Legal expert warns of the pitfalls of tranferring patient data
The NHS is in transition and organisations are in the process of transferring services and functions to new NHS bodies. Here, CHRIS ALDERSON, a partner at healthcare legal experts, Hempsons, speaks about the importance of preparing information governance plans and keeping asset registers up to date
The Department of Health has published guidance for organisations transferring services and functions to new bodies. NHS Information Governance: Effective Management of Records during a period of Transition or Organisational Change is essential reading for those responsible for managing NHS organisations through the current period of transition.
The guidance suggests that transferring organisations should:
Where the records to be transferred include personal data, it is important to ensure that the necessary Data Protection Act registrations with the Information Commissioner are up to date and reflect the change in functions. It will be necessary to ensure that any successor organisation receiving patient data complies with the requirements of the Information Governance Toolkit , and there must be an adequate plan for informing patients about the change.
It will be necessary to ensure that any successor organisation receiving patient data complies with the requirements of the Information Governance Toolkit , and there must be an adequate plan for informing patients about the change
The steps suggested range from information notices in appointment letters where the responsibility remains within the NHS, through to writing to each patient in advance if the service is transferring to a private sector supplier.
Where both active and inactive patient records are to be transferred, the guidance suggests that the inactive records should not be shared with the new organisation if at all possible, as there would be no need for the receiving body to hold inactive patient records. In such circumstances, the guidance stresses that the inactive records should be archived so as to allow the easy tracing and re-activation if required.
The guidance recognises that in some instances it will simply not be practicable to separate inactive patient records from active files, in which case it advises that the transfer of all records to the new body would be justified in the public interest – provided that steps are taken to ensure that the records are only accessible on a ‘need to know’ basis.
An organisation may hold some patient records in its own right, with another organisation’s archived patient records. This often causes confusion as to which organisation is the data controller. It is important to understand that it may be that both organisations are data controllers of such information, irrespective of what labels have been applied in any transfer agreement.
