YOUR WORKING OUTCOME
Trace a patient journey, check access and suppliers, and assemble a defensible clinical-information evidence pack.
Where to begin
Begin with one typical patient journey: enquiry, booking, assessment, treatment, billing and any onward referral. Use the route to connect clinical confidentiality with the systems and administrative work around care.
Clinic owners, practice managers, clinical leads and privacy teams handling patient information.
Your first working session
Choose the journey
Select a service and list its information types, systems and recipients using roles and categories rather than patient details.
Bring back: A one-page journey map with a responsible owner.
Check who can see what
Ask the system owner to demonstrate the access available to reception, clinicians, billing staff and external support.
Bring back: A dated role-access review with exceptions assigned.
Collect the supplier pack
Gather the EHR, booking, messaging and cloud-provider terms, subprocessor information and support locations.
Bring back: A supplier evidence list showing received and missing items.
Work through the evidence
Follow the patient information
Walk through booking, consultations, payment and referrals with the people doing the work. Include paper forms, exported reports, images, messages, scanned letters and shared mailboxes. Record each purpose and identify where copies are created.
Evidence: Staff walkthrough notes, system list, forms and categories of information.Your output: An activity record and data-flow map that can be reconciled with the actual workflow.What useful evidence might look like
Illustrative: FLOW-03 links the booking form to the clinical record and records the billing export owner.
Separate care from other purposes
Document the Article 6 basis and relevant Article 9 condition for each purpose. Consider the conditions and confidentiality safeguards for health or social care where that route is relied on. Review reminders, research and marketing separately from direct care; treatment consent does not answer every data-protection question.
Evidence: Purpose-specific basis decisions, relevant professional duties, collection screens and patient information.Your output: A basis register and patient-facing notice that match the service.What useful evidence might look like
Illustrative: BASIS-04 records appointment administration separately from optional newsletter marketing.
ICO: current guide to lawful basis (opens in a new tab) · ICO: conditions for special-category processing (opens in a new tab)
Verify clinical-system and supplier controls
Review permissions, leavers, export controls, secure sharing and the arrangements for restoring availability. Confirm each supplier’s role, Article 28 terms where applicable, subcontractors and overseas support. Request evidence proportionate to the sensitivity and consequences.
Evidence: Role matrix, dated access sample, supplier terms, security evidence and location details.Your output: A supplier and access action list with concrete completion evidence.What useful evidence might look like
Illustrative: SUP-02 remains open until the EHR provider identifies the legal entity operating remote support.
ICO: controller responsibilities when using a processor (opens in a new tab) · ICO: required processor contract terms (opens in a new tab) · ICO: international transfer test (opens in a new tab)
Screen changes before they reach patients
Screen new transcription, AI, remote consultation, monitoring and record-sharing features before launch. Describe the actual configuration and who can access outputs. Where a DPIA is required, assess risks to people and verify the mitigations before approval.
Evidence: Project brief, screening decision, system demonstration and advice from relevant clinical and privacy roles.Your output: A recorded launch decision with approved controls or unresolved conditions.What useful evidence might look like
Illustrative: CHANGE-05 records that a proposed recording feature remains disabled pending the assessment.
Make retention operate by record type
Identify clinical and administrative record classes, the retention start event and the applicable source. Check jurisdiction and service context before using NHS England examples. Test how deletion, restrictions and legal holds work in the EHR, email, exports and backups.
Evidence: Approved schedule, source references, supplier deletion capabilities and a test record.Your output: A usable schedule and documented disposal or hold procedure.What useful evidence might look like
Illustrative: RET-07 records a class-specific trigger and why an archived referral is included in the disposal review.
ICO: storage limitation (opens in a new tab) · NHS England: care-records retention schedule (opens in a new tab)
Rehearse a request and an incident
Walk through an access request and a misdirected clinical letter as separate exercises. Check requester authority, third-party material and relevant health-data safeguards. For the incident, test escalation and the distinct regulator and patient-notification decisions without sending a real exercise notification.
Evidence: Exercise notes, named decision roles, search and redaction checklist, incident log.Your output: A tested escalation route and an improvement list supported by the exercise.What useful evidence might look like
Illustrative: EX-02 records that weekend escalation failed and assigns a deputy contact.
ICO: guide to subject access (opens in a new tab) · ICO: data protection exemptions (opens in a new tab) · ICO: personal data breaches guide (opens in a new tab)
Your completed starter pack
- Patient data-flow map and ROPA entries
- Purpose-by-purpose basis and notice review
- Access and supplier evidence log
- DPIA screening and relevant approvals
- Record-specific retention schedule
- Rights and incident exercise findings
When to escalate
- Address immediate patient-safety or safeguarding concerns through the appropriate operational route while data-protection decisions continue.
- Escalate unresolved high DPIA residual risk before the proposed processing begins; internal sign-off does not replace Article 36 consultation where required.
- Use competent clinical input for applicable health-data access safeguards. Do not treat a healthcare label as a blanket reason to withhold information.
- Keep actual clinical records in the organisation’s controlled systems. The site’s templates need evidence references, not patient histories.
Give the open actions an owner.
Use the assessment to organise your findings, then verify the underlying evidence before reporting assurance.
Start your reviewOfficial sources
- ICO: accountability and governance (opens in a new tab)
- ICO: current guide to lawful basis (opens in a new tab)
- ICO: conditions for special-category processing (opens in a new tab)
- ICO: controller responsibilities when using a processor (opens in a new tab)
- ICO: required processor contract terms (opens in a new tab)
- ICO: international transfer test (opens in a new tab)
- ICO: when a DPIA is required (opens in a new tab)
- ICO: storage limitation (opens in a new tab)
- NHS England: care-records retention schedule (opens in a new tab)
- ICO: guide to subject access (opens in a new tab)
- ICO: data protection exemptions (opens in a new tab)
- ICO: personal data breaches guide (opens in a new tab)