Privacy, sharing and handover of records and measurements

Patient records, prescriptions and optical measurements are personal data and often health data. Access, discussion and sharing should occur only for a genuine work purpose and only by approved routes.

Privacy risks commonly come from small lapses: a screen left open, a prescription handed to the wrong person, an order slip left face-up, a photo sent from a personal phone, or a relative given information without proper authority.

Protect records and measurements

• Use need-to-know access: open records only when required for the task you are doing.
• Reduce public detail: avoid stating prescription details, health information or order issues where others can overhear.
• Protect screens: lock devices and hide identifiable information when not in use.
• Control printouts: collect prescriptions, order slips, referrals and lists promptly.
• Use approved channels: do not use personal phones, personal email, unapproved messaging apps or screenshots to share patient information.
• Check authority: do not assume companions, relatives, employers or online suppliers can receive information without verification.
• Share the minimum: provide only the information needed for the authorised task.

Handover without oversharing

Handover should give the next person enough to act while keeping private details limited. Include the local patient identifier, the task or concern, key facts, what has already been done, what the patient asked or said, and who is responsible for follow-up.

If someone requests a copy of information, treat it according to your local procedure - it may be a subject access request, a routine prescription request, a third-party request or another type of disclosure. Do not improvise.

Subject access and disclosure requests

Records and measurements carry privacy duties. Verify authority, use approved channels and share only the minimum necessary.