Data privacy, protection and security

Adam Marsh | March 2022

With respect to privacy and GDPR, as a healthcare provider you are a data controller of personal sensitive data. Dental Audio Notes is a data processor acting on your behalf and instruction.

To demonstrate compliance with data protection laws when using DAN, there are three things you should do:

1. Carry out your due diligence of us, which this article forms part of. We provide links to all the information you need in this article.
2. Confirm the patient’s consent to each recording. You can do this verbally as soon as you start recording.
3. Update your patient privacy information to highlight the use of DAN. We provide example items for you below.

Your due diligence of us

When you implement any new system that handles patient data, you should assess the measures in place to safeguard patient information.

Our policies and governance referenced below provide the guarantees you need for this due diligence. Further, we provide a Data Protection Impact Assessment (DPIA)¹ template with all the relevant information completed to make this process as simple as possible.

Dental Audio Notes is fully compliant with the NHS Data Security and Protection Toolkit², GDPR³ and registered with the ICO⁴. Our privacy policy⁵, data security and protection policy⁶ and supplier governance overview ⁷ are available online.

We partner with CREST⁸ approved security experts⁹ and registered data protection advisors¹⁰ with experience in healthcare data to ensure we, our systems and processes comply with the latest standards and policies related to security and privacy. Our security experts regularly penetration test our systems to identify any vulnerability risks and provide insight on potential enhancements.

We partner with Amazon Web Services¹¹ (AWS) to provide our infrastructure to the highest digital and physical security standards: ISO/IEC 27001¹²; ISO 28000:2007¹³; Cyber Essentials Plus¹⁴; ISO 27017¹⁵; ISO 27018¹⁶; SOC 1/2/3¹⁷.

Only you, and users you authorise, can decrypt DAN data. The Dental Audio Notes team has no access to this data. All data is stored in the UK.

Confirming the patient’s consent to recording

To ensure that your use of DAN is fully compliant you should confirm the patient’s consent for each recording. You can do this verbally as soon as you start recording. We have some examples of how to introduce DAN to a patient before starting the record in our FAQ - how do I introduce DAN to my patients?¹⁸.

After pressing record, open with:

Dentist: “ok [patient name], can you just confirm that you are happy for us to audio record this conversation as part of your dental records?”

Patient: “yes”

You should also note that a recording has been made in your written records. This can be as simple as: "recorded in DAN with verbal consent to form part of the patient record".

Update your patient privacy information

You may wish to update your patient privacy information to highlight the use of DAN.

In your Privacy Policy, update:

• your “What information do we collect” section to include: “audio recordings”
• your “How we obtain information” section to include: “By secure audio recording, with your explicit consent”

Notes