GDPR and Data Protection in Care Homes: Records, Requests and Breaches

GDPR and Data Protection in Care Homes: Records, Requests and Breaches

What UK GDPR requires of a care home in daily practice: the ICO fee, special category data, sharing information with families, subject access requests, how long to keep records, security standards and what to do if there is a breach.

Care homes must follow UK GDPR and the Data Protection Act 2018 when they handle residents’ personal data, most of which is health information, a “special category” needing extra protection. In practice that means paying the ICO data protection fee unless exempt, restricting access to records, recording the legal basis before sharing information with families, answering subject access requests within one calendar month, keeping care records for at least the period in the NHS Records Management Code (8 years for adult social care records), and reporting qualifying breaches to the ICO within 72 hours where feasible.

Every care plan, medication record and daily note in a care home is personal data, and most of it is health data. CQC’s own guidance says all organisations that collect or use personal data must comply with GDPR, and that services should also meet the National Data Guardian’s data security standards (CQC: Check the way you handle personal information meets the right standards). This guide turns those requirements into day-to-day practice for a care home or care provider, with each rule taken from the ICO, CQC or NHS England.

The Seven UK GDPR Principles Applied to a Care Home

The ICO’s guide to the data protection principles sets out seven principles (ICO: Data protection principles). CQC’s guidance gives examples of what GDPR expects, including processing the least possible personal data, keeping it only as long as needed, assessing lawfulness, protecting data, respecting people’s rights, being transparent and reporting security breaches. Here is how the principles look in a care setting (the practice examples are our suggestions):

ICO Registration and the Data Protection Fee

Under the Data Protection (Charges and Information) Regulations 2018, organisations, including sole traders, that use personal information must pay a data protection fee unless they are exempt. The ICO sets three tiers (ICO: Guide to the data protection fee):

The ICO says charities that are not otherwise exempt pay only the tier 1 fee, and paying by direct debit gives a £5 discount. Staff numbers are the average over your financial year and include employees, workers, office holders and partners, with each part-timer counted as one. The ICO has an online self-assessment to check what applies to you. Fees are set by Parliament, so check the ICO page for the current figures.

Special Category Data: Why Care Records Need Extra Care

Health data is special category data under UK GDPR, alongside information such as religious beliefs and, in some cases, ethnicity or sexual orientation (ICO: What is special category data?). To process it you need both a lawful basis under Article 6 and a separate condition under Article 9. Because care plans, medication records and daily notes are largely health data, a care home carries a risk profile closer to a healthcare provider than a typical small business. In practice:

• Limit access to records to staff who need them for their role. CQC’s guidance lists this among the National Data Guardian’s standards.
• Protect paper records (locked storage, controlled access) as well as digital ones (passwords, encryption, supported software).
• Keep your privacy notice and records of processing up to date.

Sharing Information With Family Members

Being next of kin does not automatically give someone the right to see a resident’s records. Record the basis before you share:

Keep a copy of any authority you have checked (GOV.UK: Lasting power of attorney), and note the date and what was shared. An LPA is about decisions, so share what is needed for the decision, not everything.

Subject Access Requests: Residents, Staff and Families

People can ask what personal information you hold about them. The ICO’s small organisation guide says you have one calendar month to respond, and if you need to check ID or ask for more information you can wait for the reply before the clock starts. You cannot add days when a month is shorter, so a request received on 31 January should be answered by 28 February, and the ICO suggests a 28-day reminder. If a request is very complex, or the person has made many requests, you can take a further two calendar months, but you must tell them about the delay before the first month ends (ICO: How to deal with a request for information).

The ICO’s care records guidance says you must make reasonable and proportionate searches to locate information, keep a clear record of where historic records are, and be open if records have been lost or destroyed (ICO: Looking after care records). The ICO notes that this guidance is under review because of the Data (Use and Access) Act, so check its site for the latest position.

How Long Should a Care Home Keep Records?

The NHS Records Management Code of Practice retention schedule sets a minimum of 8 years for adult social care records, including care plans, and says the periods listed must always be considered the minimum (NHS England: Appendix II, care records). CQC says all health and social care services must “have regard” to the Code, meaning you follow it unless you have a good reason not to, and Digital Care Hub publishes an abbreviated version for adult social care providers. Check the Code for how the period is counted and for other record types such as staff and complaints records, which have their own entries.

The ICO says you must keep personal information only as long as necessary, that there are legal obligations to retain care records for specified periods, and that you may consider a longer period where it is necessary and proportionate. Throughout the period you must store records securely, protect them against loss, damage and unlawful or accidental destruction, and keep them up to date. Keep a documented retention schedule, follow it, and dispose of records securely at the end.

Security Standards and the Data Security and Protection Toolkit

CQC’s guidance points care providers to the National Data Guardian’s 10 data security standards. They include sharing data only for lawful and appropriate reasons, regular staff training in data security, access only where needed for the job, a plan for data security threats, not using unsupported software, an IT protection strategy based on a proven framework such as Cyber Essentials, and supplier contracts that hold IT suppliers to account.

The Data Security and Protection Toolkit is the free self-assessment for those standards and GDPR. CQC’s guidance says all care providers working under the NHS Standard Contract must register with it, and that the government recommends all other adult social care providers register too. CQC also links data handling to good governance (Regulation 17).

If There Is a Personal Data Breach

Misdirected emails, lost paper files and unlocked cabinets are typical care-setting breaches. The ICO says that when you have a breach you must assess the likely risk to people’s rights and freedoms. If a risk is likely, you must notify the ICO as soon as possible and, where feasible, within 72 hours. If the risk to people is high, you must also tell those people without undue delay (ICO: Personal data breach).

1. Contain the breach and assess what happened and who is affected.
2. Decide whether it is likely to risk people’s rights and freedoms, and whether that risk is high.
3. Report to the ICO online if required. The ICO says the form takes about 30 minutes and cannot be saved, so gather details first.
4. If you do not have the full picture within 72 hours, the ICO says to give what you have and provide more later without undue delay.
5. Log every breach and your decision, review your controls, and record lessons learned.

Some breaches will also be a safeguarding matter or need notifying to CQC or others. See notifiable events.

Data Protection Checklist for a Care Home

• ICO fee paid at the right tier, or an exemption recorded.
• Privacy notice, lawful basis and Article 9 condition documented for care records.
• Access to records restricted by role; paper and digital security in place.
• Recorded basis (consent, LPA, best-interests decision) before sharing with family.
• A subject access request process with a 28-day internal reminder.
• A retention schedule based on the NHS Records Management Code, actually followed.
• Staff data security training, and a plan for breaches with the 72-hour clock in it.
• Data Security and Protection Toolkit registration considered or completed.

Policies such as data protection and records management are on the CQC required policies list, and they need reviewing regularly. See how often to review care home policies.

Sources: CQC: Check the way you handle personal information meets the right standards · ICO: Guide to the data protection fee · ICO: Personal data breach · ICO: How to deal with a request for information · ICO: Looking after care records · NHS England: Records Management Code, Appendix II care records retention schedule