Confidentiality / GDPR questions

[AXCS]

Hi
I have a band 3 admin interview coming up for the nhs and I have a feeling there will be a question about confidentiality and/or GDPR. How would you best answer a question like this?

also any other questions you think will prjsblt be asked please feel free to share!

thanks in advance

@It depends on the question. Just remember “data” can mean a lot of things and should only be “processed” (used) for the intended purpose it was collected for. Sharing is a big no no unless set out in privacy policy e.g. HR system to payroll system.

Also paper records, notes, letters are covered by gdpr rules, it is not just electronic data.

Thank you 🙂

If you Google I'm sure there'll be a useful overview of the principles behind it which would be good to know, but a key principle is consent. Unless there's a legitimate interest you should process (which means doing anything, including reading on a screen) someone's data without their consent.

Thanks all

Be sure to say that you'll follow the NHS policy and ask for guidance if you are ever unsure.

GDPR is all about Personal Data - anything that can identify an individual. So Name, address, email address etc are the obvious ones.

Within the context of your job you will also have access to special category/sensitive personal data - medical history, sexuality, ethnicity.

The general principles are:

• that you should only do with that data what you have permission to do
• you should only share that data with people who have authority to have it
• people have the right to request to see/have amended their own data but there will be an NHS process that they will need to follow to invoke that right
• if you ever think that data has been compromised - left where it shouldn't have been, given to someone it shouldnt have been.... you need to report it as a potential breach. You would follow the NHS process to do that

They may want to know that you understand things like locking your computer before leaving your desk, not leaving forms on your desk that have personal information etc. as well

Read up about Caldicott guidelines. It’s basically about only giving the basic information needed, and to someone who has the right to that information.
Every hospital will have a Caldicott guardian, to manage it.

Thanks all - I had the interview and I got the job :) confidentiality did come up so thanks for the refresher!!

Congratulations.

This is wrong.

You must have a lawful basis for processing. There are 6. If you are processing special category data (eg data relating to health) you need a lawful basis plus an additional condition for processing.