Dr Christine Walker
A GP asked about the data protection implications of recording phone calls.
A GP called the advice line to ask about recording outgoing calls at her practice where they recorded all calls, including internal calls between staff. She explained that currently, an automated message to tell the caller their call was being recorded was being given on incoming calls only.
The GP wanted to know if they should also be warning each patient every time the practice made a call out to them. She had also realised that all internal calls between staff were recorded, and that some staff were not aware of this.
The MDU's medico-legal assistant advised that calls will often contain personal data, so any recordings fall under the remit of the Data Protection Act 2018 which is the act implementing the General Data Protection Regulation (GDPR). Article 5 of the GDPR sets out principles relating to processing of personal data, which applies to all calls that are recorded. In summary these are;
- lawfulness, fairness and transparency
- purpose limitation
- data minimisation
- storage limitation
- integrity and confidentiality (security).
Doctors should also ensure that they comply with relevant GMC guidance, Making and using visual and audio recordings of patients. This advises giving patients the information they want about the purpose of recording, and making recordings only where you have appropriate consent or other valid authority for doing so. This applies to all calls with patients – not just incoming calls.
The GMC guidance also advises that recordings must not be made against a patient's wishes and reasonable steps must be made to inform callers that their calls may be recorded. While it is common practice for GP practices to record their incoming calls and give an appropriate warning, it is harder to automate a warning message on outgoing calls and internal calls within the practice.
The adviser confirmed that recording of any call, including internal calls between staff and outgoing calls to patients, is subject to data protection legislation. They suggested that for outgoing calls where an automated message could not be used, the fact the call was to be recorded could be explained when the caller would normally do a brief security check to verify they are speaking to the correct person. In addition, the adviser suggested more general measures to make patients aware of this, such as a statement on the practice website or printed information in the surgery.
The adviser recommended all staff be informed that internal calls are recorded – for example, as part of the induction for new staff – and asked to confirm they understand. They don't need to be told every time a call is made, but should be informed of any change in how the data was processed.
The important principle to remember is that there should be 'no surprises', and that patients and staff should know how their data will be processed and used.
Dr Christine Walker
Christine Walker undertook GP training before choosing a career in paediatrics. Her particular interests were neonatology, paediatric neurology and child development. She became a consultant in community paediatrics, leading a multi-disciplinary child development centre team and she was made a fellow of the Royal College of Paediatrics and Child Health. She has been a medico-legal adviser at the MDU since 2009.
See more by Dr Christine Walker
Laura joined the MDU 11 years ago and worked in several different positions within professional services, including as an advisory department administrator, claims administrator and a CAS senior enquiries administrator. She recently started working as a medico-legal assistant providing advice to members regarding non-clinical cases and supporting the medico-legal advisers where instructed with more complex matters.
See more by Laura Fisk