|
The Eight Data Protection Principles as laid down in the 1998 Data Protection Act (along with the Caldicott Principles) must be followed at all times:
-
Data must be processed fairly and lawfully.
-
Personal data shall be obtained only for one or more specific and lawful purposes.
-
Personal data shall be adequate, relevant and not excessive in relation to the purpose(s) for which they are processed.
-
Personal data shall be accurate and where necessary kept up to date.
-
Personal data processed for any purpose(s) shall not be kept for longer than is necessary for that purpose.
-
Personal data shall be processed in accordance with the rights of data subjects under the 1998 Data Protection Act.
-
Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.
-
Personal data shall not be transferred to a country outside the EEA, unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.
|
The Caldicott Principles as laid down by the NHS Executive must also be followed by the Trust:
-
Principle 1 - Justify the purpose(s)
Every proposed use or transfer of patient-identifiable information within or from an organisation should be clearly defined and scrutinised, with continuing uses regularly reviewed by an appropriate guardian.
-
Principle 2 - Don't use patient-identifiable information unless it is absolutely necessary
Patient-identifiable information items should not be used unless there is no alternative.
-
Principle 3 - Use the minimum necessary patient-identifiable information
Where use of patient-identifiable information is considered to be essential, each individual item of information should be justified with the aim of reducing identifiability.
-
Principle 4 - Access to patient-identifiable information should be on a strict need to know basis
Only those individuals who need access to patient-identifiable information should have access to it, and they should only have access to the information items that they need to see.
-
Principle 5 - Everyone should be aware of their responsibilities
Action should be taken to ensure that those handling patient-identifiable information - both clinical and non-clinical staff - are aware of their responsibilities and obligations to respect patient confidentiality.
-
Principle 6 - Understand and comply with the law
Every use of patient-identifiable information must be lawful. Someone in each organisation should be responsible for ensuring that the organisation complies with legal requirements.
Failure to maintain patient information in a confidential manner can result in disciplinary proceedings being taken against a member of staff.
|
| |
|
