A CHANGE in the law has given the Information Commissioner new powers to compulsorily audit GP surgeries and other public healthcare organisations to access how they handle personal patient information.
The law which came into effect on 1 February amends the Data Protection Act and allows the Information Commissioner’s Office (ICO)to enter premises without consent to check on compliance with the Act and to review areas including security of data, records management, staff training and data sharing.
Previously, the ICO would only undertake compulsory audits in central government departments and consent was required for audits in the NHS. The new legislation will not apply to any private companies providing NHS services to the public.
Christopher Graham, the Information Commissioner, said: "The Health Service holds some of the most sensitive personal information available, but instead of leading the way in how it looks after that information, the NHS is one of the worst performers. This is a major cause for concern.
“Time and time again we see data breaches caused by poor procedures and insufficient training. It simply isn't good enough.
"We fine these organisations when they get it wrong, but this new power to force our way into the worst performing parts of the health sector will give us a chance to act before a breach happens. It’s a reassuring step for patients."
The ICO has powers to impose monetary penalties, issue undertakings or even launch criminal proceedings against organisations and individuals who fail to protect private data. To date, the ICO has issued fines to NHS organisations totalling £1.3 million.
More details can be found on the ICO website
This page was correct at the time of publication. Any guidance is intended as general guidance for members only. If you are a member and need specific advice relating to your own circumstances, please contact one of our advisers.
Save this article
Save this article to a list of favourite articles which members can access in their account.
Save to library