Review of a medical illustration department’s data processing system to confirm general data protection regulation (GDPR) compliance

Abstract

This article reviews the clinical photography and video data processing and storage arrangements of the Medical Illustration Department (MID) at the Queen Elizabeth Hospital Birmingham National Health Service (NHS) Foundation Trust (QEHB), part of the University Hospitals Birmingham (UHB) NHS Foundation Trust umbrella group. This review suggests that the department’s current workflow and technical processing solution satisfies the requirements of the general data protection regulation (GDPR). At the time of writing, there were no additional financial costs or technical skills required for implementing GDPR regulations but this could change in future data processing systems. There are significant potential costs for non-compliance with GDPR. Brexit is unlikely to have any effect on complying with GDPR requirements. The GDPR gives the public the right to access information and be informed of how and why it is processed. It is recommended that improved administrative processing capability to accommodate this requirement should be included in future data processing designs. At the QEHB informed consent for use of photographs and videos is currently adequate to satisfy the common law of confidence.