Data protection laws and personal data

Question 1

What is personal data?

Answer 1

Information relating to an identifiable natural person, who can be directly/indirectly identified by reference to an identifier

Question 2

Give 3 examples of identifiers?

Answer 2

Name, address, cultural identity

Question 3

What act was implemented in the UK to protect personal data?

Answer 3

General Data Protection Regulation (GDPR) implemented Data Protection Act 2018

Question 4

How does the DPA 2018 state data should be processed?

Answer 4

Fairly and lawfully

Question 5

What right does the DPA 2018 give living people/their authorised representatives?

Answer 5

Right to apply for access to personal data irrespective of where data was produced

Question 6

In what 2 situations does DPA 2018 not apply?

Answer 6

Deceased person

Data is anonymous

Question 7

Does DPA 2018 apply to NHS or private health records?

Answer 7

Both

Question 8

How does DPA 2018 apply to employers?

Answer 8

Employers could hold info on employees’ mental, physical health

Question 9

Who developed the Caldicott principles?

Answer 9

Dame Fiona Caldicott

Question 10

What is the purpose of the Caldicott principles?

Answer 10

Demonstrate how staff should handle their access to patient’s personal information

Question 11

What is the role of the Caldicott Guardian?

Answer 11

Safeguarding and governing of use of personal data in the Trust

Question 12

How many Caldicott principles are there?

Answer 12

8

Question 13

What do Caldicott principles state about decisions regarding sharing confidential info?

Answer 13

Must be justified

Question 14

What do Caldicott principles state about when to share confidential info?

Answer 14

Only when necessary

Question 15

What do Caldicott principles state about how much confidential info to share?

Answer 15

Minimum necessary amount

Question 16

What do Caldicott principles state about sharing info on a need-to-know basis?

Answer 16

Only tell others what they need to know at the time that need to know the info

Question 17

What do Caldicott principles state about staff responsibilities regarding sharing confidential info?

Answer 17

Staff should be aware of their responsibilities

Question 18

What do Caldicott principles state about the law?

Answer 18

Staff must comply with the law

Question 19

What do Caldicott principles state about balance between duties of sharing info and confidentiality?

Answer 19

Duty of sharing info for individual care is just as important as duty of confidentiality

Question 20

What do Caldicott principles state about informing patients and service users?

Answer 20

They should be informed about how their personal data is used

Question 21

If personal data is incorrect or incomplete, what can the data subject do?

Answer 21

They have the right to correct data

Question 22

If a patient’s personal records contain an incorrect clinical opinion, can the patient exercise their right to correct data?

Answer 22

No, incorrect clinical opinions can’t be removed/corrected but patient can add note stating that they disagree with the clinical opinion

Question 23

What right does a data subject have that allows them to request to remove personal data?

Answer 23

Right of erasure

Question 24

Why does a data subject’s right to erasure not apply to health records?

Answer 24

Healthcare professionals can refuse to comply if data is needed for processing eg. in public interest, or they have official authority

Question 25

Can children access their personal records?

Answer 25

Yes, if they have capacity

Question 26

Give 2 situations in which a patient can access their child’s personal records?

Answer 26

Child gives consent to parents

Child doesn’t have capacity, so patients are given access in child’s best interests

Question 27

Can divorced or separated parents access their child’s personal records if required?

Answer 27

Yes, they still have the same parental responsibility

Question 28

Generally, do deceased patients’ notes stay confidential?

Answer 28

Yes

Question 29

Give 2 examples of when deceased patients’ notes are shared?

Answer 29

Access to Health Records Act 1990 applied

Court-ordered

Question 30

What is the Access to Health Records Act 1990?

Answer 30

Permits access to deceased person’s records by others with claim arising from that patient’s death