Spire Healthcare Group Plc · LSE:SPI
Spire Healthcare — Investor Presentation (April 2018)
40 slides from Spire Healthcare's investor presentation, Apr 30, 2018
Slide 1: GDPR: What It Means For You
Version Consultant 3.1 GDPR WHAT IT MEANS FOR YOU 30 April 2018 © Spire Healthcare Limited 2018. Spire Healthcare Limited permits use of this content by consultants with current practising privileges at Spire hospitals (without liability for such use) but by no other person.
Slide 2: Agenda
Agenda • Introduction to GDPR • Your responsibilities • What you need to do for your practice • What you need to do for Spire patients • Action list • Coming from Spire • Questions
Slide 3: GDPR - what and why?
GDPR - what and why? • General Data Protection Regulation plus new UK Data Protection Act Replaces DPA 1998 and modernises DP law Rules on handling, processing and storing data New concepts: accountability, demonstrating and designing compliance New rights for data subjects Contractual req
Slide 4: GDPR: We are all impacted
GDPR We are all impacted the data we leave everywhere we go at work we are accountable for patient data: medical records, billing data, contact data, images, correspondence, CVs Applies equally to Spire and consultants, medical secretaries, other self-employed clinicians, NHS, PMI, other operato
Slide 5: GDPR seeks to create increased consumer trust
In an age of high volume data, GDPR seeks to create increased consumer trust through increased organisational responsibility and evidenced governance
Slide 6: The Core Principles of GDPR
The 7 Core Principles of GDPR Personal data must be: • Processed lawfully, fairly, transparently • Collected for specified, explicit, legitimate purposes • Adequate, relevant and limited to what is necessary • Accurate and up to date • Kept no longer than is necessary • Kept securely • Managed with
Slide 7: Key legal concepts
Key legal concepts Controller a (individual or corporate) person who determines the purpose and means of processing personal data Processor a (individual or corporate) person who processes personal data on behalf of a controller Data subject an individual identifiable by reference to personal data P
Slide 8: Regulator powers
Regulator powers • Greatly increased power for ICO to fine for GDPR breaches • Data controllers and data processors may be liable for breaches and resulting civil claims for compensation • Regulator (ICO) has new powers: audit, restrict data operations • Very clear professional expectations of GMC,
Slide 9: Your responsibilities
| 2> Your responsibilities Spire Healthcare Corkimg after ym.
Slide 10: Self-employed medsecs are data processors
Self-employed medsecs are data processors • Only process data under instruction from the controller • Specific obligations under GDPR e.g. use appropriate security measures maintain record of processing report breaches • Must have written contract containing specified obligations • May be subj
Slide 11: Consultants are data controllers
Consultants are data controllers A controller “determines the purpose and means of processing” • Decides which data to collect and how long to hold it • Interprets or materially alters data, exercises professional judgement or decision-making in relation to data • If you are self-employed you are th
Slide 12: Spire and consultants are joint controllers
Spire and consultants are joint controllers • Often controllers share data and/or jointly determine how it is processed • Spire + consultant = joint controllers of Spire patient data (both process a patient record and share it between them) • An individual can claim/exercise rights against any contr
Slide 13: You are responsible for your private practice
YOU are responsible for your private practice – but we are both responsible for Spire patient data “remember the blue bit”
Slide 14: What you need to do for your practice
What you need to do for your practice
Slide 15: Your private practice – key compliance tasks
Your private practice – 11 key compliance tasks 1. Compliance plan: produce and maintain 2. ICO: register or notify and pay 3. Identify legal bases: for processing personal data 4. Record of Processing: create and include data inventory 5. Privacy Impact Assessment: conduct if needed 6. Contracts: a
Slide 16: You must be able to demonstrate compliance
You must be able to 1/11 demonstrate compliance The law says: “the controller shall be …able to demonstrate that processing is performed in accordance with this Regulation...” • Beware of regulator action or fines for failure to demonstrate compliance – not just when something has gone wrong • Estab
Slide 17: You must pay ICO
2/11 You must pay ICO GDPR removes “registration” requirement…but notify & fee payable to ICO by all controllers (£35 if controller revenue <£632k and paid by DD)
Slide 18: Consultants must have a legal basis for processing
Consultants must have a 3/11 “legal basis” for processing • Private healthcare provision usually justified on basis of contractual relationship with the patient • Healthcare data is now “special category”. Requires additional legal basis for processing (was “sensitive”) Basis usually provision of
Slide 19: Consent for data processing
Consent for data processing GDPR says consent must be a: “clear affirmative act establishing a freely given, specific, informed and unambiguous“ • You must record consents for evidence • Request for consent: obvious, clear, in plain language • Silence, pre-ticked boxes or inactivity not permitted •
Slide 20: You must have a record of processing
You must have a “record 4/11 of processing” You must keep a “record of processing” with specified content (e.g. what, where, why, how, who, how long, security) • Data processors must have one too • Include a data inventory covering your data holdings Spire will help you for Spire patients • Our reco
Slide 21: Privacy Impact Assessments
5/11 Privacy Impact Assessments The law requires controllers to conduct PIAs for high risk operations • “High risk" = to rights and freedoms of individuals e.g. large scale processing of sensitive personal data • See ICO guidelines for conduct of PIAs • Usually conducted on new processes • Spire wil
Slide 22: Contracts
6/11 Contracts Controllers must have written contracts with their third party data processors containing specified contents Examples of third parties: Medsecs not employed by you IT providers (e.g. email, data storage, practice manager e.g. DGL) Dictation company providing typing services Bi
Slide 23: Transferring data outside EEA
Transferring data outside EEA Stronger controls are needed for data transferred or stored outside the EEA. Either: A. Ascertain the country is approved by the ICO B. Verify recipient’s compliance, get contract & include in PN C. Obtain informed patient consent Areas of concern • Use of cloud provide
Slide 24: You may need your own Privacy Notice
You may need your own 7/11 Privacy Notice (PN) You must provide a PN when you first collect data (or soon after you receive data from a third party) • PN contents have a detailed specification • You need to provide patients with your PN if you collect their data before they agree to go to Spire • Af
Slide 25: Data Subject Rights (DSR)
Data Subject Rights (DSR) 8/11 Everyone has these FREE rights Right to be informed Right of access (Subject Access Requests/Medical Records) Right to rectification Right to erasure Right to restrict processing Right to data portability Right to object Rights related to automated deci
Slide 26: DSRs – Spire patients
DSRs – Spire patients Any DSR addressed solely to a consultant are his/her responsibility to manage…. Except a SAR for a medical record • As a joint DC and holder of the single patient record, Spire will continue to respond directly to the patient • Notify Spire Medical Record Department within 2 da
Slide 27: GDPR and your staff
9/11 GDPR and your staff • You may need to update staff contracts to cover GDPR • You should have a privacy notice that tells your staff how you use their data (there’s no small business exemption) • You should train your staff in DP requirements and your DP policies – this can be aligned with medic
Slide 28: A new risk for controllers having data breaches
10/11 A new risk for controllers having data breaches Healthcare has been an area of focus for ICO • Breach: A security breach that leads to the destruction, loss, alteration, disclosure of or access to personal data, even if temporary • Legally obliged to report certain breaches to ICO within 72 ho
Slide 29: What you need to do for Spire Patients
What you need to do to do for Spire Patients
Slide 30: Spire is introducing a Data Sharing Agreement
Spire is introducing a 11/11 Data Sharing Agreement • Mutual obligations for patient data and compliance • Matrix allocates responsibilities between Spire and consultants: each responsible for own operations Solely responsible: security of data on own systems or paper, own billing processes, train
Slide 31: Spire's Data Rules - email policy
Spire’s Data Rules - email policy • Basic admin data can be sent unencrypted to patients who opt to receive emails • Special category data MUST be sent encrypted to patients who opt to receive this data by email • All emails to third parties must be encrypted /secure • Email preferences will be visi
Slide 32: Spire's Data Rules
Spire’s Data Rules • Review the Rules and audit your practice to ensure everyone complies; clinicians, medical secs, DPs. Example Rules: Photography: see rules/new Spire app in pipeline Laptops: must be encrypted Password changes: at least every 3 months Access Control: only those trained in
Slide 33: Spire documents being changed
Spire documents being changed • New Data Sharing Agreement and Responsibility Matrix • New Data Security Rules for GDPR • New Processing contract for Spire medical secretaries • Updated Consultant/Clinical Support Specialist Handbook • Updated NHS Panel and Self-pay T&Cs • Updated Spire GP Engagemen
Slide 34: Action List
Action List Spire Healthcare Corkimg after ym
Slide 35: Action points
Action points 1. Register with ICO 2. Produce a compliance plan 3. Establish legal bases for processing 4. Produce your processing record and data inventory 5. Review Spire’s new documentation 6. Review Privacy Notices: decide if/when to use Spire’s 7. Audit your security: comply with law & Spire Da
Slide 36: Coming from Spire…
| 2> Coming from Spire... Spire Healthcare Corkimg after ym.
Slide 37: Timeline
Timeline Due by Date Spire Documents (Estimated) • GDPR Guidebook • Available • Data Sharing Agreement • Mid May 2018 • Patient Privacy Notices • Available • Model Contract Clauses • Available • Example Record of • 11 May 2018 Processing • Spire’s Updated • 11 May 2018 Documents • Single Patient Rec
Slide 38: Where can you find Spire provided information?
Where can you find Spire provided information? The first major document set will be emailed and available at: www.spirehealthcare.com/gdpr • Further minor updates on web • Final complete set will be emailed For any other queries please contact our mailbox: gdpr@spirehealthcare.com
Slide 39: Useful information / contacts
Useful information / contacts • Spire DPO Officer: gdpr@spirehealthcare.com responsible for monitoring compliance and accountability • UK Data Protection Bill • ICO website • BMA website/GMC website • Information Governance Alliance – NHS Digital • Spire Medsecs can also use Spire intranet
Slide 40: Important
IMPORTANT This presentation provides general information only and should not be relied on as legal advice You should take your own professional advice on your specific circumstances
Spire Healthcare Group — Investor Presentation (April 2018) on 6ix