Request a DEMO

See how we can help you Pass your next CQC inspection
COMPANY DETAILS
HOW DO YOU KNOW ABOUT US

Data Protection Policy for the Smart Health Care Compliance website

The purpose of this policy is to introduce the General Data Protection Regulation 2016 (“GDPR”) and to ensure that Smart Health Care Compliance and Training understands the key principles of GDPR.

This policy sets out the steps that need to be taken by Smart Health Care Compliance to ensure that Smart Health Care Compliance handles, uses and processes personal data in a way that meets the requirements of GDPR. It should be read in addition to the additional GDPR policies and procedures and guidance that will be produced from now until May 2018.

This policy applies to all staff at Smart Health Care Compliance who process personal data about other staff, Patients and any other living individuals as part of their role.

To meet the legal requirements of the regulated activities that Smart Health Care Compliance is registered to provide:

1. Scope

The following roles may be affected by this policy:

The following stakeholders may be affected by this policy:

2. Objectives

The objective of this policy is to introduce the principles and requirements of GDPR.

3. Policy

GDPR Background

GDPR will come into force on 25 May 2018 and will replace the Data Protection Act 1998. GDPR will be implemented regardless of Brexit. GDPR will provide greater protection to individuals and place greater obligations on organisations, but it can be dealt with in bite-size chunks to ensure that any impact on the provision of care and services is reduced.

All staff will need to understand whether the ways in which they handle personal data already meet the requirements of GDPR and, if not, the steps that need to be taken to achieve compliance.

Smart Health Care Compliance Approach to GDPR

Smart Health Care Compliance is required to take a proportionate and appropriate approach to GDPR compliance. Smart Health Care Compliance understands that not all organisations will need to take the same steps – it will depend on the volume and types of personal data processed by a particular organisation, as well as the processes already in place to protect personal data. We understand that if we process significant volumes of personal data, including special categories of data, or have unusual or complicated processes in place in terms of the way we handle personal data, we will consider obtaining legal advice specific to the processing we conduct and the steps we may need to take.

GDPR does not apply to any personal data held about someone who has died. Both the Access to Medical Reports Act 1988 and the Access to Health Records 1990 will continue to apply.

Smart Health Care Compliance Process for Promoting Compliance

To ensure that Smart Health Care Compliance understands and is able to comply with GDPR, all staff should review the following documents that will be produced over the next few months:

 

Overview of Key Principles and Documents

The key principles and themes of each of the documents listed above are summarised below:

Initial Audit and Privacy Impact Assessment

 Smart Dental Compliance and Training understands that we should conduct an audit of the personal data we currently process. This can be carried out internally by Smart Dental Compliance and Training with the assistance of key staff members. The audit will reveal whether the ways in which Smart Dental Compliance and Training processes personal data meet the requirements of GDPR and will also indicate whether Smart Dental Compliance and Training should delete some of the personal data it currently holds. An initial Privacy Impact Assessment template will be provided as part of the GDPR documentation.

Key Terms

GDPR imposes obligations on all organizations processing a data subject's personal data. A brief description of those three key terms is included in the Definitions section of this document and will be expanded upon in the Key Terms Guidance.

The requirements that Smart Health Care Compliance will need to meet will vary depending on whether Smart Health Care Compliance is a Data Controller or a Data Processor. We recognise that in most scenarios, Smart Health Care Compliance will be a Data Controller. The meaning of Data Controller and Data Processor, together with the roles they play under GDPR, will be explained in the Key Terms Guidance.

Special categories of data attract a greater level of protection, and the consequences for breaching GDPR in relation to special categories of data may be more severe than breaches relating to other types of personal data. This will also be covered in more detail in the Key Terms Guidance.

Key Principles

There are 6 key principles of GDPR which Smart Dental Compliance and Training  must comply with. These 6 principles are very similar to the key principles set out in the Data Protection Act 1998. They are:

These key principles will be explained in more detail in the guidance entitled 'GDPR – Key Principles'.

 Smart Dental Compliance and Training recognises that in addition to complying with the key principles, Smart Health Care Compliance must be able to provide documentation to the Information Commissioner's Office (ICO) on request, as evidence of compliance. We understand that we must also adopt 'privacy by design'. This means that data protection issues should be considered at the very start of a project, or engagement with a new Patient. Data protection should not be an after-thought. These ideas will also be covered in more detail in the Key Principles Guidance.

Processing Personal Data

The position has been improved under GDPR in terms of the ability of care sector organisations to process special categories of data. The provision of health or social care or treatment or the management of health or social care systems and services is now expressly referred to as a reason for which an organisation is entitled to process special categories of data.

In terms of other types of personal data, Smart Health Care Compliance must only process personal data if it is able to rely on one of a number of grounds set out in GDPR. The grounds which are most commonly relied on are:

The other grounds which may apply are:

Data Protection Officers

Smart Health Care Compliance understands that some organisations will need to appoint a formal Data Protection Officer under GDPR (a “DPO”). The DPO benefits from enhanced employment rights and must meet certain.

criteria, so we recognise that it is important to know whether Smart Health Care Compliance has a DPO. This requirement will be outlined in the policy and procedure on Data Protection Officers.

Whether or not Smart Health Care Compliance needs to appoint a formal Data Protection Officer, Smart Health Care Compliance will appoint a single person to have overall responsibility for the management of personal data and compliance with GDPR.

Data Security and Retention

Key principles of GDPR as follows:

Data retention refers to the period for which Smart Health Care Compliance keeps the personal data that has been provided by a Data Subject. At a high level, Smart Health Care Compliance  must only keep personal data for as long as it needs the personal data.

Data security requiresSmart Health Care Compliance to put in place appropriate measures to keep data secure.

These requirements will be described in more detail in the policy & procedure entitled Data Security and Retention, which will be drafted with a view to being circulated amongst staff at Smart Health Care Compliance.

Website Privacy Policy & Procedure

Where Smart Dental Compliance and Training collects personal data via a website, we understand that we will need a GDPR compliant website privacy policy. The privacy policy will explain how and why personal data is collected, the purposes for which it is used and how long the personal data is kept. A template website policy will be provided.

Subject Access Requests

One of the key rights of a Data Subject is to request access to and copies of the personal data held about them by an organisation. Where Smart Dental Compliance and Training  receives a Subject Access Request, it will be responded to the Subject Access Request in accordance with the requirements of GDPR. To help staff, a Subject Access Request Policy & Procedure will be made available to staff. A Smart Health Care Compliance process map to follow when responding to a Subject Access Request, as well as a Subject Access Request letter template will also be included.

The Rights of a Data Subject

In addition to the right to place a Subject Access Request, Data Subjects benefit from several other rights, including the right to be forgotten, the right to object to certain types of processing and the right to request that their personal data be corrected by Smart Health Care Compliance All rights of the Data Subject will be covered in detail in the corresponding guidance.

Breach Notification Under GDPR

We understand, that in certain circumstances, if Smart Health Care Compliance breaches GDPR, we must notify the ICO and potentially any affected Data Subjects. There are strict timescales in place for making such notifications. A policy and procedure for breach notification that can be circulated to all staff, together with a process map for Smart Health Care Compliance to follow if a breach of GDPR takes place will be published.

We understand that this requirement is likely to have less impact on NHS organisations that are already used to reporting using the NHS reporting tool.

Fair Processing Notice and Consent Form

Organisations are required to provide Data Subjects with certain information about the ways in which their personal data is being processed. The easiest way to provide that information is in a Fair Processing Notice. A Fair Processing Notice template will be produced for Smart Dental Compliance and Training to use and adapt on a case by case basis.

The Fair Processing Notice will sit alongside a consent form which can be used to ensure that Smart Health Care Compliance obtains appropriate consent, particularly from the Patient, to the various ways in which Smart Health Care Compliance uses the personal data. The Consent Form will contain advice and additional steps to take if the Patient is a child or lacks capacity.

Transfer of Data

If Smart Health Care Compliance wishes to transfer personal data to a third party, we understand that we should put in place an agreement to set out how the third party will use the personal data. The transfer would include, for example, using a data centre in a non-EU country. If that third party is based outside the European Economic Area, we recognise that further protection will need to be put in place and other aspects considered before the transfer takes place. Guidance will be produced to explain the implications of transferring personal data in more detail.

Privacy Impact Assessments

In addition to carrying out an Initial Impact Assessment (referred to above), Smart Dental Compliance and Training will carry out further assessments each time it processes personal data in a way that presents a “high risk” for the Data Subject. Examples of when a Privacy Impact Assessment should be conducted will be provided in the relevant policy & procedure. Given the volume of special categories of data that are frequently processed by organisations in the health and care sector, there are likely to be a number of scenarios which require a Privacy Impact Assessment to be completed.

The Privacy Impact Assessment template may also be used to record any data protection incidents, such as breaches or 'near misses'.

 

Compliance with GDPR

Smart Health Care Compliance understands that there are two primary reasons to ensure that compliance with GDPR is achieved:

Smart Health Care Compliance appreciates that it is important to remember, however, that the intention of the ICO is to educate and advise, not to punish. The ICO wants organisations to achieve compliance. A one-off, minor breach may not attract the attention of the ICO but if Smart Health Care Compliance persistently breaches GDPR or commits significant one-off breaches (such as the loss of a large volume of personal data, or the loss of special categories of data), it may be subject to ICO enforcement action. In addition to imposing fines, the ICO also has the power to conduct audits of Smart Health Care Compliance and our data protection policies and processes Smart Health Care Compliance realises that the ICO may also require Smart Health Care Compliance to stop providing services, or to notify Data Subjects of the breach, delete certain personal data we hold or prohibit certain types of processing.