Data Protection procedures

​

Robust Data protection of personal details and information is a legal requirement for all businesses. As a healthcare company, Harley Street Physiotherapy Ltd also handles sensitive information, which requires a greater legal responsibility to keep it secure.

Anyone handling data while undertaking activities for Harley Street Physiotherapy Ltd. that can identify an individual is acting as a data processor on behalf of the company.

​

Every person within the company whether employed or contracted has a legal responsibility as a data processor to ensure data they are processing remains secure.

​

This document outlines Harley Street Physiotherapy Ltd data protection procedures.

​

Registration

Contact details- name, phone number, and email are taken over the phone, in person or via email, entered directly into PPS, and a registration form is sent for the patient to complete. All further Contact details and information is automatically uploaded to their account.

Patients are informed of links to our privacy policy and options for consent to data processing via their online registration form and appointment emails. Therefore there should be an signed updated registration form for each episode of care if more than 6 months apart.

​

Clinical information

We are a paperless clinic. All paper referrals / reports / patient information/details should be scanned and uploaded to the patients PPS account. Clinical information should be saved where possible into case documents. Or transferred to case documents when a case is opened. Training will be given to company processors unfamiliar with this process.

Once scanned the document should be marked as scanned – returned to the client / shredded or filed in the locked clinic notes cabinet (bottom drawer) for shredding.

​

Cliniko clinical notes should be updated from any temporary hand written clinical notes ( which identify the individual) . These should be uploaded to PPS case documents and case notes amended before shredding the paper copy.

No patient information should be stored on a personal computer hard drive or cloud. Access is available via PPS online software. Be aware that opening documents from Cliniko downloads to the computer so they should be deleted from file and hard drive after access.

Clinical data/ sensitive information

​

Emails

Every employee or contractor will be allocated their own company email address.

Your company email must be password protected and used for all email communications between yourself and patients / third parties or company communications.

​

Company policy is to use Egress secure email when transferring sensitive information such as clinic letters to third parties.

Personal emails should not be used for any communications regarding or to clients or third parties in relation to work undertaken for or through Harley Street Physiotherapy Ltd.

​

Mobile phones

Company mobile phones must be password protected and used for communication with patients via phone, text or email

Personal mobiles phones should not be used. If use is required in exceptional circumstances the phone must be password protected and any patient details must not be stored on the device and deleted immediately after use. The phone should be locked in between use.

 

Computers

Clinic computer should be used. It should be turned off after use and not left unattended when logged in.

It is recommended that the anonymous view is employed in Cliniko when the diary page is open in the clinic room.

Personal computers used to access Clinic practice software Clinic for company activities out of clinic must be password protected and not left unattended when logged in.

​

Patient details/ accounts for Harley Street Physiotherapy clinic users can be accessed via online practice software PPS via a password protected login. Patient details must not be saved to the computer hard drive or personal cloud storage. Any details or documents uploaded to the computer or downloaded from for temporary access should be deleted from the computer file and from the hard drive after use.

Contractors processing patient details in the role of a data Controller due to their own work unrelated to Harley Street Physiotherapy are advised that they should have their own privacy and data protection policies in place and be signed up with the ICO ( Information Commission Office).

​

Payments

We do not manually take card details as we have in clinic & online payment options available or can invoice for BACS payment.

Payments are taken by card in clinic with no need to request or manually document card details.

​
 

Photographs and videos

Verbal Consent should be sought before any photographic or video assessment of individuals. It is recommended that the patients own phone is used where possible.

Written consent should be gained before using media for case studies, social media or marketing. There are consent forms available.

​

Confidentially & consent to use of personal data

Consent regarding data processing is sought from clients through registration forms but should be reviewed / updated at intervals and when appropriate and documented . Via returning patient registration form or in the clients account / clinical notes.

Consent should be sought before discussing individuals cases with third parties.

Contact details should not be shared with third parties verbally or in writing unless consent has been given – eg on referral letters. Documenting updated consent is advised.

Consent to using/ sharing individuals data can be withdrawn by the them at any time and should be documented. Please refer to Harley Street Physiotherapy Ltd privacy policy for exceptions to deleting individuals data.

Patients personal situation should not be discussed with anyone without their prior consent.