Handling personal data is a daily occurrence in veterinary practices. Data protection regulation must be adhered to and having stringent processes and procedures in place to demonstrate compliance are a must. These processes and procedures will be important in the event of any customer complaints, a business sale or investment or reorganisation, as well as in the event of an Information Commissioner’s Office (ICO) investigation.
Handling “personal data”
As a reminder, “personal data” is any animal and client-related information, including notes, contact details, telephone numbers, IP addresses or payment information, that identifies a living (human) individual. While animal treatment records are not themselves personal data, if they link back to a (human) client, with names and addresses, or email contact details and phone numbers, then the animal treatment records also become personal data.
While animal treatment records are not themselves personal data, if they link back to a (human) client, with names and addresses, or email contact details and phone numbers, then the animal treatment records also become personal data
Becoming data compliant
Veterinary practices will need to consider these steps to become compliant:
- Register as a data controller with the ICO: usually, a veterinary practice will be a data controller collecting and processing personal data on their own behalf. Registration is not expensive and can be completed online on the ICO website
- Appoint someone who is responsible for overall data protection management in the veterinary practice. This should be someone relatively senior who is able to advise on decision making, and has a good understanding of data protection or has access to advisers for additional support
- Prepare a privacy policy usually for publication on the veterinary practice website. The privacy policy should give information about the types of personal data collected and processed by the business, what it is used for, how long it is retained and whether the data is shared. To establish all the information, you will need to conduct a “data audit”, which includes:
- Identifying all the personal data coming into the practice. This may be clients calling the practice to make an appointment for the first time, registering their pets and themselves as a new client, or it may be the notes relating to their dog’s treatment and payment by insurance. Any information that links to a client’s name or client ID at the practice becomes personal data, and you should also carefully consider how financial (payment) data is treated
- Considering what uses are made of the personal data, as well as where it is stored (are all records electronic or are there paper records kept also?) and how long you need to keep the records for
- Considering whether the personal data is shared with any other parties – for example, laboratories or referrals, electronic payment systems, other business networks or partners
- Create an internal record of all processing undertaken by the practice (called a “ROPA” or record of processing activities) which is often easiest in table form and should record all the information discovered during the data audit. The ROPA should also include your staff personal data (whether they are employees or independent contractors or consultants). The ROPA should contain information as to where the servers are located if the personal data is stored electronically. The servers should ideally be located in the United Kingdom or the European Economic Area, and United States-based storage should be avoided
- Create a staff privacy notice so that your staff have information as to how their personal data is treated by their employer
- Ensure training is given to staff so that they can take the steps necessary to protect personal data they manage in their role at the veterinary practice. This training should be recorded in an internal training record and retained. Additionally, top-up or refresher training should be provided annually to ensure that practices and procedures remain up to date
- Set up processes (and record policies and keep records) for management of data subject access requests and data breaches
- Liaise with IT support to ensure that electronic records are securely kept, protected from unjustified access and regularly “pen tested” to avoid hacking or accidental breaches. Security will need to be kept up to date on all other paper records also. Further, practices should ensure that different databases are kept separately and only the staff responsible for that area should be able to access them. For example, this means that staff records should be kept safely and confidentially and only the staff involved in HR management should be able to access such records. Client or payment records should be separate from the marketing list that the practice may have
- Consider contractual relationships and any exchange of personal data that takes place. If there is a regular exchange of personal data – for example, referrals of clients or perhaps an outsourced staff payroll service – then there should be a data processing or a data sharing agreement put in place (depending on whether both parties are independent data controllers or whether one is a data controller and the other is a data processor)
- Be prepared to review and update: data protection law is evolving and changing, often technologically driven. Regular reviews should include inspecting the procedures, annually updating data subject records (eg to get rid of out-of-date records and to correct records that may be incorrect), revising training, updating IT security and checking that the ROPA is still accurate and if not, doing a new data audit.
Ensure training is given to staff so that they can take the steps necessary to protect personal data they manage in their role at the veterinary practice
Summary
Data is an essential part of practice life and being data compliant is a legal requirement for business, requiring regular reviewing and updating of systems and processes. Practices or individuals with any uncertainties around how they handle client data should take the time to undertake a data audit to ensure their compliance with any legislation that may affect them.
