GDPR - Students Doctors details

[MatthewL]

A patients name, address and DoB is all that A&E would need for an admission, they will be able to find the GP details and access parts of the record i.e. any medication from their system without needing to speak to a GP. It is what they call Summary Care Record, certain parts of your records are available in this instant. You details are looked up on the spine using name and DoB, rarely 2 people have same name and DoB hence the verification with the NHS number.

[GrumbleDook]

Going back to the original topic, I asked our data manager about GP details. Apparently, we collect it in case there is a medical emergency and we can't contact parents, so any additional information we can provide might help. The GP wouldn't talk to us, but they would talk to A&E staff.

 

So you have a purpose, a lawful basis, data retention and minimisation in place.

It's inline with data protection legislation and also with KCSiE too.

Just make sure any contact/data sharing gets logged.

[markberry]

You should not be DPO too.

 

There is a clear conflict of interest between your two roles. Basically, you cannot be responsible for monitoring yourself as a person responsible for data.

 

I'm very hands off and main roles is within SLT and looking at IT strategy. We have a technical team who deal the support and technical implementations. We do take advice externally where required and we also have a deputy DPO who I refer to should there be any conflict of interest.