Obtaining and storing data.
What data is held?
Why is this data held?
Who is the data controller?
Name in organisation or if individual, then you.
How was the data obtained?
Primarily, the data we hold is obtained during face to face consultation with clients. We go through a consultation form with them and discuss their presenting problem, expanding our questions as necessary to understand.
On the original booking, we will obtain a name and phone no by phone of if the booking is through our online system, we will look for date of birth and email address.
Why was the data originally gathered?
Name, phone, email and date of borth are gathered at time of booking to secure booking, letting us kow who is coming in anhow to contact them with reminder text or should we need to cancel due to unforeseen circumstances.
Where is the data stored?
On our computer, we hold client name and our chart no for their records, for accessibility only, especially if internet goes fown or our online system is offline.
On our online booking system, we hold client name, our chart no, address, phone no, email if we have it, medical red flags if any, who referred them if relevant, clients who are related if any
on our paper records, we hold client name, our chart no, address, phone no, medical history and treatment notes, and reports received from client in relation to their condition and any letters we have sent to them or on their behalf at their request.
Browsing data is held by Google Anayltics
How secure is the data; encryption and accessibilty?
We use a cloud-based online booking system to track and take bookings. This has extensice encryption security built into it and has been expanded with the GDPR 2018.
When we are not at the desk, the computer screen is locked and needs a password to access. This password is known to therapists in the clinic only and is recorded in a book that is kept in a locked safe and can only be accessed by clinic owners.
Names, address, phone no, email and date of birth are stored on this booking system, as well as their payment history and appointment schedule.
These and all other details, i.e. medical history, treatment notes, etc. are kept manually in a locked filling cabinet in a locked room. Access to this room is for clinic staff only and access to the filling cabinet is further restricted. The key to the cabinets is kept in the safe and can only be accessed ny clinic owners.
CLient record charts in use each day are kept in a folder that is with the therapist at all times and is not left lying around around in view of a client.
Newly filled out records charts are put in a seperate folder and locked into the filling cabinet at the end of each working day, awaiting processing, at which point they can be filed away with the rest.
Phones and devices used to take calls or access cloud-based online booking systems are kept locked by passwords and not left accessible to unauthorised people.
Is the data shared with 3rd Parties and on what basis?
We use a cloud-based booking system to provide our services. This company books appointments, stores and processes all transactions, emails appointment confirmations, receipts and account statements. Please view their privacy policy.
We also use PayPal, please view their privacy policy.
How long shall the data be retained?
Our insurance providers require us to retain all records for a period of 7 years after the last appointment, or in the case of minors, for 7 years after their 18th birthday.
AMENDING DATA
Amending incorrect data
A change of name, address, phone no, email, doctor, etc, is done by the owner/manager of the clinic. Once the change needed has been brought to their attention directly by a client, or by another therapist on behal of a client, the data will be updated on the online booking system straigh away. Their paper records will be pulled and the update will be made to this file also.
Transferring data
Upon receiving a request from a client to transfer data to another therapist, solicitor, medical professional, the paper records including all medical history and treatment history will be sent by registered post, with no amendments, to the address provided by the client. The client must sign consent to this transfer, which stated the date, the name and address of the recipient and acknowledgemtn of permission to send. This will be kept in place of their original records, with name, date of birth and address until the allocated time has passed, in which case it will be destroyed.
Destroying data
Data will only be destroyed after the allotted time frame as quoted above.
The online booking system can fully delete any details. The client records i question will be archived as per their system and then deleted completely.
The record of client name and chart no. listed on our computer will continue to be listed with a highlighted note indicating the date of its destruction
The paper record will be removed and shredded on site. These are brought home in 2 seperate bags one at a time, to burn in a fire, checking that all paper is properly burned and that nothing is remaining.
https://www.wikihow.com/destroy-sensitve-documents
Obtaining Data and consent to hold data
How is data obtained?
Data breaches
What is a data breach?
A data breach is when our online system has been accessed at the core or if our account has been accessed at our level or if a person has got access to our premises and there is evidence or a risk of data being copied, accessed, destroyed or remived from our premises.
How to identify a data breach.
What to do if there has been a data breach
Fill out a Data Breach incident form asap and let the data controller know, who will then do the following.
Within 72 hours (legal obligation or face a fine) of knowing something has happened, get in touch with the Data Protection Commissioners referring to the Data Breach form.
Consider if clients affected need to be notified (risk of identity theft, card fraud or breach of confidentiality), so that they can take appropriate measures to mitigate the effects to their property, person or reputation. Notifying data subjects is a remidial measure intended to redress the balance and restore some measure of knowledge and control. Let them know who to contact in our organisation for more details.
3rd parties may need to be contacted to help; i.e An Garda Siochana, the financial istitutes
Keep a diary of any data breaches or suspected data breaches