Data protection and patient enquiries: what is required of the facility?

From the moment a patient shares their name, their contact number or information related to their enquiry, the facility becomes responsible for handling and protecting that data, even before the enquiry becomes an appointment or reaches any medical system.

This article is for general awareness and is not legal advice. It is advisable to consult a legal specialist on the facility's obligations and its particular circumstances.

The facility remains the data controller

The facility is the party that decides why patient data is collected and how it is used. When an outside vendor is brought in to manage or answer enquiries, the vendor acts as a data processor, within a scope and under instructions set by the facility.

Having another party in the reply process does not transfer the facility's role as controller of the data, so it is important that each party's role and the extent of its access to the data are clear before the service begins.

The data needed to manage an enquiry

Managing a patient's enquiry and booking their appointment does not require collecting everything about their condition. In most cases, the operational data needed is limited to:

1. The name, to identify the patient and communicate with them
2. The contact number, to continue the conversation on the channel in use
3. The service requested, to understand what the patient needs and direct them appropriately
4. The appointment details, once the booking is made
5. The consent record, to document what the patient agreed to and when

This data is different from the information held in the clinical file. When an enquiry includes medical information or a case that needs assessment, it must go to the facility's relevant team rather than being handled in the usual enquiry flow.

What must be clear before data processing begins

When an outside vendor becomes part of how patient data is handled, it is important to document the relationship and the scope of its data handling clearly.

This includes:

• A data processing agreement that sets out the facility's role and the vendor's role
• A clear scope of the data the vendor may access and use
• A clear procedure for handling data leaks or unauthorised access
• A defined policy for retaining and deleting data
• The ability to export the facility's data when needed

Having these details in writing before the service starts makes each party's responsibilities, and the limits of its access to the data, clear.

Where the data is hosted

Where the data is stored is an important part of assessing any service that handles patient data, and so is knowing whether the data, or any part of its processing, moves outside the Kingdom.

Knowing the name of the platform or service provider in use is not enough. The facility must be clear on where the data is hosted and which parties in the service chain may process it.

Consent is tied to purpose

A patient getting in touch to ask about a service does not necessarily mean they agree to their data being used for other purposes.

If the data will later be used for a different purpose, such as marketing messages, that use must be handled separately, under the requirements that apply to it.

The facility must also keep a record showing the consent it obtained, its purpose and when it was recorded, so that it can be referred to when needed.

What should you know before you sign?

Before contracting with any vendor that handles patient enquiry data, 5 things must be clear: each party's role, the data that can be accessed, where it is hosted, how data incidents are handled, and whether the data can be recovered or exported.

Having these points clear from the start helps the facility know how its patients' data is handled, and who can access it, for as long as the service runs.