confidentiality Flashcards by Mary Mekhaeil

what does the GDPR ensure?

•Intended to ensure that data is processed lawfully, fairly and in a transparent manner in relation to individuals across the EU

How well did you know this?

Not at all

Perfectly

what was the GDPR linked with in 2018?

GDPR is accompanied by a new Data Protection Act which came into force in May 2018
•The new Act is all about personal information and the way that it is collected, stored and used

How well did you know this?

Not at all

Perfectly

who oversees the data protection act 2018?

information commissioner (IC)

How well did you know this?

Not at all

Perfectly

what does the data protection act 2018 oversee?

•The Act requires anyone who records and uses personal information to be registered with the IC

How well did you know this?

Not at all

Perfectly

define data subject

•An identified or identifiable living ‘natural individual’

How well did you know this?

Not at all

Perfectly

define data processor

Collecting, recording, organising, structuring, storing, retrieval, consulting, use and disclosure of data
Someone who does any of the above is a data processor

How well did you know this?

Not at all

Perfectly

define data controller

•A person with overall responsibility for the processing of information (decides what data to process and how)

How well did you know this?

Not at all

Perfectly

who is the informations commission officier?

•the independent authority for the UK which will uphold information rights in the public interest

How well did you know this?

Not at all

Perfectly

what is classed as personal information?

Name and address
•Telephone number
•Email address
•Details of medicines dispensed
•NHS number
•Age
•Any information which could potentially be used to identify a person could be classed as PI

How well did you know this?

Not at all

Perfectly

how should organizations handle personal information?

Be transparent in explaining the use of people’s PI
Provide choices about how PI is used where appropriate to do so
Keep it secure
Only collect and retain the minimum amount of PI necessary to carry out their functions
Only retain data for as long as it is required
Report any loss of PI promptly

How well did you know this?

Not at all

Perfectly

what happens if you do not comply with how PI should be handled?

severe penalties

How well did you know this?

Not at all

Perfectly

what is special category data?

personal information that is especially sensitive

How well did you know this?

Not at all

Perfectly

what would happen if you disclosed special category data?

•Disclosure of this data could significantly impact the rights and freedoms of data subjects and potentially be used against them for unlawful discrimination.

How well did you know this?

Not at all

Perfectly

what are examples of special category data?

Race and ethnic origin
Religious or philosophical beliefs
Political opinions
Trade union memberships
Biometric data used to identify an individual
Genetic data
Health data
Data related to sexual preferences, sex life, and/or sexual orientation

How well did you know this?

Not at all

Perfectly

when can you process special category data?

The data subject has given explicit consent to the processing for one or more specified purposes
Processing is necessary for the purpose of the provision of healthcare or treatment •The processing must be done under the responsibility of a professional

How well did you know this?

Not at all

Perfectly

what are the rights of individuals when it comes to PI?

The right to be informed
The right of access
The right to rectification
The right to erasure
The right to restrict processing
The right to data portability
The right to object to data processing
The right not to be subject to automated decision-making including profiling

what rights of individuals are applied to pharmacy?

1.The right to be informed
2.The right of access
3.The right to rectification
7The right to object to data processing

what is patient confidentiality?

is a professional obligation for all pharmacy professionals

t is a professional requirement to gain consent from the patient for the provision of care or pharmacy services

what type of consent applies to marketing purposes?

GDPR consent

what does consent mean?

Consent means ‘express willingness, give permission, agree’

•GPhC Standards for Pharmacy Professionals: ‘Obtain consent to provide care and pharmacy services’

what are the two types of consent?

•Explicit consent
•Implied consent
-must be active consent- not silent- must not assume

when is a pre-ticked consent box ok?

never

what must be provided to a pateient when giving consent?

Information must be provided on the right to withdraw consent and how to do this

how is explicit consent now the same as service consent?

•Consent or explicit consent is a lawful basis for processing personal data
•This is not the same as consent for service provision (consent to the activity) e.g. in a pharmacy
therefore may have to ask for consent twice

whats an example of where you may have to ask for consent twice?

Consent to provide the service | •Consent to process the data associated with the service

how can a person give consent?

* have the capacity to do so * be acting voluntarily * have enough information to allow them to make an informed decision (including material risks) * Be capable of weighing up the information provided

when obtaining consent what should the information be like?

* Information provided should be clear, accurate and presented in a way the patient can understand * No assumption should be made about a person’s level of knowledge * Patients should be given the opportunity to ask questions * In an emergency, if a person needs urgent treatment and consent cannot be obtained, then treatment can be given (unless there is a valid and applicable advance decision to refuse treatment)

when can disclosure of confidential information happen?

* A patient agrees to their information being disclosed (assuming the patient has capacity to make the decision) * The Law requires the information to be disclosed * It is in the public interest to disclose the information

when disclosuing information what info should be given?

only what is required

who can requrest disclosure of information?

•The police or another enforcement, prosecuting or regulatory authority •A healthcare regulator •An NHS counter-fraud investigation officer •A coroner, judge or relevant court - they should have a legmit reason

when are disclosures made in the oublic interest?

This could included information that is required to prevent:•A serious crime •Serious harm to a person receiving care or to a third party •Serious risk to public health

what should be protected in the pharmacy?

•Visibility of Rx forms – left in a place where other people can see them (also Rx awaiting collection) •Visibility of PMR screen to other people•Having discussions about customers both in and outside of work•Physical security breaches to the premises•Errors when bagging/handing out/delivering prescriptions•Shouting out patients’ details when collecting a Rx•Security of smart cards•Secure sign on for access to PMR•Lost prescriptions•Lost keys to premises or filing cabinets•Faxing information to an incorrect number•Lack of encryption of electronic data•Sending an email with data to the incorrect recipient

give a few examples of data breaches?

•Access by an unauthorised third party•Sending personal data to an incorrect recipient•Alteration of personal data without permission•Computing devices containing personal data being lost or stolen•Deliberate or accidental action by a controller or processo

what happens when a data breach occurs?

* Any data breaches should be documented •Personal data breaches that are likely to result in a risk to a person’s rights must be reported to the ICO within 72 hours of the breach * If there is a high risk that the breach is likely to affect the rights of individuals, the individuals affected must be informed * The IC has the power to fine controllers or processors who breach GDPR by up to 4% of global annual turnover or up to €20 million, whichever is the highest