Audit of adherence to patient confidentiality requirements in radiological practice

Audit of adherence to patient confidentiality requirements in radiological practice, taken from Guidance on maintaining patient confidentiality when using radiology department information systems (Second edition)

Keeping patients’ personal information confidential is a key requirement of the 2018 Data Protection Act (DPA) and European Union’s GDPR. Auditing how your personal practice and that of your workplace complies with the regulations is just as important as auditing your clinical work. The items listed below are possible topics for such an audit and will give you an idea of how compliant you are with the current regulations.

The standard: 

Your place of work should:

1. Have a data protection officer
2. Have a policy on patient confidentiality reflecting the DPA (2018) and GDPR regulations
3. Have readily accessible information leaflets and signs advising patients on how you intend to process their data
4. Obtain explicit consent when patient data is likely to be processed for purposes other than direct care or clinical audit
5. Keep a record of all meetings that involve the display of patient identifiable information (PID)
6. Use anonymised images when teaching (except when teaching those staff directly involved in patient care)
7. Have a log that records all the PID-containing removable media it releases (for example CDs). Records should include the name and designation of the recipient
8. Make sure that staff members are aware of and adhere to the email ‘ten rules to follow when sharing patient information’
9. Log all devices used to create radiology reports remote from the host environment
10. Perform a documented data impact assessment prior to sharing PID with any external organisation.

Suggested number of standards to audit – choose up to six but always include 2 and 3.

Target: 

100% compliance.

Indicators: 

1. Engage with departmental clinical governance officer/lead
2. Ask to see departmental data protection policy(s)
3. Ask to see patient information leaflets and assess their accessibility
4. Ask to see removable media logs
5. Ask radiologists to describe how they use anonymised images when teaching or discussing images with individuals not involved in the direct care of patients
6. Ask to see data impact assessments for instances of image sharing with external organisations.

Data items to be collected: 

The presence or absence of items detailed in "The standard" (above).

Suggested number: 

N/A

Discuss outcomes with local IGO, DPO and Caldicott guardians. Re-audit as appropriate.

1. The Royal College of Radiologists. Guidance on maintaining patient confidentiality when using radiology department information systems. London: The Royal College of Radiologist, 2019.

2. The Royal College of Radiologists. Standards for patient consent particular to radiology, second edition. London: The Royal College of Radiologist, 2012.

3. www.gmc-uk.org/ethical-guidance/ethical-guidance-for-doctors/confidentiality (last accessed 19/5/22).

4. https://www.nhsx.nhs.uk/information-governance/ (last accessed 19/5/22).

Taken from Guidance on maintaining patient confidentiality when using radiology department information systems (Second edition)