Health data in a clinic: medical records, images and insurers
Nextica Law & Tax implements data protection in dental, aesthetic and multi-specialty clinics, where the data is a special category (art. 9 GDPR): custody of and access to the medical record and its retention periods, impact assessments where the processing requires one, patient photographs and videos, waiting-room CCTV, disclosures to insurers and mutual funds, and responses to patients' access requests.
A patient asks for their full medical record and there are thirty days to provide it. The question is not whether you will: it is whether you know where everything is.
What's included
1. A record of processing activities identifying health data for what it is
special category, with its own legal basis and reinforced measures.
2. A policy for custody, access and retention of medical records by document type, with the minimum periods healthcare rules set.
3. An impact assessment where the processing requires one by its nature, scope or the volume of health data.
4. Specific, separate consent for non-clinical uses
before-and-after photographs, publication on social media and marketing communications.
5. CCTV in the waiting room and common areas, with the information duties and proportionality reviewed.
6. Disclosures to insurers, mutual funds and laboratories, with the legal basis and contract each one requires.
7. A procedure for patient access to their record and for responding to breaches, rehearsed before it is needed.
HEALTH DATA IS A SPECIAL CATEGORY
And that changes the legal basis, the measures and the consequences. These three appear most often in a clinic.
Before-and-after photographs published under the treatment consent
that does not work. An identifiable patient's image is health data, and publishing it requires specific consent for that use, separate from the clinical one and revocable at any time.
art. 9 General Data Protection RegulationAn impact assessment not carried out
large-scale processing of special category data is one of the situations where one is likely required, and in a clinic with volume that condition is met more often than people think.
art. 35 General Data Protection RegulationRetention with no policy
deleting before time is as problematic as keeping things indefinitely 'just in case'. What you do is set a policy by document type, with the minimum periods healthcare rules establish, and be able to explain it if asked.
Law 41/2002 on patient autonomyFrequently asked questions
Can I use a patient's before-and-after photos on social media?
Only with specific consent for that use, separate from the consent to treatment and revocable at any time. A generic consent signed at the first visit does not cover social media publication, and the image of an identifiable patient is health data. On top of that, publishing may fall within healthcare advertising, which in Catalonia has its own rules.
How long must the medical record be kept?
Healthcare legislation sets minimum retention periods running from the discharge of each episode of care, and some documents are kept longer because of their clinical value or because they are affected by a claim. Deleting early is as problematic as keeping everything indefinitely 'just in case': what you do is set a retention policy by document type and apply it, so you can explain it if asked.
Let's talk about your company.
Tell us your situation and we'll reply within 24 working hours.