Patient records in a physiotherapy clinic
Physio Plus is a private physiotherapy clinic in Sliema with four therapists, two receptionists and about 6,000 active patient records. Reception books appointments by phone and writes notes on paper cards; the cards are scanned to a USB drive that stays plugged into the reception PC. Reception also emails exercise sheets to patients from a personal Gmail account because the clinic's own mail server was 'too slow'. The reception PC has no login password because staff change shifts constantly, and all four therapists use one shared login on the practice laptop. Last month that laptop was stolen from a car; it held a full export of the patient database in CSV, made for a locum who needed it for a week. The owner wants to move to a cloud practice-management service hosted in the EU at €60 per user per month, but worries that patients would have to sign consent forms for every appointment and that the cloud is less safe than a server in the back office.
1. Identify the data protection failures in the current setup and explain which principles each one breaches.
Read the worked answer
Several distinct failures map onto Data Protection Act (Cap. 586) principles. Health data is special-category data, so the baseline is high. (a) No access control: a reception PC with no password and one shared therapist login means the clinic cannot say who saw which record, breaching integrity and confidentiality and accountability. (b) The unencrypted USB drive holding scanned notes is portable and physically vulnerable, the same principle again. (c) Emailing exercise sheets from a personal Gmail account puts patient data outside the clinic's control, with no processor agreement and no audit trail. (d) The CSV export of the entire database 'for a locum' breaches data minimisation: the locum needed the patients they would see, not all 6,000. (e) The stolen laptop was unencrypted, which turns the theft into a reportable personal data breach. (f) Keeping paper cards and scans indefinitely with no retention rule breaches storage limitation. A strong answer separates the theft, which is an incident to be handled, from the standing design faults, which are the real cause; candidates often treat all six as one problem and lose the marks for analysis.
2. Advise whether consent is the right basis for processing, and what the clinic must do about the theft.
Read the worked answer
Consent is the wrong basis here and the owner's fear is misplaced. Health care processing can rely on the provision of health care under the special-category conditions in the Act, with the ordinary lawful basis being performance of a contract or the clinic's legal obligations to keep treatment records. Consent would be inappropriate because of the imbalance between clinic and patient, because care cannot be made conditional on a consent the patient is free to refuse, and because a signature at every appointment would be theatre rather than compliance. The theft is a personal data breach. Because the export contained identifiable health data and was unencrypted, risk to patients is likely high: the clinic should notify the Information and Data Protection Commissioner without undue delay and, where the high-risk threshold is met, inform affected patients, telling them what was taken and what to watch for. It must record the breach in its register, investigate how a full export left the building in the first place, and review the locum arrangement. Notification is not an admission of liability, and delaying it to protect reputation would itself be a breach.
3. Evaluate the cloud proposal and list the contractual and technical safeguards the clinic should require.
Read the worked answer
Moving to an EU-hosted service can be safer than the present setup, but only if the contract and configuration are right. The clinic remains the controller and the provider is a processor, so there must be a written agreement covering instructions, confidentiality, sub-processors, breach notification, deletion on exit and audit rights. EU hosting helps but does not remove the need for a transfer assessment if support staff access data from outside the EU. Technically: TLS in transit, encryption at rest, multi-factor authentication for all users, role-based access so a therapist sees only their own patients, audit logging of record access, and configurable retention. Before go-live the clinic should run a data protection impact assessment, clean and minimise what it migrates rather than carrying old free-text notes 'just in case', and test export of its own data so it is not locked in. Backups and an exit plan matter as much as features. The €60 per user per month is not the main cost; training, data cleaning and contract review are. Handled this way, the cloud proposal is defensible and cheaper than a back-office server the clinic cannot secure.