Thingwall Osteopathy - Data Protection Policy

Information Held

The following information is collected: Patient name, address, date of birth, phone numbers, GP details, medical history, family medical history and case history for treatment carried out at clinic. All information is given by the patient or their carer, parent or legal guardian.

Data Collection

The information collected is sufficient for the purpose of making informed clinical decisions.

Data is collected on the phone (by reception staff or practitioners) to book appointments and take contact details. Medical information is collected by osteopaths at a face to face appointment.

Patient contact details, appointments and clinical records are stored manually.

Data Storage and Disposal

Patient records are stored securely within the clinic.

Records cannot be deleted before statutory requirements for data retention – 8 years or up to 25 years of age for children.

Notes are archived after 2 years. They are then securely stored elsewhere on site.

Notes are destroyed by shredding after 8 years or 25 years of age for children.

Consent

Patient data may also be used for appointment reminders, if requested.

Data Sharing

Information is only shared with other persons with patient’s permission. This would usually be with other health professionals. Patient information is never passed on to other practitioners, persons or companies without consent.

Data would extremely rarely be shared without consent if there was a legal order or in case of serious safety risks.

Data Checks

In June every year a random selection of patient data, approximately equivalent to patient numbers for one month, will be examined and updated as necessary.

Security

Access to paper records is restricted to practitioners and reception staff who have signed a confidentiality agreement.

All electronic data is password protected. Systems are kept updated and antivirus security systems are in place and updated.

Passwords are changed every year.

Data breaches will be detected by observing signs of unauthorised entry to storage areas, monitoring communications or becoming aware of a security breach on the computer system. Data breaches will be investigated and reported to the Information Commissioner’s Office by the appointed person. Patients will be informed if we believe a data breach has occurred.

Patients may contact the Information Commissioner’s Office if they believe a data breach has occurred. Information Commissioner’s Office: 0303 123 1113

Subject Access Requests

All staff know that subject access requests must be responded to within a month and no charge can be made.

Data is only released on receipt of a signed request from patients, or in exceptional circumstances. Any data sharing is detailed in the patient record.

Therapies Other Than Osteopathy

All other therapists at the clinic are responsible for their own records and management of patients’ personal information as per the General Data Protection Regulation.

Please refer to your specific therapist for a privacy statement and for details of how they manage your information.

For further information regarding the storage and processing of your personal data, or if you feel that there is an error in the data we hold, or if you would like us to remove your contact details from our database, please contact the practice manager, Margaret Lavender on 0151 648 6870">0151 648 6870 or via info@wirral-osteopaths.com. Thingwall Osteopathy is registered with the Information Commissioner’s Office, registration number Z6875976 If you feel that Thingwall Osteopaths have not managed your personal information correctly, please contact us, and we shall endeavour to address your concern immediately. You also have the right to object to the Information Commissioner’s Office at www.ico.org.uk/concerns or by phone on 0303 123 1113.