The UK’s data protection regulator has today published new guidance reminding health and care providers of best practice and their legal requirements around keeping people informed about how they use the personal information they hold on patients and clients.

The Information Commissioner’s Office (ICO) – the UK watchdog that supports and polices data protection and freedom of information laws – says it wants to support health and social care organisations to ensure they are being transparent with people about how their data is being handled and to “provide regulatory certainty” on what people should be told and when.

The NHS, other health providers and the social care sector routinely record sensitive information about the most intimate aspects of care, provided to them on the basis that it will be treated as confidential and the way it is kept and used keeps it safe.

The ICO says in its Transparency in health and social care guidance, that central to people trusting those who hold information about them is transparency about how it is used. It is reminding data holders that, under data protection law, people have a right to know what is happening to their personal information.

The ICO Head of Regulatory Policy Projects, Anne Russell, says keeping people informed is essential as the nature of how data is used changes:

“Being transparent is essential to building public trust in health and social care services. If people clearly understand how and why their personal information is being used, they are likely to feel empowered to share their health information to both access care and support initiatives such as medical research.”

The guidance says the main reasons for being transparent are about ensuring people understand when and how organisations are using their personal information and for what purpose; and to empower people to use that knowledge to help them make decisions about their rights under the law.

The guidance will help organisations to understand the definition of, and assess appropriate levels of, transparency. It also provides practical steps to developing effective transparency information and how to share this with those using their services.

The ICO says the steps taken to inform patients and service users should be proportionate to the risks, suggesting the steps a GP practice might take to tell patients they’ve made a small change to their privacy notice would not need to as detailed as those for an NHS board bringing in a new health records system.

Ms Russell says safely managed health and care data has the potential to help both individuals and the wider health and care system:

“As new technologies are developed and deployed in the health sector, our personal information is becoming more important than ever to boost the efficiency and public benefit of these systems. With this bespoke guidance, we want to support health and social care organisations by improving their understanding of effective transparency, ensuring that they are clear, open and honest with everyone whose personal information is being used.” 

The Scottish government says Scotland is internationally recognised for its rich data and strengths in informatics, and has “long been a pioneer” in the use of linked health service data for statistical research, adding: “This has resulted in our well-established capacity to use data linkage in evaluating interventions for the benefit of the population’s health”.

Last month NHS Dumfries and Galloway confirmed that a police investigation was underway after hackers managed to break into its systems and threatened to release clinical data unless a ransom was paid.

Read more: Hackers threaten to publish more stolen patient data; NHS staff say data vital to improving care

 

Sign up to our bulletin for key health & social care updates straight to your inbox and you can follow healthandcare.scot on Google News.