Preparing for GDPR with Clinicminds

Author: Guy Makmel
  • GDPR

On May 25, 2018 the General Data Protection Regulation (GDPR) will get into effect in the European Union. As clinic owner, you should prepare your business for these new regulations. This article provides recommendations for using Clinicminds in compliance with the GDPR.

For general recommendations about preparing for the GDPR, we recommend to consult your national data protection authority:

Note that this document is provided merely as a recommendation for using Clinicminds. It is no legal advise and Clinicminds B.V. cannot be held responsible for the accuracy of this document. Consult a legal professional for advice about your clinic’s situation.

Data Processing Agreement

The first and easiest step is to accept the Data Processing Agreement from Clinicminds. This legal agreement describes the role and responsibilities of Clinicminds with regard to the data from your clinic and clients that are processed in Clinicminds. As a business, you are obliged to have a written contract with certain guarantees when a third party, like Clinicminds, processes data on your behalf. Therefore, you must accept the Data Processing Agreement of Clinicminds.

To accept the agreement, open Clinicminds and go to menu > Settings > Subscription & Invoices. In the section Agreements, click Review & Agree next to the Data Processing Agreement. We recommend to save the agreement by downloading the PDF. You can always download it at a later time from this page as well.

Note that you probably need to have similar agreements with other IT providers that process data for your clinic. Some examples include: cloud bookkeeping software; marketing software (like email newsletters); communication software (like your email provider or social media tools); collaboration software (like cloud office suites or task systems); your website (if it contains forms or collects data in another way); et cetera. We recommend to contact the applicable providers as soon as possible, and store all agreements so you can easily find them at a later time.

Consent from clients

There are six lawful basis on which you may process data. One of them is when you have a contractual obligation with your client (like a treatment agreement), or when your client requested something before getting into an agreement (like booking an appointment or requesting a treatment quote). However, on this basis you may only process the data as necessary to perform the contract. You cannot process the data for other purposes, like analysing your clinic’s performance.

Furthermore, health data is considered special category data in the GDPR. It requires more protection because it is more sensitive data. In addition to the lawful basis, you also need to meet another specific condition to process this special category data.

Consent from your client is another possible lawful basis to process data. Furthermore, consent is also one of the possible specific conditions required to process special category data. Therefore, obtaining consent from your clients can be a good way to legally process their data. To obtain consent from your clients, you should inform them clearly and specifically about the data you process, the goal of the processing, and their rights. Your client must give their explicit consent for the processing (so a pre-ticked checkbox is not valid). Make sure to keep evidence of their consent.

We recommend you to investigate which data you store, and for which purposes you process it. The basic things may be clear, like storing information about the consultation and treatment in the medical record. Do not forget other things, like performing business analytics on your clinic’s performance, or sending reminders to your clients about repeated treatments.

During the appointment

When you perform a consultation or treatment, you can discuss the processing of your client’s data with them, and ask for their consent. Your consultants and doctors should be prepared, so they can discuss everything with the client and answer questions. You can register that data processing was discussed during the consultation as evidence. Furthermore, you can ask the client to provide explicit consent and evidence by signing a form.

Register discussion: To register that your consultant or doctor discussed data processing, you can make a discussion point for it. Open Clinicminds and go to menu > Records > Discussion Points. Here you can add a discussion point about data processing. The discussion point will be shown in the Consultation tab of consultations and treatments. Your consultant or doctor can check it, to register that they discussed it. If you choose Required discussion point when setting up the discussion point, your consultant or doctor must tick the checkbox before proceeding in the record, so they cannot forget it.

Signed consent: To get explicit consent and evidence that your client agrees with the data processing, you can put it in a form. Open Clinicminds and go to menu > Records > Forms. Here you can add a form with the details of the data processing. We recommend to make a separate form about data processing (and not include it in an existing informed consent), so your client explicitly agrees with it. The form will be shown in the Forms tab of consultations and treatments. Your consultant or doctor can then let the client sign the form from there.

Before the appointment

You can also inform clients about the processing of their data before the appointment. This can save time during the appointment itself. You can send the form about data processing with the appointment confirmation, so your client can read it from home. Furthermore, you can include details about data processing in your online scheduler.

Send form: First, set up a form about data processing as described above. When booking an appointment in the calendar, your staff can check the form in the section Send forms with confirmation via email. The confirmation and reminder email will then contain a button to view the form. You can also set up the form to be sent automatically, also for appointments booked via the online scheduler. For this, open Clinicminds and go to menu > Records > Treatment Categories. Click all applicable categories, and select the form in the section Send forms with appointment confirmation by default.

Online scheduler: You can include details about data processing in the texts shown in the online scheduler. By default, the following sentence is included on the homepage: “By booking an appointment, you agree that your data will be stored in our system.” To edit this, open Clinicminds and go to menu > Settings > Calendar/Booking Settings. Edit Text before booking in the Online booking section.

Client’s right to erasure

With the GDPR, your clients have several rights with regard to their personal data. For example, they have the right to access their data, or rectify any errors in it. Another right is the right to erasure, or right to be forgotten: if a client requests so, you must erase their data. However, you cannot simply delete their whole record in Clinicminds: you are required to keep certain data in your administration, like invoices and appointments in your calendar, depending on national law.

To support erasure requests, Clinicminds has a feature for archiving clients. All data is deleted, except for administrative and legal data like appointment dates, record dates, signed forms, quotes, invoices, and product sales. To archive a client, open Clinicminds, find the client and open their page, click Edit Client below the client details, and click Archive Client at the bottom.

After archiving a client, the client will no longer show up in the app any more. To access the remaining data, open Clinicminds, go to menu > Clients & Records > Archive, and search for the archived client by name, date of birth, or client number. There is a separate permission to restrict access to this archive by user role. Relevant data remains available in the administration, like the invoices section or report, though the client’s name is replaced with “Archived client”. The client number remains available, so the client can be looked up in the archive if necessary. Note that PDF documents, like forms, quotes, and invoices, are not modified when archiving the client, so they can still contain certain personal data.

Note that Clinicminds keeps daily backups of all data for one month as a security measure. Therefore, after archiving a client or editing/deleting data in the app, it takes one month before the (old) data is really gone. However, during that month the data is no longer accessible for users in the app, as the backups are stored separately from the live database.

Security recommendations

User roles and permissions

Clinicminds offers settings to precisely manage to which parts of the application your users have access. You should use these settings to make sure that your users can only view or edit data they are supposed to. We recommend you to review these settings and make sure they are still accurate.

The settings are based on user roles. For each user role, you can determine which permissions are granted. You can make user roles based on the functions in your clinic (like doctor, secretary, administration, et cetera). To manage your clinic’s user roles, open Clinicminds and go to menu > Clinic > User Roles.

After setting up your user roles, you can assign them to your users. Each user has one user role, and they get the permissions as set up for that role. For example, you can have multiple doctors that all have the ‘Doctor’ user role. To manage your clinic’s users, open Clinicminds and go to menu > Clinic > Users.

Password and passcode

When you open Clinicminds, users have to log in using their username and password. On iPad and computers, the user stays logged in for one hour after their last activity. After one hour of inactivity, the user has to log in again.

To log in easier after an hour of inactivity, users can enable a four-digit passcode. Within 24 hours of their last activity, they can then log back in by entering the passcode. To enable this as a user, open Clinicminds and go to menu > Settings > Login Details.

We recommend you and your users to use a strong password and passcode for Clinicminds, that is not used for other services. You can use a password manager to use strong and unique passwords for all websites and cloud applications that you use.

Two-factor authentication

As an extra security measure, you can enable two-factor authentication. This requires you to enter a code from your smartphone after logging in using your username and password. With two-factor authentication, even if someone would know your password, they would not be able to access your account (unless they also have access to your smartphone).

To enable two-factor authentication as a user, open Clinicminds and go to menu > Settings > Login Details. You need an authenticator app for this on your smartphone, like the free Google Authenticator app.

It is possible to require all users in your clinic to use two-factor authentication. To do so, open Clinicminds and go to menu > Settings > Clinic Settings. Here you can enable the setting Require two-factor authentication. After doing so, your users will be required to set up two-factor authentication on their account the next time they log in.