For solicitors
How I handle your clients’ records
Medical records are special category personal data. This page sets out how records sent to me are received, stored, used and destroyed, so that your compliance team does not have to ask.
Receiving records
Not by unencrypted email
Preferred method
Encrypted methods only: Egress, Mimecast, ShareFile, or the solicitor’s own encrypted platform.
Not accepted
Unencrypted email attachments containing identifiable medical records. If that is your firm’s only available route, contact us and we will arrange an alternative.
Storage and access
Encrypted, limited, accounted for
01
Records are held in encrypted local and cloud storage in Europe.
02
Physical records are kept in a locked cabinet; devices are secured laptops.
03
Access is limited to me and to Lexmed, which provides the administration of my practice under contract and handles records on my behalf under a written data processing agreement.
04
Devices are encrypted, password protected and support multi-factor authentication and remote wipe.
05
Records are not held on personal devices belonging to anyone else and are not processed by any third party.
Retention and destruction
Nothing kept beyond its purpose
Records are retained for 6 months following conclusion of the instruction.
At the end of that period, electronic records are securely deleted and physical records are confidentially destroyed.
Records will be returned or destroyed earlier on your written request.
A certificate of destruction is available on request.
Data protection status
Where this instruction sits under UK GDPR
Breach notification
Told without undue delay
In the event of a personal data breach affecting records held in connection with your instruction, I will notify you without undue delay and in any event within 24 hours of becoming aware of it, and will co-operate fully with any notification you are required to make.
Professional indemnity
Cover held for medicolegal work
Any questions from your compliance team?
Email my practice at info@thoracicsurgeryexpertwitness.co.uk and they will answer them directly.
Email compliance questions