Patient Data in Dentistry

Are we treating our patients’ information with the same care we expect to give the patients themselves?

A patient books an appointment online and provides their contact details. They complete a medical history form when they attend the practice. During treatment, the dentist updates their clinical notes and may take an X-ray or photograph. Information might then need to be shared with a dental laboratory, specialist or another healthcare professional.

All of this involves the use of personal data.

Dental practices hold a wide range of information about their patients, from names, addresses and telephone numbers to medical histories, medication information, treatment notes, X-rays and clinical photographs. Information relating to a person’s health is classed as special category data under the UK GDPR and requires additional protection because of its sensitive nature.

Protecting patient information is therefore about much more than keeping the clinical record secure. Practices also need to think about how information is handled during everyday activities, who can access it, where it is stored and what happens when it needs to be shared outside the practice.

The reception desk is part of data protection too

Privacy risks can arise before a patient even enters the treatment room.

Reception areas are busy environments. Staff answer telephone calls, confirm patient details, discuss appointments and communicate with clinicians while other patients may be waiting nearby.

Something as ordinary as discussing a patient’s treatment loudly at reception, leaving a computer screen visible or placing paperwork where others can see it can create a confidentiality issue.

The solution does not have to make reception impractical. Instead, practices should consider privacy when deciding how everyday tasks are carried out.

Computer screens can be positioned away from public view, records should not be left unattended and conversations involving sensitive information should be handled discreetly. Staff should also understand when a discussion needs to take place somewhere more private.

These relatively simple measures can make a meaningful difference to patient confidentiality.

Who can see the patient record?

A dental practice may have dentists, dental nurses, hygienists, therapists, receptionists, practice managers and temporary staff all using the same systems.

That does not necessarily mean everybody should have the same level of access.

Access to personal data should be appropriate to a person’s role and limited to the information they need to carry out their work. Practices should therefore consider whether the permissions within their patient management and other systems properly reflect the responsibilities of different members of staff.

Individual user accounts should also be used where possible rather than shared logins. Apart from improving security, individual accounts can help establish who has accessed or changed information if an issue later needs to be investigated.

Access should also be reviewed when somebody changes role or leaves the practice. Accounts belonging to former members of staff should not remain active unnecessarily.

It is worth remembering that a confidentiality incident does not always involve patient information being sent outside the practice. If a member of staff accesses a patient’s record without a legitimate reason, this can itself raise data protection and confidentiality concerns.

Where do clinical photographs actually end up?

Photographs and digital images are now a routine part of dentistry. They may be used to record a patient’s condition, monitor the progress of treatment, support a referral or communicate with a dental laboratory.

The increased use of mobile phones and tablets makes taking and sharing images much easier, but it can also introduce risks that practices may not immediately consider.

If a device is used to take a clinical photograph, the practice should know where that image is being stored. For example, is it being saved to the device’s photo library? Is that library automatically synchronised with a personal cloud account? Does a copy remain on the device after the photograph has been transferred to the patient’s record?

Practices should have clear procedures covering which devices and applications can be used for clinical photography, how images are transferred and stored, and when copies should be deleted from the original device.

There is also a difference between using a photograph as part of a patient’s clinical care and using the same image for another purpose.

A practice may, for example, want to use before and after photographs on its website, social media pages or other promotional material. An image being available within the patient’s clinical record does not automatically mean it can be used for these purposes.

Where photographs are going to be used beyond the patient’s care, the practice should carefully consider the intended use, what the patient has been told and whether appropriate consent has been obtained and recorded.

Sharing information outside the practice

Dental practices do not work in isolation. Patient information may need to be shared with dental laboratories, specialists, referral centres, NHS bodies and other organisations involved in a patient’s care.

Practices may also use external companies to provide IT systems, cloud services, appointment platforms and other services that involve the processing of personal data.

Before information is shared, it is important to consider what the recipient actually needs.

For example, a dental laboratory may require information to produce an appliance or complete a particular piece of work, but this does not necessarily mean it needs access to the patient’s full clinical history. Sharing only the information that is required helps practices comply with the data minimisation principle and reduces the amount of information exposed if something goes wrong.

How the information is shared should also be considered. Sending information to the correct person does not remove the need to use an appropriate and secure method of communication.

Practices should therefore understand which external organisations have access to patient information, why they receive it and what arrangements are in place to protect that information.

Technology has changed the risk for dental practices

Dental practices increasingly depend on technology.

Appointment systems, digital radiography, cloud-based patient management platforms, online forms and electronic communications can improve efficiency, but they also increase the consequences of poor cyber security.

A compromised email account could expose patient correspondence. Stolen login credentials could provide access to clinical records. Ransomware could prevent staff from accessing information required to provide care.

Cyber security and data protection therefore overlap considerably in a dental environment.

Measures such as multi-factor authentication, secure backups, appropriate encryption, software updates and sensible access controls can reduce these risks. Staff awareness is equally important because phishing emails and other forms of social engineering frequently target people rather than technology.

Practices should also know what to do when something goes wrong.

A personal data breach might involve a cyberattack, but it could equally involve sending an X-ray to the wrong patient, losing paperwork or accidentally disclosing patient information in an email.

The first priority should be to contain and assess the incident. Where a breach is likely to result in a risk to people’s rights and freedoms, notification to the Information Commissioner’s Office is required without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

Retaining and Disposing of information

Dental practices have legitimate reasons for retaining patient records, including clinical, professional and legal requirements. However, this does not mean that every piece of personal information should automatically be kept forever.

Practices should understand what information they hold and have a clear approach to how long different types of records need to be retained, taking account of relevant legal and professional requirements.

It is also important to think beyond the main patient management system. Copies of personal data may exist in emails, scanned documents, photographs, archived files, backups and systems operated by third-party providers.

A documented retention schedule can help a practice take a consistent approach and avoid information simply being retained because nobody has decided when it should be deleted.

When information is no longer required, it should be disposed of securely. This applies to paper records as well as electronic information and devices. The method used should make it appropriately difficult for personal data to be recovered by somebody who is not authorised to access it.

Would your team recognise a patient’s data rights request?

Patients have rights over their personal information, and one of the most familiar in a dental setting is the right of access.

The difficulty is that a request does not have to contain the words “subject access request” to be valid.

A patient may simply ask for the information the practice holds about them or request a copy of their records.

Front line staff therefore need to recognise when an ordinary looking enquiry may actually be an exercise of a data protection right and know who within the practice should deal with it.

Responding may also require more than exporting information from the clinical system. Relevant personal data could exist within emails, correspondence, photographs or other locations.

Requests involving children, representatives or information relating to other individuals can introduce further considerations.

Having an established process before a request arrives can prevent unnecessary delay and reduce the risk of inconsistent responses.

What should dental practices take away from this?

The challenge for dental practices is not simply that they hold sensitive information. It is that the information is continually being used.

It moves between reception and the treatment room, between different members of the dental team, between systems and devices and, where necessary, outside the practice.

That makes good data protection a practical issue rather than a paperwork exercise.

Practices should be able to answer some relatively straightforward questions:

• What personal information do we hold
• Where is it stored
• Who can access it
• Which external organisations receive it
• How is it protected
• How long do we keep it
• What would we do if it were lost, accessed inappropriately or sent to the wrong person

If those questions are difficult to answer, there may be gaps worth addressing.

How can Data Protection People support dental practices?

Data protection requirements can sometimes appear disconnected from the realities of running a busy dental practice. Our role is to make them practical.

Data Protection People can work with dental practices to understand how information is actually being handled and identify proportionate improvements.

This might involve reviewing patient data flows and access arrangements, assessing risks around clinical photography and third-party sharing, reviewing privacy information and supplier agreements, establishing retention schedules, improving breach response procedures or supporting the handling of data subject rights requests.

We can also provide training tailored to the situations dental teams encounter in practice, helping staff understand not only what the rules require but how those requirements apply to their everyday roles.