: Compliance Essentials

    Skillcast Essentials is our best-selling library and there's a reason for that. Essentials library provides comprehensive coverage of the key compliance / conduct issues that companies in the UK face today.

    Request now

    10 Worst Cyber Crimes Analysed

    Cyber crime creates a huge financial drain on the UK economy every single year. Nearly half of UK businesses reported a cyber attack, according to specialist insurer Hiscox. According to recent ...

    Read More
    Six of the Best Books on Governance, Risk Management & Compliance

    We didn't become compliance learning experts overnight. We stand on the shoulders of some great minds in the Governance, Risk Management and Compliance (GRC) community. Our Pick of the Best Books on ...

    Read More
    5MLD is Coming: Threat or Opportunity?

    Many cryptocurrency firms will feel that more money-laundering regulations are a hindrance to their agile business models, but perhaps they should try and see the opportunities too? The appeal of ...

    Read More
    Skillcast Giving Back

    Skillcast promotes ethical behaviour not only to our customers but to society in general. We do this through education, charitable donations and managing our impact on the environment. We help ...

    Read More