Webinar Q&A

Can patient pre and post-op pictures be taken on a mobile phone?

We would generally advise that a dedicated camera or device be used for clinical photographs to reduce the risk of inadvertent data breaches. You should check that holding clinical information on a personal device doesn’t breach the practice’s data policy and make the holder a data controller requiring ICO registration.

More information can be found within the Clinical photos on mobile phones DDJ Journal article.

If a husband calls the reception and asks when his wife’s appointment is, can the receptionist provide that information? It can be difficult to refuse because he may say, “She is my wife”. Does it make any difference if the practice has seen them before and staff are sure that they are husband and wife?

The scenario you describe can sometimes be tricky to navigate for the reasons you outline; however, one never knows the precise circumstances behind such an enquiry.

For example, has the relationship changed? Have the couple separated? Is the husband seeking to find out the whereabouts of his wife, is he exerting coercive control, what if she has created a fictitious appointment to cover for being elsewhere?

The safest way would be to train the reception team in how to deal with such enquiries consistently– something along the lines of ‘while we want to be as helpful as we can, respecting patient confidentiality is very important to us, and so I regret we are unable to provide any information to others without specific permission. I do hope you’ll understand that we do so to act in the best interests of all our patients.

If a reception team member breaches confidentiality contrary to the guidance they have been given, who would be responsible in the event of a complaint?

Generally, the employer/practice owner is responsible for the acts and omissions of their employed staff and must address the complaint. The staff member may make themselves open to disciplinary action.

This question underscores the importance of having clear written policies on confidentiality and data protection, high-quality training and induction procedures, and that employment contracts that reflect the duty to adhere to these.

I am an associate dentist, registered with the ICO, I can access the practice records system from home to review treatment plans etc. Is this ok?

The question of the circumstances in which associates should register with the ICO is set out in this DDU Journal article.

In the scenario you describe, you should check with the practice data controller (commonly the owner) and data protection officer if one is appointed, that your accessing practice systems and records remotely does not breach practice data protection and privacy policies or any relevant clauses in your associate agreement.

Do patients need to formally request notes i.e. in writing, or can they verbally request them and then document this in their notes?

Patients are entitled to requests for information held about them in writing, by email or verbally and such a request can be submitted to anyone within the organisation. Guidance can be found on the NHS England website.

The request would normally be passed to the data controller to deal with and a note would be made of the request and compliance with that request.

What would you advise in respect of privacy while using dental AI tools?

Carefully risk-manage the implementation and use of AI tools. There is a detailed article on the subject in this DDU Journal article.

If one receives an email with a confidential attachment by mistake, do you open the attachment?

As professionals, we would be expected to respect the privacy of the person to whom the information relates and act in accordance with their best interests. Generally, one would delete the information and confirm to the sender that you had done so. The sender would then need to consider what action they would need to take in respect of the data breach. While we are not IT security experts, care should always be taken in respect of unexpected attachments.

How do you manage unauthorised access to data by members of staff who do not require that data i.e. clinical data by those not involved in clinical care?

Information should only be accessed and processed in accordance with practice policies. Most practice management systems have a variety of settings to assist with this; permissions are set in accordance with the needs of the role. For example, a practice manager may need to access financial information, whereas a nurse or associate may not, and vice versa in respect of clinical data. Again, staff training, policies and contracts can play a role in ensuring adherence to these principles.

CPD-verifiable education - Public Services Delivery Scotland

Continue learning with the DDU