Additional care for medical information.
WHY IT IS DIFFERENT
Health data is sensitive, and misuse causes serious harm including discrimination.
WHO HOLDS IT
Clinics and hospitals Insurers Employers, in limited circumstances Wellness and fitness applications
WHAT PROCESSING REQUIRES
A lawful basis plus an additional condition.
WHAT CONDITIONS TYPICALLY APPLY
Explicit consent Provision of healthcare Public health Legal claims
WHAT PROFESSIONAL OBLIGATIONS ADD
Confidentiality duties independent of data protection law.
WHY THAT MATTERS
Both apply, and the stricter governs.
WHAT SECURITY IS EXPECTED
Strong access control, logged Encryption Short retention where possible Careful handling of paper records
WHAT TO BE CAREFUL WITH
Discussing patients where others can hear Records left visible Messaging platforms used for clinical information Photographs on personal devices
WHY MESSAGING SPECIFICALLY
It is convenient, widespread, and frequently unauthorised.
WHAT TO PROVIDE INSTEAD
An approved channel.
WHAT EMPLOYERS SHOULD HOLD
The minimum: fitness for work, adjustments needed.
WHAT THEY SHOULD NOT HOLD
Diagnoses, unless genuinely necessary.
WHAT TO DOCUMENT
The condition relied upon, and access controls.
WHAT TO TAKE ADVICE ON
Any substantial health data processing.
