A - EXAMPLE OF RECORD KEEPING IN TYPICAL COMMUNITY HEARING PRACTICE Name of Controller: Address of Controller: Telephone/Email: Responsible person: Category of personal Legal basis for processing Who Where possible, time Technical/organisational security measures to ensure level of security appropriate data/data subject personal data personal data are limits for erasure to risks shared with Patient records Legitimate interest and for Registered health See footnote Registered health care professionals and under their supervision have access. – including test results, the purposes of health care care professionals Adults: 8 years. All registered staff comply with HCPC standards, which ensure they respect patient imaging, referral and under Children: retained confidentiality and make accurate records. Paper records are kept securely. letters etc. their supervision until aged 25 (or 26 if Electronic data is password protected and employees can only access the they are 17 when information essential for their role, and receive appropriate training for their role. treatment ends) All employees have passwords so there is an audit of any changes made, there is also a back-up system that means data can be restored. All anti-virus software and other software are kept up to date. Legitimate interest The data subject’s Kept for tax purposes records are kept securely. Electronic data is password protected and Customer records – e.g. direct bank and future employees can only access the information essential for their role, and receive debit/payment claims/information appropriate training for their role. All employees have passwords so there is an details audit of any changes made, there is also a back-up system that means data can be restored. All anti-virus software and other software are kept up to date. Staff records Performance of a contract HR (including Kept for tax purposes – includes bank details, with the data subject or to payroll) and and future NI number, and other take steps to enter into a senior claims/information personal information contract and processing is management only necessary for carrying out obligations under employment 1: Example of how a community hearing practice might document its compliance with data protection rules. ANNEX B LAWFUL BASES FOR PROCESSING PERSONAL DATA – Practices will need to have at least one lawful basis for processing personal data. This means having a legal basis for each processing activity. Lawful basis for processing personal data Notes/examples
A - EXAMPLE OF RECORD KEEPING IN TYPICAL COMMUNITY HEARING PRACTICE Name of Controller: Address of Controller: Telephone/Email: Responsible person: Category of personal data/data subject Legal basis for processing personal data Who personal data are shared with Where possible, time limits for erasure Technical/organisational security measures to ensure level of security appropriate to risks Patient records – including test results, imaging, referral letters etc. Legitimate interest and for the purposes of health care Registered health care professionals and under their supervision See footnote Adults: 8 years. Children: retained until aged 25 (or 26 if they are 17 when treatment ends) Registered health care professionals and under their supervision have access. All registered staff comply with HCPC standards, which ensure they respect patient confidentiality and make accurate records. Paper records are kept securely. Electronic data is password protected and employees can only access the information essential for their role, and receive appropriate training for their role. All employees have passwords so there is an audit of any changes made, there is also a back-up system that means data can be restored. All anti-virus software and other software are kept up to date. Customer records – e.g. direct debit/payment details Legitimate interest The data subject’s bank Kept for tax purposes and future claims/information records are kept securely. Electronic data is password protected and employees can only access the information essential for their role, and receive appropriate training for their role. All employees have passwords so there is an audit of any changes made, there is also a back-up system that means data can be restored. All anti-virus software and other software are kept up to date. Staff records – includes bank details, NI number, and other personal information Performance of a contract with the data subject or to take steps to enter into a contract and processing is necessary for carrying out obligations under employment HR (including payroll) and senior management only Kept for tax purposes and future claims/information 1: Example of how a community hearing practice might document its compliance with data protection rules. ANNEX B – LAWFUL BASES FOR PROCESSING PERSONAL DATA Practices will need to have at least one lawful basis for processing personal data. This means having a legal basis for each processing activity. Lawful basis for processing personal data Notes/examples
NCHA_GDPR_guidance.docx