The scene

A GP called the advice line to ask about recording outgoing calls at her practice where they recorded all calls, including internal calls between staff. She explained that currently, an automated message to tell the caller their call was being recorded was being given on incoming calls only.

The GP wanted to know if they should also be warning each patient every time the practice made a call out to them. She had also realised that all internal calls between staff were recorded, and that some staff were not aware of this.

MDU advice

The MDU's medico-legal assistant advised that calls will often contain personal data, so any recordings fall under the remit of the Data Protection Act 2018 which is the act implementing the General Data Protection Regulation (GDPR). Article 5 of the GDPR sets out principles relating to processing of personal data, which applies to all calls that are recorded. In summary these are;

• lawfulness, fairness and transparency
• purpose limitation
• data minimisation
• accuracy
• storage limitation
• integrity and confidentiality (security).

Doctors should also ensure that they comply with relevant GMC guidance, Making and using visual and audio recordings of patients. This advises giving patients the information they want about the purpose of recording, and making recordings only where you have appropriate consent or other valid authority for doing so. This applies to all calls with patients – not just incoming calls.

The GMC guidance also advises that recordings must not be made against a patient's wishes and reasonable steps must be made to inform callers that their calls may be recorded. While it is common practice for GP practices to record their incoming calls and give an appropriate warning, it is harder to automate a warning message on outgoing calls and internal calls within the practice.

The adviser confirmed that recording of any call, including internal calls between staff and outgoing calls to patients, is subject to data protection legislation. They suggested that for outgoing calls where an automated message could not be used, the fact the call was to be recorded could be explained when the caller would normally do a brief security check to verify they are speaking to the correct person. In addition, the adviser suggested more general measures to make patients aware of this, such as a statement on the practice website or printed information in the surgery.

The adviser recommended all staff be informed that internal calls are recorded – for example, as part of the induction for new staff – and asked to confirm they understand. They don't need to be told every time a call is made, but should be informed of any change in how the data was processed.

The important principle to remember is that there should be 'no surprises', and that patients and staff should know how their data will be processed and used.