Confidentiality, Security, and Access

Optical records contain sensitive health data that must be protected against unauthorised access, loss, or inappropriate disclosure. Security is both technical and behavioural: robust systems are ineffective if passwords are shared or screens are left unlocked. Patients also have rights to access their records, which need to be handled lawfully and efficiently.^[4][7][1]

Technical and organisational safeguards

• Access control: unique user accounts, least-privilege permissions, two-factor authentication where available, automatic screen locks.^[4][3]
• Secure transmission and storage: encryption in transit and at rest; approved NHSmail/portals for sharing; regular, tested backups.^[5][7]
• Operational discipline: clear desk/screen policies, device identity checks, breach reporting processes, and staff training with records of completion.^[7][8]

[box]Data should be shared on a "minimum necessary" basis for direct care.^[9]

For secondary uses (audit, teaching), it helps to de-identify where possible and document the lawful basis. Safeguarding may justify disclosure without consent; records must show the rationale and who authorised it.^[6][9]

Handling Subject Access Requests (SAR) under UK GDPR

• Verify identity and clarify scope; respond without undue delay and within one month.^[1]
• Provide copies in a commonly used format, including attachments (images, letters), redacting third-party data where appropriate.^[1][6]
• Document the request and actions taken, including the date supplied and any lawful extension or refusal (with reasons).^[7]

Keeping patients informed of progress and providing a contact point for questions helps manage expectations. SARs should not alter the clinical record; any clarifications are best issued as separate explanatory notes, not edits to original entries.^[8][2]

References (numbered in text) Why we include references

1. A guide to subject access, Information Commissioner's Office (ICO) Find (opens in a new tab)
2. Amending patient and service user records, NHS Transformation Directorate (NHS England) Find (opens in a new tab)
3. Multi-factor authentication (MFA) policy, NHS England Digital (2024) Find (opens in a new tab)
4. Principle: B2 Identity and access control, NHS England Digital Find (opens in a new tab)
5. Guidance for sending secure email (including to patients), NHS England Digital (2022) Find (opens in a new tab)
6. Pseudonymisation, Information Commissioner's Office (ICO) Find (opens in a new tab)
7. Data Security and Protection Toolkit (DSPT), NHS England Digital (2025) Find (opens in a new tab)
8. The incident reporting system / responding to incidents guidance, NHS England Digital (Data Security guidance) Find (opens in a new tab)
9. The Caldicott Principles, National Data Guardian / GOV.UK (Published 8 December 2020) Find (opens in a new tab)