The GDPR Regulations

RE: The GDPR Regulations

Martin Atkinson — Tue, 19 Dec 2017 16:29:58 GMT

[quote user="Edward Jones"]

[quote user="Martin Atkinson"]

[quote user="Edward Jones"]

Any comments on how CCTV/consultation recording can be made GDPR compliant?

[/quote]Tell them that they're being monitored and ask if they object, then note reply in records?

[/quote]

Something along these lines might work, except opt-in consent has to be obtained and documented. Verbal consent may have to be in response to a script

[/quote]So when you call many insurance companies/big businesses these days, they tell you either directly or by a pre-recorded message that the call may be recorded. You make your decision if you're accepting that by continuing with the phone call or putting the receiver down. How can that be in response to a script now or in the future? Surely my suggestion is just as valid.

I still can't help that some people are overthinking this. The regulations are primarily designed to control the misuse of data by big companies and unscrupulous individuals for use for aggressive marketing/cold calling. I really fail to see how it will really change the way we do things when we are just using it for the benefit of our existing clients or if anyone could really be bothered about a minor innocent transgression. If you're empire building running a high power outfit and are aggressively marketing then perhaps you do need to be reigned in a bit.

I'm certainly not going to be paying anyone for a seminar on the subject!

RE: The GDPR Regulations

Edward Jones — Mon, 18 Dec 2017 12:58:11 GMT

[quote user="J G Wray"]A reply from RCVS:[/quote]

Can I share this elsewhere, please?

[quote user="Martin Atkinson"]

[quote user="Edward Jones"]

Any comments on how CCTV/consultation recording can be made GDPR compliant?

[/quote]Tell them that they're being monitored and ask if they object, then note reply in records?

[/quote]

Something along these lines might work, except opt-in consent has to be obtained and documented. Verbal consent may have to be in response to a script

RE: The GDPR Regulations

Martin Atkinson — Fri, 15 Dec 2017 10:45:52 GMT

[quote user="Edward Jones"]

Any comments on how CCTV/consultation recording can be made GDPR compliant?

[/quote]Tell them that they're being monitored and ask if they object, then note reply in records?

At what point do you ask permission if reception conversation are being monitored or even their movement in and out the surgery with external CCTV? Perhaps a big sign in the waiting room saying everything is being monitored then they can vote with their feet if they don't like this.

RE: The GDPR Regulations

Edward Jones — Fri, 15 Dec 2017 09:06:48 GMT

I know this is everyone's favourite topic, so I thought it deserved a bump

Any comments on how CCTV/consultation recording can be made GDPR compliant?

RE: The GDPR Regulations

J G Wray — Tue, 05 Dec 2017 20:15:40 GMT

The free VPMA GDPR webinar is worth the time. Some on here are going to be daunted by the work required to comply. Pertinent Q&A section at the end

However, no source that I've seen or read is articulating a justification for holding on to a client's financial records more than six years. No PMS that I know has a deletion feature. Ho hum.

RE: The GDPR Regulations

J G Wray — Fri, 24 Nov 2017 16:52:34 GMT

A reply from RCVS:

"..

In relation to how long the RCVS hold data relating to registrants, I can confirm that the Professional Conduct Department retain files for 10 years before destruction, while for other departments this is variable. The RCVS is however currently reviewing its internal policies and practice across the board in anticipation of the implementation of GDPR.

The RCVS does not specify how long veterinary surgeons retain client and clinical records. It is for practices to set their own policy. The RCVS does however advise that practices speak with their professional indemnity insurers about such matters. The RCVS’s best practice advice to registrants regarding the retention of clinical and client records is set out within Chapter 13 of the RCVS’ supporting guidance, specifically 13.14 – 13.18 https://www.rcvs.org.uk/setting-standards/advice-and-guidance/code-of-professional-conduct-for-veterinary-surgeons/supporting-guidance/clinical-and-client-records/ The RCVS is reviewing it supporting guidance as well as internal policies in advance of the GDPR. So further information will be to follow..."

I've followed the link which was revised in Oct 2017:

"..

13. Clinical and client records

Updated 25 October 2017

13.1 Clinical and client records should include details of examination, treatment administered, procedures undertaken, medication prescribed and/or supplied, the results of any diagnostic or laboratory tests (including, for example, radiograph, ultrasound or electrocardiogram images or scans), provisional or confirmed diagnoses, and advice given to the client (whether over the telephone or in person). They should also include outline plans for future treatment or investigations, details of proposed follow-up care or advice, notes of telephone conversations, fee estimates or quotations, consents given or withheld, contact details and any recommendations or discussion about referral or re-direction.

13.2 The utmost care is essential in writing records or recording a client's personal details to ensure that they are clear, accurate and appropriately detailed. Clinical and client records should be objective and factual, and veterinary surgeons and veterinary nurses should avoid making personal observations or assumptions about a client’s motivation, financial circumstances or other matters.

13.3 Ideally, client financial information and any other personal or sensitive information should be recorded separately from clinical records. This is because only relevant clinical information / information in the interests of the treatment of the animal should be provided to colleagues taking over responsibility for a case. It is however acceptable to include a statement in the clinical records that treatment has been limited or declined by the client for financial or other reasons.

RE: The GDPR Regulations

J G Wray — Wed, 22 Nov 2017 11:50:21 GMT

[quote user="Beats"]then start sending your barrage of "YOUR PET'S HEALTH IS AT RISK! Hit reply to remain opted-in to our vital information service for your pet" weekly pester power now [/quote]

Hmmm, that's a bit unsubtle.

I see this as an exercise in cleaning up our Customer data as well. Others, in other industries, who have this issue are looking for a mixed approach with technology, Email/SMS taking the strain of contact, but there's the problem of recording the opt in or lack of response, which can no longer be regarded as a tacit acceptance. Lack of response may be due to a lack of willingness to respond, or poor customer data and poor contact as a consequence, or poor contact where there are problems with the technology.

The recording of opt in can also be challenged and although PMS these days have a tick box accepting marketing materials, it appears that running a report as to when this was ticked (opt in) and that there was consent is much more difficult.

Has anyone on this forum got a plan from their PMS providers as to how to set about this?

RE: The GDPR Regulations

mariette asselbergs — Wed, 22 Nov 2017 00:32:37 GMT

Maybe a bit of a sideline but a similar issue re the medical world.

Dignity in dying published a report about the hurdles people have to take to be able to go to Dignitas for euthanasia. One problem was that you need your medical records with diagnosis and prognosis. One of the people interviewed told that his GP kept insisting he wanted to know what he needed his records and results for. When patient finally gave in and told him the reason, the GP refused and said he needed to consult his ethical and legal committee. The committee subsequently ruled that it was unethical and illegal to provide patient's medical records and results to euthanasia doctors in countries where euthanasia is legal (Dignitas in this case). I found this profoundly shocking.

Mariette

RE: The GDPR Regulations

Beats — Mon, 20 Nov 2017 19:46:42 GMT

[quote user="J G Wray"]and..... by March 2018 you will need to have systems and proof that clients have opted in to these services[/quote]

then start sending your barrage of "YOUR PET'S HEALTH IS AT RISK! Hit reply to remain opted-in to our vital information service for your pet" weekly pester power now

RE: The GDPR Regulations

J G Wray — Mon, 20 Nov 2017 16:34:06 GMT

[quote user="robloxley"]and you can send SMS or emails, can also do recalls for other things beyond just vaccination[/quote]

and..... by March 2018 you will need to have systems and proof that clients have opted in to these services

RE: The GDPR Regulations

Rob Loxley — Mon, 20 Nov 2017 13:28:25 GMT

[quote user="Thomas Johnson"]Definitely a task made much easier by computers.[/quote]

and you can send SMS or emails, can also do recalls for other things beyond just vaccination

RE: The GDPR Regulations

Thomas Johnson — Mon, 20 Nov 2017 09:27:04 GMT

[quote user="George Cooper"]

Regarding "reminders" for things.....we used to ask the client to write their own address on the front of the postcard or envelope for their new reminder for that product/service and then stored the thing in the appropriate box for the appropriate month.

[/quote]

Ah yes, the days of writing the reminder for the following year when the vaccine was given, filing it away for 11 months, and then having to check through them all before sending to make sure the animal wasn't dead and the owner hadn't moved. Definitely a task made much easier by computers.

RE: The GDPR Regulations

George Cooper — Sun, 19 Nov 2017 11:45:08 GMT

RE: The GDPR Regulations

Martin Atkinson — Fri, 17 Nov 2017 10:07:09 GMT

[quote user="Bob Russell"] I have taken up one of these offers and a company have put a lot of effort into reaching the conclusion that I was never mug enough to take out PPI. Did it just to get them to waste a bit of time![/quote]I tell the ambulance chasers that I am very concerned and that my case is very complicated so before they take it on they should refer to the the case of Arkell v Pressdram 1971.

RE: The GDPR Regulations

Bob Russell — Fri, 17 Nov 2017 09:59:10 GMT

The issue is not really what we do (and are allowed to do) now but what will be the case next year when new and tougher rules are brought in.

Increased controls are coming and there may have to be changes in the level of consent required before there is any contact with clients. It may just result in a consent form being completed.

Not that much of a surprise with all the junk phone calls and text messages being thrown at people. BT intercepted over 120 junk calls to our home number last month alone. Thankfully this has pretty much ended the stream of messages left about PPI, boilers and insulation.

I have taken up one of these offers and a company have put a lot of effort into reaching the conclusion that I was never mug enough to take out PPI. Did it just to get them to waste a bit of time!

RE: The GDPR Regulations

J G Wray — Fri, 17 Nov 2017 08:01:14 GMT

Response from RCVS, boy, I wish I could say this sort of thing:

"..

Dear Dr Wray,

Ref: 11.17-C164

Thank you for your email, which has been passed on to the Standards & Advice team.

We are currently receiving a high number of enquiries and are working to capacity – a member of the team will get back to you as soon as possible. Thank you in advance for your patience...."

RE: The GDPR Regulations

Martin Atkinson — Thu, 16 Nov 2017 08:51:58 GMT

[quote user="robloxley"]Maybe the time to think about it is now: "so you've had fluffy's booster today, are you happy for us to send you a reminder in a year's time; and in 3 months for worming, and in a month for flea treatment"?[/quote]Which is exactly what we do plus 6 months for a free dental check post and give them a choice of post, SMS or email only I don't so much as ask as tell them we will.

I don't recall once in my career anyone complaining they've been sent a reminder but plenty have when they didn't get one, either through oversight or PMS failure.

RE: The GDPR Regulations

Rob Loxley — Wed, 15 Nov 2017 21:17:39 GMT

[quote user="Bob Russell"]

As I understand it there will be no inferred consent under the new regulations. It will be compulsory.

I will worry about it next year!!

[/quote]

Maybe the time to think about it is now: "so you've had fluffy's booster today, are you happy for us to send you a reminder in a year's time; and in 3 months for worming, and in a month for flea treatment"?

RE: The GDPR Regulations

Iain Richards — Wed, 15 Nov 2017 18:24:12 GMT

It would be good if BVA/RCVS were to be able to confirm with the ICO that sending client records is not an infrongment of the regs. Even without this, prosecution would not be in anyone's interest.

RE: The GDPR Regulations

Bob Russell — Wed, 15 Nov 2017 17:11:40 GMT

Our accountants and our bookkeeper are both of the impression that much of the contact with clients by email, letter, SMS etc comes under the mantle of both marketing and the data protection regulations.

Just because it makes sense to us does not make it the case with the authorities and ultimately the courts. I suspect the data protection regulators want the £35 a year from everybody!

RE: The GDPR Regulations

J G Wray — Wed, 15 Nov 2017 16:26:04 GMT

[quote user="Martin Atkinson"] I think most of us are probably safe[/quote]

Gently be it said, but we've been here before. It doesn't really matter what you think, it's what others think...

RE: The GDPR Regulations

Martin Atkinson — Wed, 15 Nov 2017 14:48:06 GMT

[quote user="J G Wray"]Interesting, so you send no marketing materials aka reminders, and all clinical notes are free from information about clients, e.g. "client in hospital", or "client away"? If you've got clinical notes free from information about clients then you are probably unique.[/quote]Reminders are not marketing tools they are erm...reminders. The clinical notes, financial records and all other information are subject to current data protection regulations are not available in the public domain or shared with any third parties, sharing with other vets means they still remain safe in a professional environment and it would take Russian state sponsored hackers to access them. I think most of us are probably safe

RE: The GDPR Regulations

Bob Russell — Wed, 15 Nov 2017 14:28:07 GMT

As I understand it there will be no inferred consent under the new regulations. It will be compulsory.

I will worry about it next year!!

RE: The GDPR Regulations

J G Wray — Wed, 15 Nov 2017 14:26:22 GMT

[quote user="Michael Woodhouse"]I've completed the online tool and it says I don't need to register with them[/quote]

Interesting, so you send no marketing materials aka reminders, and all clinical notes are free from information about clients, e.g. "client in hospital", or "client away"? If you've got clinical notes free from information about clients then you are probably unique.

RE: The GDPR Regulations

Michael Woodhouse — Wed, 15 Nov 2017 14:14:52 GMT

[quote user="J G Wray"]against your registration at ICO[/quote]

I've completed the online tool and it says I don't need to register with them. I would if I had CCTV

We always get verbal consent to send a history.