<img alt="" src="https://secure.give2hill.com/215766.png" style="display:none;">

< Previous      Next >

GDPR, Patient Medical Record Retention and the Right to Erasure
Cegedim

By Cegedim
On Jun 11, 2018

Read time
1 minutes

GDPR, Patient Medical Record Retention and the Right to Erasure

The GDPR includes a right for an individual to have personal data erased. How does this legislation sit alongside NHS data retention guidelines for general practices?

Under the GDPR data law, individuals can request to have personal data erased. Does this mean you must delete medical records if a patient asks to have their data erased?

The Information Commissioner's Office website contains detailed information about the right to erasure. We recommend you take a look to see a full description of this aspect of the GDPR.

If you don't have time to read the detail, the right to erasure only applies in certain circumstances. Relevant exceptions include processing data that is for:

  1. Medical diagnosis
  2. The provision of health or social care
  3. The management of health or social care systems or services

NHS data retention policy

There are various legal and medical requirements about retention periods for patient data. Standard NHS data retention policy is to keep GP records for at least ten years after death.
The expert view is that the NHS requirements take precedence over the GDPR right to erasure.

More on the GDPR and medical records

The GDPR legislation is complicated, so we're not able to offer you legal advice on the GDPR. To help you understand the changes, you can find a list of relevant resources here.

 

Share this story, Choose your platform

Share on facebook Share on linkedin Share on twitter