GDPR's Influence on General Practices: Challenges and Solutions

This report analyzes the implications of the General Data Protection Regulation (GDPR) on general practitioner (GP) practices and healthcare services. It explores the key issues, including the expanded scope of personal data protection, the impact on patient data management, and the need for compliance with new regulations. The report reviews the GDPR regulations, their impact on GPs, and the implications for patients and healthcare services. It proposes actions such as training programs and the appointment of data protection officers (DPOs) to address the challenges. The evaluation of the proposed actions highlights the importance of understanding GDPR principles and implementing suitable data management systems. The report emphasizes the need for GPs to ensure data security, patient privacy, and compliance with the law. Ultimately, the study recommends solutions for GPs to meet GDPR regulations effectively and ensure the protection of patient data.

The impact of new GDPR
regulation for GP Practices
1

TABLE OF CONTENTS
ISSUE 1
AIMS AND OBJECTIVES 2
LITERATURE REVIEW 3
GDPR regulations 3
Implications of GDPR on practices of general practitioners 3
Impact of GDPR regulation for patients and health care services 4
PROPOSED ACTION 6
EVALUATION OF ACTIONS AND REFLECTION ON PROCESS 7
REFLECTION 9
RECOMMENDATION 10
REFERENCES 11
APPENDIX 13
2

1 ISSUE
General data protection regulation (GDPR) which came into enforcement in 2018 has
affected the data privacy and management techniques followed by general practitioners as well
as health care organisations. The regulation has influenced all organisations processing and
dealing with the personal records and information of EU citizens. Contrary to the data protection
act the GDPR has extended the range of personal data which needs protection so that individual's
privacy and rights can be protected (Voigt and Von dem Bussche, 2017). However apart from
the businesses the act has significant implications on the practices of general practitioners (GP).
The health care professionals sustain the extremely personal records of their patients along with
their genetic information. Thus, the regulation has critical impact upon practices of GP and
overall health care services.
With the principles of GDPR regulations several enhancements have been made to
existing data protection act (DPA). Within health care services the regulation allow patients to
access their personal health records as well as to decide the extent of data sharing and privacy.
The regulation covers both digital records and physical records. In this context the biggest issues
for GP is to compliance with the new regulation GP has to incorporate several changes in their
practices and health care settings. Thus, it is very essential for the GP to understand the scope
and range of the GDPR so that safety and privacy rights of the patient's can be secured.
The regulation influences to both processors and controllers of data and thus it becomes
essential for the general practitioners to understand the range and methods of using the personal
and health records of the EU patients. For this purpose the GP will require introducing several
changes to their practices and to identify the challenges in health care settings which can affect
the integration of their practices and new legislation (Lovell and Foy, 2018). To make the data
sharing fair and cost effective GP will also need to assess their practices so that legal aspects are
not violated and necessary changes can be made to health care practices.
Apart from the GDPR UK also has data protect act which aims at assuring the privacy of
user data. The user data may consist of their contact details, account details and biometric
information. The data protection act consist of data regulations which are applicable to UK only
while contrary to this GDPR has broader aspect and is applicable to all nations of European
3

Union. Data protection act pertains information limited to identification of an individual while
contrary to the new regulation will also explore the genetic information, location, identification
marks as well as other biological parameters. The earlier data protection act did not have much
control and monitoring over the data used by general practitioners and healthcare services.
However, the new GDPR act will regulate the practices of GP and the way in which they store,
use and provide the data of service users.
4

2 AIMS AND OBJECTIVES
The key aim and objective of the study are as follows:
Aim
To analyse and propose solutions regarding impact of new GDPR regulation for practices
of GP.
Objectives:
● To analyse the implications of GDPR regulations on GP
● To evaluate the impact of GDPR on health services and patients.
● To evaluate the possible actions and solutions in response to GDPR in health care
practices of GP.
● To recommend the appropriate solutions for GP's for meeting GDPR Regulations.
● To reflect upon the impact and proposed solutions for GDPR.
5

3 LITERATURE REVIEW
1 GDPR regulations
GDPR provides the data protection to the personal details and sensitive data of the
individuals. According to Goddard, (2017) the GP holds the sensitive and personal health records
of the patients and thus the regulation needs compliance in the services provided by GP. The
most significant change incorporated by the regulation is that it has transformed and widen the
role of general practitioners as data controllers. The data defined as the personal information in
GDPR includes personal information such as name, IP address and NHS number as well as the
special category data such as health status and health records of the individuals.
It has been suggested from several studies that GDPR compliance need to be
demonstrated within health care setting and thus several processes must be incorporated within
care settings. Sousa and et.al., (2018) stated that with the new regulation GP will be required to
maintain updated records along with the effective data protection policies. Data protection
officers have become mandatory so that practices of GP can be made more accurate and reliable.
The regulation aims at encouraging the safe and easy flow the sensitive data of individuals.
GDPR also ensure that general practices does not impose any kind of fees or the financial
restrictions on patients for providing access to the health records. It has been analysed from prior
studies that general practitioners does not consider the security breaches or the database related
issue seriously. Thus, the regulation bounds general practitioners to essentially monitor the data
security and access.
As per the view of Rumbold and Pierscionek, (2017) the regulation aims at ensuring the
privacy of people but it must be assured that privacy notice must have lawful basis so that
information can be processed accurately and safely. The regulation also emphasis that each of
the patient must have information that how their personal details are used by the GP. Thus, it
becomes necessary for GP to have informed consent from the patients regarding the use of their
personal information. The regulation highlights the need of increasing accountability of GP and
to develop a more effective governance network for the data protection.
6

2 Implications of GDPR on practices of general practitioners
In the view of Otto, (2018) GDPR will have critical impact on the existing policies and
practices followed by GP. It has been also analysed that general practitioners also use and
process the details of their patients with different agencies such as national health agencies or the
other organisations aiming at conducting health researches or improving the health outcomes.
Lindgren, (2016) stated that GDPR prepares guideline for the GP so that are accountable
and answerable that how their actions or using data is for the public welfare and does not cause
any harm to the privacy and identity of the individual. Prior to the sharing of data GP must
inform their patients that how they can resolve the issue. The data processing practices followed
by general practitioners are followed by principles such as accuracy, accountability, integrity,
confidentiality and transparency. With the implementation of GDPR in clinical settings GP are
regularly monitored that data is maintained and stored in a way and for the period it is necessary
and legal.
According to Chassang, (2017) GDPR has not only influenced the practices of GP but
has also explored to determine and implement suitable organisational and technical
measurements for protecting unauthorised and unlawful data processing. Another important
implication of GDPR is that along with the authorised access of data GP are also liable to have
concern for the destruction and accidental loss of data. Since general practitioners have access
and control to genetic and biological information it becomes mandatory for GP to ensure that
their care settings are also capable enough to prevent such accidental loss of data.
3 Impact of GDPR regulation for patients and health care services
According to GDPR Information pack, (2019) the key objective of GDPR is to provide
individual more authority and control over their personal data. Thus, patients have right to deny
the sharing of their records with external agencies or other individuals. However, this can have
serious implications for health professions as deletion of health records can have serious
concerns for patients as well as for communities. For instance the patient suffering from highly
contagious disease like HIV may prohibit GP to keep their data, however this can be harmful for
the other people as their vulnerability becomes high to get infected.
As per the view of Wachter, Mittelstadt and Floridi, (2017) GDPR will also be beneficial
for the patients as it will help GP to enhance the quality of services. Since practitioners will have
7

records of patient's medical history it will be possible for them to provide more accurate health
care services on the basis of their medical records. The proper management of data also helps
national health agencies to analyse the data and to formulate suitable health improvement
strategies.
4. Possible actions and solutions in response to GDPR
The foremost change identified is the necessity of having data protection officer (DPO).
The GP service providers are authorised and accountable to public and thus they must have DPO
so that expertise knowledge and efficiency regarding data protection policies and law can be
integrated within GP practices. Carey, (2018) stated that developing systems and organisational
culture for secure management of data can be challenging in term of cost and skills. Thus, GP
must provide suitable training to their staff members so that they can integrate the new
regulations in their practices (Rumbold and Pierscionek, 2017). The staff members are
accountable to DPO and thus they must be trained enough so that they can effectively report the
data management concerns. Through training programs and regular monitoring DPO will assure
that each and every GP and staff member of the organisation is well aware of the type and nature
of information they are storing or accessing. After the implementation of GDPR there will be
regular tracking and monitoring of the information which is stored in the user systems.
8

4 PROPOSED ACTION
In order to solve the implications of GDPR training is necessary for GP so that they can
assure that data of their patients is shared and stored in lawful manner and their privacy and
security is not threatened. To manage the implications of GDPR health service providers must
initiate training programs. The training programs will help GP to understand the concepts and
principles related to GDPR. It will also help them to recognise the current organisational
resources and the identification of most appropriate data processing and controlling tools
(Hertzberg, 2018).
The practitioners must provide training to other members so that organisational needs and
data flow can be mapped and GDPR regulations can be effectively implemented. Another crucial
advantage by incorporating such training plans into the action is that it helps GP to deal with the
GDPR compliance is to develop suitable policies for the data monitoring, transfer and actions so
that all perspectives of GDPR can be integrated within practices. For providing more effective
solutions to incorporate changes of GDPR it is also necessary that in training programs GP must
be provided information regarding gap between existing data policies and the new GDPR policy.
It will help to understand the necessary changes to incorporate in the practice. Training program
will also assist in formulating policies for regular monitoring of the data and handling of health
service providers so that GDPR goals can be successfully achieved.
9

5 EVALUATION OF ACTIONS AND REFLECTION ON PROCESS
The actions discussed in above for the issue can be considered as effective. Since most of
the GP as well as other health professionals may not be aware of the actual implications of
GDPR. Thus, the action to make them aware with the regulation is mandatory and highly
effective. However, the general practitioners does not effectively implement the new and
improved data processing system without assuring the suitable analysis of the organisation. The
training programs can provide complete guidance on implementing and utilisation of such
system.
The existing data management system of the health care setting are not sufficient for such
type of controlled processing (Phillips, 2018). Thus, in such situation it can be said that the
assessment of the organisational resources can help GP to perform the current evaluation and to
suggest the necessary changes in the practices. GDPR also consist of extended version of data
protection policy thus there are several principles which are already incorporated by the
practitioners. The training programs will help to understand the impact and participation of every
GP within organisation.
The development of new policies in compliance with the data protection is also one of the
effective action. The data breach and unauthorised practices cannot be avoided without support
and cooperation from the other service providers. Thus, choice of providing training to GP and
other professionals is also beneficial (Lambrinoudakis, 2018). However, the training may not
proven to be effective until the professional skill of individuals are not identified. Thus, for
improving the efficiency of training session GP must also assure that the training and
development programs are developed which helps to improve the professional capability of the
individuals.
However, the current policies and training programs does not incorporate any training
schemes which makes GP efficient in term of data management and processing skills. The
management must communicate with the service users, general practitioners and other
stakeholders so that each and every individual can become aware of the ongoing development
and improvement process. Further the suggested actions does not consider the system efficiency
and technological advancements which can influence the data privacy and role of users in
maintaining the integrity of data.
10

For instance the consent of patients is obtained from the online form but there are
possibilities that some service users such as minors or the individuals suffering with critical
diseases may not favour the process (Tikkinen-Piri, Rohunen and Markkula, 2018). Thus, GP
must also develop policies which can help to overcome such crisis. Within training programs
practitioners and employees must be trained so that they can manage the online records and
system. The proposed actions also consider the legal perspective of the regulation. However, the
data processing and management may give rise to conflict between GP and the service users.
Hence, it is also suggested that actions must also include the suitable policies for the conflicting
situation.
Within health care profession interest of an individual may collide with the other and thus
it depends upon GP or the patient to decide that how data must be shared and processed. Such
type of conflicting situations occur when service users are not willing to share their records
(Wilkinson, 2018). For dealing with such conflicting aspect action plan including strong
legislative support is highly appropriate. The data mapping used in the implementation is also
significant and integral part of the GDPR regulation as it helps in assessing and monitoring the
ethical and legal flow of data securely and safely.
11

6 REFLECTION
Time management is an important part of conducting any study. However, by improving
and using suitable approaches the time management can be improved and efficiency of the study
outcomes can be encouraged. While conducting the study I tried to follow a well planned
structured so that I can accomplish my tasks on time. Though I experienced difficulties in
analysis and understanding of the issue but gradually I improved my research skills. The study
also helped me to enhance my research capabilities and to explore different aspects associated
with the study topic. Through the report I also understood that what significant changes can be
introduced by data protection regulation. As a part of health care sector the study has helped me
to gain the perspective of patient as well as regulatory authorities towards data protection.
The study has helped to explore the extent up to which data management will change in
health care practices. I also learned the difference between data protection act and GDPR and
that how new act will influence the actions of GP. I have also attached time frame in appendix to
demonstrate the time management used by me to accomplish this project.
12