news and events hero

GDPR – an essential guide for claims handlers

On 25 May 2018 the General Data Protection Regulation (GDPR) will come into force. The GDPR will govern the way that all personal data is processed. It will be accompanied by the Data Protection Act 2018, and other laws relating to how information is handled (for instance, common law confidentiality) will also continue to apply. GDPR is an evolution of the earlier law set out in the Data Protection Act 1998 and many of the principles are similar. However, individuals have enhanced rights, and there are some more onerous obligations on organisations to demonstrate compliance.

What is personal data?

For the purposes of the GDPR, personal data is any information that relates to or is about a living person. It includes facts, opinions, and intentions, in respect of individuals. Examples of personal data include names, addresses, telephone numbers or e-mail addresses, the content of medical records, and CCTV footage. There is a sub-category of personal data known as special category data. This category of data is considered to be more sensitive and examples include information relating to race, ethnicity, sexual orientation, political or religious beliefs, health (including genetics) and biometrics.  This is similar to the existing concept of ‘sensitive personal data’

What is processing?

This is defined as

“…any operation or set of operations which is performed on personal data … such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.”

In other words doing anything with personal data is ‘processing’ it.

Does it affect me?

Yes. The GDPR will apply to all organisations in the European Union responsible for processing personal data and will impose new requirements on the way personal data is processed and held. We expect the provisions of the GDPR will remain in force beyond the UK’s anticipated departure from the European Union in 2019.

For those acting in a claims-handling capacity within NHS Trusts, you will be dealing with special category data on a daily basis. The most obvious example of this will be disclosure of patient medical records which constitute ‘special category data.’ Therefore anyone acting in a claims-handling capacity will be subject to the provisions of GDPR and will need to demonstrate their compliance with those provisions.

What do I need to consider?

The GDPR provides six key principles which must normally be adhered to when processing personal data:

  1. Processing of data is lawful, fair and transparent
  2. Processing is for a specified, explicit and legitimate purpose
  3. Processing is adequate, relevant and limited to what is necessary
  4. Personal data should be accurate
  5. Personal data should not be kept for longer than necessary
  6. Processing should ensure the data is kept confidential, safe and secure.

There are some exemptions from the obligations to be fair and transparent where data is being processed for the purposes of establishing, exercising or defending legal rights. This largely reflects the existing law.

As well as acting in accordance with the six principles above, you need to be able to justify the use of data. From a claims-handling perspective the processing of personal data, such as medical records, could be justified on the following grounds:

  1. Processing is necessary for the purposes of the management of healthcare services.
  2. Processing of the data is necessary for the establishment, exercise or defence of legal claims;
  3. Processing of the data is necessary to protect the vital interests of the patient where the patient is physically or legally incapable of giving consent;

In other words, you do not need consent for handling personal data for the purposes of GDPR (and particularly in the case of legal claims). However, in appropriate circumstances having patient authority is fairer and more respectful, and also helps you to comply with other requirements, such as common law confidentiality.

How will GDPR affect me?

The GDPR will provide enhanced individual rights to patients in respect of their access to data and how it can processed. For claims handlers the most important points are:

More broadly, data controllers are required to be able to ‘demonstrate compliance’ with the GDPR. This means having systems, policies, processes and training in place to ensure that everyone that interacts with personal data knows how it should be used. Your organisation should have a ‘Data Protection Officer’ in place and they are a point of contact and advice. The organisation should maintain a (general) record of its processing activities and this should include the work of the legal services and records departments. Obligations to report incidents (which are already mandatory for NHS organisations under the Information Governance Incident Reporting framework) are put on a statutory footing.

What is the most important thing to get right?

We would always advocate the security of personal data as a key priority. The use of privacy enhancing technology (such as encryption of CDs of records), and taking care that the right information is seen by the right people (for instance carefully reviewing records prior to disclosure to ensure that the correct information is being disclosed).

What are the penalties for non-compliance?

There are a range of enforcement options available to the Information Commissioner to investigate and take action if processing does not comply with the law. As is well known, financial penalties under the GDPR are up to a maximum of €20 million or 4% of turnover, but there are many other enforcement options available. Additionally, individuals can bring a legal claim on their own account if they believe their data protection rights have been infringed.

Download page as PDF