In the consent tab we explored the lawful basis for processing sensitive patient data within the referral system (and in general dental practices more broadly). What is a secondary use of data? Put simply, it is the use of data for a purpose other than that originally intended. Examples of secondary use for dental care data might include: commissioning intelligence, risk stratification, financial and national clinical audit, healthcare management and planning, research and public health surveillance.

What permission is needed?

While we discussed that consent is not required for primary health care use, the GDPR are very clear that express patient consent is needed for the use of identifiable information for secondary purposes. However, if patient data is fully anonymised – i.e. there is no means by which the data can be matched back to an individual, then no such consent is required.

The removal of patient identifiers may not be enough to secure anonymity, especially if a disease is rare, or a geographical location is sparsely populated.

Data from the referral management system is fully anonymised within the N3 hosting environment before it is provided to Health Boards, managed clinical networks and others for the purposes of commissioning and research. We remove all patient identifiable data and all identifiable data relating to the referring dentist or practice. For example, we change date of birth to age in years, the URN is removed leaving only the geographical indicator i.e. MAN, and the postcode is exchanged for the local authority area.

Is any consent needed for referrals and patient contact?

We do contact patients about their experience of their treatment, the Friends and Family Test, as well as other PROMS and PREMS that are requested by managed clinical networks. This is undertaken using text message surveys and explicit consent for the patient to be contacted in this way is collected at the time of referral.

If you would like more information on secondary uses, the British Medical Association, has produced some very useful guidance – you can read it here.

Patient’s have always had a right to access their health data – the GDPR changes a few things about how this process works.

• Individuals have the right to access their personal data and supplementary information.
• The right of access allows individuals to be aware of and verify the lawfulness of the processing.

The main difference is that you can no longer charge individuals for access to their data, and you must supply it within a month. However, you can charge a ‘reasonable fee’ when a request is manifestly unfounded or excessive, particularly if it is repetitive. You may also charge a reasonable fee to comply with requests for further copies of the same information. This does not mean that you can charge for all subsequent access requests. It is likely that many SAR will now wait until June 2018 when they will be free of charge. For some organisations, especially those with CCTV or other imaging systems, such requests could be complex to provide – and expensive.

How long do I have to comply?

Information must be provided without delay and at the latest within one month of receipt.

You will be able to extend the period of compliance by a further two months where requests are complex or numerous. If this is the case, you must inform the individual within one month of the receipt of the request and explain why the extension is necessary.

The GDPR includes a best practice recommendation that, where possible, organisations should be able to provide remote access to a secure self-service system which will not be appropriate for most health care providers.

What about referrals?

We do occasionally get SAR from patients directly or via their Solicitors. In most cases we will refer them to the referring dentist as they are often requesting full dental records. If a data subject wishes to see their referral we will provide this to them as soon as possible. As a data processor we will also notify the referring dental practice that a SAR has been made.

We have fair processing information for both professional users and patients. We have aimed to make the documents brief, simple and easy to understand.

We will also provide a fair processing notice leaflet so that you can display this in your surgery for patient’s information. This will be available on this page shortly.

The GDPR encourages data processors and controllers to act in a fair manner, by explaining how and why their data is being used. This is especially important when it comes to the processing of sensitive data – such as that provided in dental referrals. The documents also include straight-forward guidance on how all data subjects can see the information that is held on them.

Click here to see the privacy information that relates to professional use of this website and the referral system.

Click here to see the privacy information that relates to patient use of this website and the referral system.

Other resources

We will be developing further resources for patients, including a simple video, that explains how their data is used to support their dental care. Referring patients is an essential part of all aspects of health care and we aim to support this process through clear and straight forward documentation and information.