The Data Protection Commissioner ("DPC") has recently published a report entitled "Data Protection Investigation in the Hospitals Sector" (the "Report"), which details an investigation into data protection in the healthcare sector, specifically across twenty hospitals carried out by the DPC's Special Investigation Unit between January and December 2017. This was the first large-scale investigation of this kind ever undertaken in Ireland.
The investigation was carried out in consideration of the substantial volume of sensitive personal data processed in the healthcare sector. Sensitive personal data includes information on physical and mental health and sexual life.
The aim of the investigation was to make recommendations for improvements in the processing of patients' personal data to ensure security and adherence with data protection regulation, and to improve the data protection infrastructure in the sector. The Report highlights fourteen matters of concern, and is intended to prompt an examination by all relevant sector bodies and hospitals of their facilities in light of these concerns.
The fourteen matters of concern were:
- controls in medical records libraries;
- security;
- storage of patient observation charts in hospital ward settings;
- storage of patient charts in trolley bins in ward settings;
- storage of confidential waste paper within the hospital setting;
- disposal of handover lists and patient lists;
- use of fax machines;
- lack of speech privacy;
- absence of audit trails;
- raising awareness of data protection in hospitals;
- consent for research;
- the processing of private health insurance information in hospitals;
- maternity service users; and
- data retention.
The Report set out over seventy recommendations, including:
- restriction of staff access to medical records libraries to those who have a current need therefor and routinely report on staff access thereto, as well as general swipe card access throughout the campus to ensure no unauthorised access;
- implementing automatic locking and logging off of computers in periods of inactivity;
- maintaining of more secure environments with respect to the filing of personal data and storage of charts, particularly during periods where a patient is waiting to be imminently seen by a consultant or otherwise;
- changing the standard practice of hanging patient observation charts on the end of the patient's bed without any security, and covering of charts in transport (such as on hospital trolleys) to prevent third party access;
- the implementation of protocols (and training of staff) to handle a personal data breach to ensure compliance with the GDPR in this respect;
- the replacement of unsecure bins, bags and trays with secure, confidential waste bins;
- providing patients with the opportunity to move to a private space to discuss their health and not being expected to discuss any aspect of their condition, care or treatment in environments where they do not have privacy;
- making comprehensive information available to patients about the processing of their personal data and purposes therefor;
- staff training and refresher programmes to inform and remind staff of their obligations with respect to the data protection rights of patients, particularly for reception staff; and
- the implementation of procedures to safely destroy patient information once the applicable data retention period has been reached.
Hospitals and other healthcare bodies are encouraged to receive the Report as a useful tool to enable them to spot data risks and implement the necessary procedures and policies that will secure their facilities. This will ensure patients' personal data is protected and that the processing of such data adheres to the GDPR.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.