The Impact of New GDPR Regulation for GP Practices

The impact of new GDPR
regulation for GP Practices
1

TABLE OF CONTENTS
ISSUE 1
AIMS AND OBJECTIVES 2
LITERATURE REVIEW 3
GDPR regulations 3
Implications of GDPR on practices of general practitioners 3
Impact of GDPR regulation for patients and health care services 4
PROPOSED ACTION 6
EVALUATION OF ACTIONS AND REFLECTION ON PROCESS 7
REFLECTION 9
RECOMMENDATION 10
REFERENCES 11
APPENDIX 13
2

1 ISSUE
General data protection regulation (GDPR) which came into enforcement in 2018 has
affected the data privacy and management techniques followed by general practitioners as well
as health care organisations. The regulation has influenced all organisations processing and
dealing with the personal records and information of EU citizens. Contrary to the data protection
act the GDPR has extended the range of personal data which needs protection so that individual's
privacy and rights can be protected (Voigt and Von dem Bussche, 2017). However apart from
the businesses the act has significant implications on the practices of general practitioners (GP).
The health care professionals sustain the extremely personal records of their patients along with
their genetic information. Thus, the regulation has critical impact upon practices of GP and
overall health care services.
With the principles of GDPR regulations several enhancements have been made to
existing data protection act (DPA). Within health care services the regulation allow patients to
access their personal health records as well as to decide the extent of data sharing and privacy.
The regulation covers both digital records and physical records. In this context the biggest issues
for GP is to compliance with the new regulation GP has to incorporate several changes in their
practices and health care settings. Thus, it is very essential for the GP to understand the scope
and range of the GDPR so that safety and privacy rights of the patient's can be secured.
The regulation influences to both processors and controllers of data and thus it becomes
essential for the general practitioners to understand the range and methods of using the personal
and health records of the EU patients. For this purpose the GP will require introducing several
changes to their practices and to identify the challenges in health care settings which can affect
the integration of their practices and new legislation (Lovell and Foy, 2018). To make the data
sharing fair and cost effective GP will also need to assess their practices so that legal aspects are
not violated and necessary changes can be made to health care practices.
Apart from the GDPR UK also has data protect act which aims at assuring the privacy of
user data. The user data may consist of their contact details, account details and biometric
information. The data protection act consist of data regulations which are applicable to UK only
while contrary to this GDPR has broader aspect and is applicable to all nations of European
Union. Data protection act pertains information limited to identification of an individual while
3

contrary to the new regulation will also explore the genetic information, location, identification
marks as well as other biological parameters. The earlier data protection act did not have much
control and monitoring over the data used by general practitioners and healthcare services.
However, the new GDPR act will regulate the practices of GP and the way in which they store,
use and provide the data of service users.
4

2 AIMS AND OBJECTIVES
The key aim and objective of the study are as follows:
Aim
To analyse and propose solutions regarding impact of new GDPR regulation for practices
of GP.
Objectives:
● To analyse the implications of GDPR regulations on GP
● To evaluate the impact of GDPR on health services and patients.
● To evaluate the possible actions and solutions in response to GDPR in health care
practices of GP.
● To recommend the appropriate solutions for GP's for meeting GDPR Regulations.
● To reflect upon the impact and proposed solutions for GDPR.
5

3 LITERATURE REVIEW
1 GDPR regulations
GDPR provides the data protection to the personal details and sensitive data of the
individuals. According to Goddard, (2017) the GP holds the sensitive and personal health records
of the patients and thus the regulation needs compliance in the services provided by GP. The
most significant change incorporated by the regulation is that it has transformed and widen the
role of general practitioners as data controllers. The data defined as the personal information in
GDPR includes personal information such as name, IP address and NHS number as well as the
special category data such as health status and health records of the individuals.
It has been suggested from several studies that GDPR compliance need to be
demonstrated within health care setting and thus several processes must be incorporated within
care settings. Sousa and et.al., (2018) stated that with the new regulation GP will be required to
maintain updated records along with the effective data protection policies. Data protection
officers have become mandatory so that practices of GP can be made more accurate and reliable.
The regulation aims at encouraging the safe and easy flow the sensitive data of individuals.
GDPR also ensure that general practices does not impose any kind of fees or the financial
restrictions on patients for providing access to the health records. It has been analysed from prior
studies that general practitioners does not consider the security breaches or the database related
issue seriously. Thus, the regulation bounds general practitioners to essentially monitor the data
security and access.
As per the view of Rumbold and Pierscionek, (2017) the regulation aims at ensuring the
privacy of people but it must be assured that privacy notice must have lawful basis so that
information can be processed accurately and safely. The regulation also emphasis that each of
the patient must have information that how their personal details are used by the GP. Thus, it
becomes necessary for GP to have informed consent from the patients regarding the use of their
personal information. The regulation highlights the need of increasing accountability of GP and
to develop a more effective governance network for the data protection.
6

2 Implications of GDPR on practices of general practitioners
In the view of Otto, (2018) GDPR will have critical impact on the existing policies and
practices followed by GP. It has been also analysed that general practitioners also use and
process the details of their patients with different agencies such as national health agencies or the
other organisations aiming at conducting health researches or improving the health outcomes.
Lindgren, (2016) stated that GDPR prepares guideline for the GP so that are accountable
and answerable that how their actions or using data is for the public welfare and does not cause
any harm to the privacy and identity of the individual. Prior to the sharing of data GP must
inform their patients that how they can resolve the issue. The data processing practices followed
by general practitioners are followed by principles such as accuracy, accountability, integrity,
confidentiality and transparency. With the implementation of GDPR in clinical settings GP are
regularly monitored that data is maintained and stored in a way and for the period it is necessary
and legal.
According to Chassang, (2017) GDPR has not only influenced the practices of GP but
has also explored to determine and implement suitable organisational and technical
measurements for protecting unauthorised and unlawful data processing. Another important
implication of GDPR is that along with the authorised access of data GP are also liable to have
concern for the destruction and accidental loss of data. Since general practitioners have access
and control to genetic and biological information it becomes mandatory for GP to ensure that
their care settings are also capable enough to prevent such accidental loss of data.
3 Impact of GDPR regulation for patients and health care services
According to GDPR Information pack, (2019) the key objective of GDPR is to provide
individual more authority and control over their personal data. Thus, patients have right to deny
the sharing of their records with external agencies or other individuals. However, this can have
serious implications for health professions as deletion of health records can have serious
concerns for patients as well as for communities. For instance the patient suffering from highly
contagious disease like HIV may prohibit GP to keep their data, however this can be harmful for
the other people as their vulnerability becomes high to get infected.
As per the view of Wachter, Mittelstadt and Floridi, (2017) GDPR will also be beneficial
for the patients as it will help GP to enhance the quality of services. Since practitioners will have
records of patient's medical history it will be possible for them to provide more accurate health
7

care services on the basis of their medical records. The proper management of data also helps
national health agencies to analyse the data and to formulate suitable health improvement
strategies.
4. Possible actions and solutions in response to GDPR
The foremost change identified is the necessity of having data protection officer (DPO).
The GP service providers are authorised and accountable to public and thus they must have DPO
so that expertise knowledge and efficiency regarding data protection policies and law can be
integrated within GP practices. Carey, (2018) stated that developing systems and organisational
culture for secure management of data can be challenging in term of cost and skills. Thus, GP
must provide suitable training to their staff members so that they can integrate the new
regulations in their practices (Rumbold and Pierscionek, 2017). The staff members are
accountable to DPO and thus they must be trained enough so that they can effectively report the
data management concerns. Through training programs and regular monitoring DPO will assure
that each and every GP and staff member of the organisation is well aware of the type and nature
of information they are storing or accessing. After the implementation of GDPR there will be
regular tracking and monitoring of the information which is stored in the user systems.
8