MSG told to improve practices following data sharing errors

Monday 04 November 2024

The Medical Specialist Group (MSG) has been ordered to improve its data protection practices following an investigation by the Office of the Data Protection Authority (ODPA).

The ODPA found that the MSG had failed to comply with the Data Protection (Bailiwick of Guernsey) Law, 2017, specifically regarding the clarity of its data sharing agreements with other healthcare providers.

This came from a complaint lodged by the parents of an MSG patient, who had received incomplete medical records.

The ODPA investigation revealed that a lack of clarity in the joint data processing agreement between the MSG and other healthcare providers hindered the patient's ability to access their full medical history.

"When more than one organisation is using the same information, it must be clear how compliance is dealt with between them," the ODPA announced in it's statement.

"This includes ensuring agreements are in place between these parties which clearly outline the respective responsibilities and expectations of each controller, so that patients/clients understand the processes."

As a result of the investigation, the ODPA has issued an Enforcement Order requiring the MSG to rectify their shortcomings in data protection practices. These actions include improving the clarity and detail of its data sharing agreements to ensure that patients' rights are protected and that they can easily access their personal data.

"It is also important that controllers recognise the Law’s accountability principle, which includes accepting responsibility for their actions and showing a willingness to improve their practices when errors are identified," the ODPA added.

"In this case, MSG readily acknowledged and accepted the deficiencies in their processes and engaged in assurances to undertake corrective action."

The ODPA emphasised the importance of clear and comprehensive data sharing agreements, particularly in healthcare settings where multiple organisations often handle the same patient information.