Deceased patients - the existing legislation, contained in the Access to Health Records Act 1990, will apply to records of deceased patients. Section 30 of the Act provides that the physical or mental health or condition of individuals may give rise to exemption from the access provisions. However, giving effect to this provision relies upon secondary legislation which is still awaited. The government is drafting an order which is very similar to an existing statutory instrument relating to access to health records under the Data Protection Act 1984. Sensitive data' includes information about physical or mental health, religious or other beliefs, racial or ethnic origin, sexual life, political opinions, trade union membership, and criminal offences.
Stricter conditions apply to the processing of sensitive data.
The explicit consent of the patient must be obtained, or processing must be to protect the vital interests of the patient, or be processing by a healthcare professional for healthcare purposes. Sensitive data may also be processed and disclosed for legal proceedings or to obtain legal advice. Proper security for personal data must be ensured through both technical and organisational measures. This means guarding against unauthorised access to data, alteration, disclosure, accidental loss or destruction of data. Registration - Existing registrations with the Data Protection Registrar will last until 24 October 2001 unless they expire sooner.