Code of conduct, ethics & standards of practise:

4.0 Data and UK GDPR

The General Data Protection Regulation 2016 and the Data Protection Act 2018 set out the requirements for handling and processing personal data and ‘special category’ data. (Special category data used to be known as ‘sensitive personal data’.)

4.1 GDPR (2016). The GDPR, the applied GDPR and this Act protect individuals with regard to the processing of personal data, in particular by;

4.1.1 requiring personal data to be processed lawfully and fairly, on the basis of the data subject’s consent or another specified basis, 4.1.2 conferring rights on the data subject to obtain information about the processing of personal data and to require inaccurate personal data to be rectified, and 4.1.3 conferring functions on the Commissioner, giving the holder of that office responsibility for monitoring and enforcing their provisions. 4.2 When carrying out functions under the GDPR, the applied GDPR and this Act, the Commissioner, in this case you the member, must have regard to the importance of securing an appropriate level of protection for personal data, taking account of the interests of data subjects, controllers and others and matters of general public interest.

4.3 Personal data is any data that relates to an individual who can be directly or indirectly identified, in particular by referring to an ‘identifier’ (for example, a name or identification number). Special category data includes information about racial or ethnic origin, political opinions, religious or philosophical beliefs, membership of a trade union, physical or mental health or condition, sexual life or sexual orientation, and genetic and biometric data processed for the purpose of identifying a person. Personal data that relates to criminal convictions and offences is no longer included within the definition of sensitive personal data, but similar additional safeguards apply to its processing.

4.4 Processing personal data includes, but is not limited to: holding, obtaining, recording, using and disclosing information.

4.5 The General Data Protection Regulation 2016 and the Data Protection Act 2018 apply to all forms of media, including paper and images. They apply to confidential client information but are far wider in their scope. For example, they also cover personnel records and opinions about an individual.

4.6 The General Data Protection Regulation 2016 introduces more detailed transparency and information-giving requirements, as well as data subject rights. The data subject rights include, for example, the right to be forgotten, the right to access personal data, and the right to have data corrected and erased. You should have privacy policies in place to communicate these effectively to clients.

4.7 Under the Data Protection (Charges and Information) Regulations 2018, every organisation or sole trader that processes personal information must pay a data protection fee to the Information Commissioner’s Office (ICO). They do not have to do this if all the processing of personal data they do is exempt under the Regulations.

4.8 The Privacy and Electronic Communications (EC Directive) Regulations 2003 set rules about sending marketing and advertising electronically (for example, by fax, email, instant message or text). You will need to make sure you comply with these rules when you contact clients by electronic means for marketing purposes (for example, when sending a newsletter). Any electronic marketing communications should only be sent to a client if the client: a) has consented to this (and this consent needs to meet the General Data Protection Regulation 2016 consent requirements), or b) was given the opportunity to opt out each time a communication is sent.

4.9 All members must:
4.9 i. Effectively protect any personal information collected against improper disclosure.
4.9 ii. Do not disclose information about a client – including the identity of the client – either during or after the lifetime of the client, without the consent of the client or the client’s legal representative.
4.9 iii. Understand that anyone to whom personal information is disclosed is given to them in confidence and that they must respect this.

4.9 iv. Personal information MUST BE DISCLOSED in the public interest only when:
a) you are satisfied that identifiable data is needed for the purpose, or
b) it is not practicable to anonymise the data.

4.9 v. If you do make the decision to disclose personal information you must, in each case:
a) tell the client beforehand, if it is reasonably practical
b) make clear to the client what information you will disclose, the reason for the disclosure and the likely consequences of the disclosure
c) disclose only what is relevant
d) make sure that the person or organisation you give the information to holds it on the same terms as those that you are subject to.
4.9 vi.When you disclose confidential information you must:
a) record in writing the reasons for the disclosure, to whom it was made, the date of disclosure and the way in which it was made (for example, written, oral)
b) record in writing the information disclosed and the justification for the disclosure
c) if the client/patient is not told before the disclosure takes place, record in writing the reasons why it was not reasonably practical to do so

4.10 It is important that the consent is freely given, which means you cannot rely on pre-ticked opt-in boxes. You will also need to make sure this is covered in your privacy policy and that you have systems and processes in place which allow you to record the consent and any opt-out requests.

4.11 Members should maintain up-to-date records of all clients in regard to medical history, presenting complaints, assessment and procedures performed. This should follow the data protection guidance listed above.

4.12 The record keeping process should be as transparent as possible, and clients should be made aware that records are being kept.

4.13 All records should be kept according to the 8 principles of the Data Protection Act (1998, GDPR 2018). (Full explanations regarding ach principle identified below can be found at: www.ico.org.uk)
These state that data must be: i) fairly and lawfully processed ii) processed for limited purposes iii) adequate, relevant and not excessive iv) accurate v) not kept for longer than is necessary vi) processed in line with your rights vii) secure viii) not transferred to countries without adequate protection.

4.14 Where a practitioner works as a part of a group practice or clinic, members should ensure that the practice or clinic is registered under the Data Protection Act (1998) where appropriate.

4.15 Records must be kept in a secure place, adequately safeguarded and not accessible to third parties. Computerised records must be kept secure from unauthorised access. Members of PAs are advised to seek advice relating to the requirement to register under the Data Protection Act where client records are computerised.(registration information is available at: www.ico.org.uk)

4.16 Practitioners should safeguard the confidentiality of all client/patients/users information. Disclosure to third parties, including other healthcare professionals should be only with the client’s written permission. (Where information is disclosed to other parties, advice should be sought relating to the requirement to register under the Data Protection Act. Where card payments are taken by individuals not covered by a group Data Protection Registration, it is recommended that advice is sought relating to the requirement to register.)

4.17 Client/patients/users records need to be kept for seven years, in the case of children for 5 years after their 21st birthday, for terminally or seriously ill clients/patients/users records should be retained indefinitely.