The Data Protection Act (DPA) makes provisions for regulating the processing of information about living individuals, including obtaining, recording, holding, using, disclosing, adapting, organising, retrieving and destroying information. The DPA recognises the rights of an individual to be told what information is being processed about them and have copies disclosed.

The DPA is based on 8 data protection principles, which can be summarised as follows.

The information:

• Must be processed fairly and lawfully;
• Shall only be obtained and used for one or more specified person purpose and shall not be excessive to that purpose;
• Shall be accurate and kept up to date;
• Shall not be kept for longer than necessary;
• Shall only be processed in accordance with the data subject rights; and
• Shall be kept safe and secure and not transferred beyond the European Economic Area, except to countries with a similar level of the asset protection.

Personal data is defined as information which relates to a living individual, who can be identified from the data either alone or in conjunction with other information held by the data controller.

Dental records are likely to fall within the definition of sensitive personal data under the terms of the DPA. The processing of sensitive personal data must comply with specific conditions set out in Schedule 3 of the Act. If you have explicit consent from the patient to hold and process their data the conditions of Schedule 3 will be met.

How do I know if the patient has provided consent?

A patient in receipt of NHS care must complete form HSC 45 and, in doing so, would authorise disclosure of their records to the HSC Board for the purposes listed below. Where no HSC 45 exists (perhaps lost or missing), then the onus would be on the practice to obtain consent from the patient, or to justify disclosure. The DPA only applies to living subjects, however disclosure of deceased patient records would not present a problem as consent would have been given as above.

The HSC Board is not entitled to see private treatment records, and private records should therefore be redacted.

Disclosure to the HSC Board of records which contain patient identifiable information, may take place lawfully where:

• The HSC Board is investigating and ensuring the quality and provision of the standard of care provided that it is for example in response to a complaint made by or on behalf of the patient;
• The information is needed in relation to the management of dental services;
• The HSC Board considers that there is a serious risk to patient health or safety; and
• Investigations of suspected fraud or any other potential criminal activity take place.

If you have been asked to provide records and you are uncertain whether the patient has provided consent or whether the HSC Board requires the records for a lawful reason, always seek advice before disclosing the records. You should consult one of our dento-legal advisers if you are unsure.