Email Risk For Doctors

Main Category: IT / Internet / E-mail
Article Date: 28 Jun 2011 - 8:00 PDT

email to a friend   printer friendly   opinions  

Doctors risk a heavy fine and GMC censure if they fail to protect patients' personal information when sending emails.

The use of email may be increasingly commonplace for healthcare professionals, but UK-wide medical defence organisation MDDUS is reminding doctors not to become complacent and to be aware of the pitfalls when sending patient data electronically.

The advice follows a decision earlier this month by the Information Commissioner's Office (ICO) to serve Surrey County Council with a fine of £120,000 - its largest monetary penalty to date - for a serious breach of the Data Protection Act. Sensitive personal information was emailed to the wrong recipients on three separate occasions.

MDDUS senior medical adviser Dr Anthea Martin says doctors have a duty to ensure that any patient records they hold remain secure. She says: "Doctors who fail to protect patient information risk incurring a fine from the ICO. But, in addition, they could also face professional difficulties with the GMC as their guidance clearly states that personal patient information must be effectively protected at all times against improper disclosure.

"With doctors increasingly using email to communicate with patients and colleagues, the risks of confidentiality breaches also increase."

She advises healthcare professionals to familiarise themselves with the policies and procedures issued by their employer or contracting body which are designed to protect patients' privacy.

They must also be mindful of the requirements of the Data Protection Act 1998 which requires information to be fairly and lawfully processed. A serious breach of the Act can result in a complaint to the ICO who have wide-ranging powers, including the ability to impose large fines.

The ICO encourages the use of data encryption where practical - a measure which could prevent cases such as Surrey County Council.

It advises: "Where the information held on a laptop or other portable device could be used to cause an individual damage or distress, in particular where it contains financial or medical 2 information, they should be encrypted. The level of protection provided by the encryption should be reviewed and updated periodically."

The GMC also urges doctors to "always consider whether the use of email services best serves patients' interests" and "whether the benefit of electronic transmission is sufficient to warrant sending insecure, identifiable data."

Source:
MDDUS

• Additional
• References
• Citations