The Office of the Data Protection Authority has conducted a review into how patient data is shared across the three island medical practices using a shared records system. The findings highlight solid safeguards alongside opportunities to further strengthen the protection of sensitive health information in a way that benefits the whole community.
The ODPA has a range of effective tools available to promote compliance within a sector. This includes formal sanctions, such as fines at one end of the spectrum, all the way to more informal solutions at the other. One of these tools is the use of thematic reviews across different sectors within the Bailiwick. These voluntary reviews scrutinise a specific area or process under the local data protection law, helping to identify what is working well and where improvements can be made. This allows the ODPA to engage with industry broadly and at the ground floor, identifying any areas of improvement to reduce the likelihood of data protection issues in the future.
The thematic review of the medical sector focused specifically how patient information is managed within shared case management systems.
Medical practices handle large volumes of health data, which is classified as Special Category Data under the Data Protection law of Guernsey. This means it requires elevated safeguards to protect service users.
Scope of the review
The ODPA focused on the use of Medicus, a system shared by three medical practices, each overseeing surgeries:
- IslandHealth
- Healthcare Group
- Queens Road Medical Practice
All three practices engaged positively with the review and welcomed the opportunity to receive additional guidance and support.
Key findings
Within Medicus, access to patient records is carefully controlled. When a patient registers with a practice, only that practice and the out-of-hours service can access their records on the system.
Other practices can only access those records where a formal patient transfer has taken place, at which point the previous records are made inactive.
The ODPA asked each practice to provide governance documents covering the handling of patients’ personal data within Medicus, including internal policies and Data Sharing Agreements.
The review confirmed that all three practices generally demonstrated respect for their responsibilities under the Law and a clear commitment to safeguarding the sensitive information they process.
While the ODPA saw positive practices, it did identify certain areas where improvements were needed.
In particular, the ODPA reviewed the Joint Controller Data Sharing Agreement in place between the practices. As the document pre-dated the introduction of Medicus, it lacked the full detail needed to reflect how the system operates today and to meet current expectations under the Law.
The ODPA recommended updating the agreement to better reflect specific arrangements in place, taking into account guidance produced by the European Data Protection Board regarding joint controllership.
The ODPA also suggested creating a more tailored agreement, specifically addressing the practical realities of using the Medicus system.
All recommendations made by the ODPA were accepted and the majority of commitments have since been completed. Any remaining commitments are in the process of being addressed.
Improvements include:
- Updates to policies addressing access to Medicus and staff roles.
- Updates to policies addressing patient transfer and inactive records.
- Updates to the retention and disposal of patient data.
- Developing a Medicus-specific data sharing agreement between all surgeries utilising the system.
The review highlights the importance of the following safeguards:
- Keeping data sharing agreements up to date.
- Ensuring governance reflects how systems are actually used in practice.
- Regularly reviewing and auditing how personal data is handled.
The more consideration given to such safeguards, the lower the risk of breaches occurring.
- While the review focussed on the three medical practices, its lessons are relevant for all organisations entrusted with sensitive personal data. In sharing the findings the ODPA hopes that other organisations will examine their own processes and consider what further steps they can take to elevate their safeguards.
The ODPA would like to thank the participating practices for their constructive engagement and their commitment to improving data protection standards.
“Thematic reviews play a critical role in identifying risk areas before they translate into real-world harms, which is especially important in a health sector responsible for some of the most sensitive of personal data. We appreciate the cooperation by the medical organisations during the review. Their engagement, and the commitments made, are key to strengthening data protection standards across the sector, meaning that Guernsey residents benefit from an even higher level of protection for their health information.”
Brent Homan, Commissioner for the Data Protection Authority
“The review recognises the strength of our internal governance, systems and processes at Queens Road Medical Practice. It truly reflects the consistent focus we place on high standards, robust data management and delivering safe, effective care for our patients. We’ll continue to build on this strong foundation and embed best practice across everything we do.”
Rob Jordan, Practice Manager - Queens Road Medical Practice
“The trust our patients place in us extends beyond the care we provide—it also includes how we protect their personal information. We are pleased to have engaged constructively with the ODPA throughout this review and welcome the recommendations that will further strengthen data protection across Guernsey’s primary care sector.
The review confirms that robust safeguards are already in place, while also highlighting opportunities for continued improvement. IslandHealth is committed to implementing these enhancements and working collaboratively with the other practices, to ensure that patients can remain confident that their sensitive health information is handled in accordance with the highest data protection standards.”
Dr Mike Long, Practice Chairman – IslandHealth
“The Healthcare Group welcome the ODPA’s thematic review into our implementation of the Medicus Electronic Patient Record system which represents a significant step forward in modernising primary care across the Bailiwick. Transitioning to a modern, digital healthcare platform is vital for improving patient outcomes, and ensuring the absolute privacy and security of our community's Special Category Medical Data is our highest priority.
"The ODPA's insights provide a valuable benchmark as we continue to embed the system, optimise our internal safeguards, and ensure our staff maintain the highest standards of data governance and accountability. We have engaged transparently with the ODPA throughout their thematic review of the Medicus system and we are pleased to note that the review highlights our robust baseline protections, and we have already actively implemented the authority’s recommendations to further strengthen our technical and organisational security measures. As with any large-scale digital transformation, maintaining continuous data protection compliance is an evolutionary process and the authority’s thematic review offers constructive guidance that helps us align our advanced cloud-first infrastructure with strict local regulatory expectations.”
John Ingrouille, Practice Manager - Healthcare Group