When a facility uses a vendor that handles patient data, the facility remains responsible for knowing how that data is used, what the vendor can access, where it is stored, and what happens to it when the service ends.
So it is important that these details are clear and in writing before any data is handled.
This article is for general awareness and is not legal advice. It is advisable to consult a legal specialist before approving any agreement involving patient data.
What is the vendor's role in processing the data?
Each party's role must be clearly defined. If the vendor handles the data on the facility's behalf and under its instructions, that must be clearly reflected in the agreement that governs the relationship between them.
Is there a data processing agreement?
It is important to have an agreement that sets out the data the vendor may handle, the purpose it is used for, the limits on access to it, and what happens to it when the contractual relationship ends.
Ideally, these details are clear before any real data is processed.
Where is the data hosted?
The name of the cloud provider alone does not show where the data is. It is important to know the country the data is hosted in, and whether any part of the processing, or any sub-processor, handles it from outside the Kingdom.
What data is collected?
The scope of the data must be proportionate to the service provided. For an enquiry and booking service, for example, the need may be limited to the name, contact number, service requested, appointment details and consent record.
For any additional data, the reason for collecting and using it must be clear.
Does the vendor need access to the clinical file?
Enquiry and booking services do not necessarily require access to the patient's medical history or full clinical file.
If the service does require this kind of access, it is important to know why, the scope of the data required, and the permissions the vendor will be given.
How are medical or urgent cases handled?
If the service uses automation or AI to communicate with patients, the path for medical and urgent cases must be clear.
These cases need to be referred to the facility's relevant team, rather than being given an automated diagnosis or medical consultation.
What happens when a data incident occurs?
The vendor must have a clear process for handling data incidents, one that sets out responsibilities, response steps, and how the facility is notified under the applicable regulatory requirements.
Having this process in place beforehand matters more than defining it after an incident.
Can the data be exported when the service ends?
It is important to know which data the facility can get back, the format it will be exported in, and what happens to the copies the vendor holds after the contractual relationship ends.
Being clear about this process from the start reduces dependence on a single vendor and ensures the facility can reach its data when it needs to.
Is the data used for any other purpose?
It must be clear whether the facility's or patients' data is used for purposes other than providing the service, including training models or sharing it with other parties.
Any additional use of the data must be set out in the relevant agreements and policies.
The review is not only for a new vendor
These questions are not only for before you contract a new service. They can also be used to review the services the facility relies on today.
A long relationship with a vendor does not mean the details of how data is processed are still clear or appropriate, so a periodic review helps confirm the scope of access, the hosting location and how data is retained.
Before sharing patient data, it must be clear who can access it, why, where it is stored, and what happens to it after the service ends.