Posts in Photography

GDPR AND ALTERNATIVE THERAPY CONSENT FORMS

July 24th, 2019 Posted by Acupuncture, Alternative Medicine, Clinic app, Consent forms, Consultation Forms, Electronic signatures, GDPR, Holistic Health, Hypnotherapy, Medical History Form, Paperless, Photography, Sports Therapy, Uncategorized, Web Design No Comment yet

It is now over one year since the GDPR legislation came into effect on the 25th of May 2018, and it’s still a major area of concern to many small and medium-sized endeavours.

The Alternative Medicine sector is no exception as I discovered when we exhibited at the Holistic Medicine Exhibition at the ICC in Birmingham recently. 

Almost everyone I spoke to wanted to know if we could help them with compliance. It was as important as the cost savings of going paperless for them. Convenience for them and their clients is the other main benefit.

Many of them were members of a Professional Hypnotherapy Association. They comply with the hypnotherapy code of ethics they studied as part of Hypnotherapy training. Therefore complying with GDPR is important too.

Fortunately, using paperless forms is a great cure for many GDPR headaches.

Nothing worries us more than the unknown. So I thought I’d write down a few words about how GDPR affects Hypnotherapists.

GDPR IS A SOLUTION NOT JUST A PROBLEM

Many people saw GDPR for alternative practitioners as a problem. By offering more transparency it safeguards consumer rights in our online world. Not a problem but a solution.

However, GDPR was written by highly paid lawyers. It appears designed to be complex to keep them in business. 

So here is my take on it, let’s start from the top, shall we? 

WHAT IS PERSONAL DATA?

Personal data means information relating to an identifiable person. Information including, names, addresses, dates of birth, ethnicity, medical information etc.

If you collect personal data for example, using an iPEGS electronic consent form you are the Controller and we are the Processor. The same is true for Medical history, Treatment plan or in fact any of our forms.

As a controller, you determine the purposes of processing personal data. We as a processor, are responsible for processing the data, storing it securely as well as keeping it accessible and within the law. 

A RECENT SURVEY SHOWED NEARLY 40% OF SMALL BUSINESSES DID NOT UNDERSTAND GDPR REGULATIONS

Most people who use paper forms are both the controller and processor. They hold all the responsibility themselves. 

HANDWRITTEN FORMS ARE DATA TOO

GDPR applies to both automated personal data and to manual filing systems. Handwritten forms are data just as the most sophisticated online form, only more cumbersome. 

You must keep an inventory of all personal data that you process.

If that data is digital with the right provider it is relatively simple to keep within the law. Paper-based data is much harder to manage.

THINGS YOU AS CONTROLLER OF PERSONAL DATA SHOULD CONSIDER

  • You must obtain consent to collect data, even the informed Consent to treatment form. You must receive Informed consent to collect Informed consent.
  • How do you store information? In a filing cabinet, on an excel sheet, or securely encrypted in the cloud?
  • Do you share or transport data and if so, how? Is it in the car as you travel between clients? Scanned, printed out and posted, emailed? All these present risks. If submitted securely to a UK data centre, as with iPEGS forms, for example, those risks disappear. Unlike your data might.
  • Is the information subject to a retention schedule?
  • You must keep client data, usually for 7 years.
  • The type of information you are holding (names, addresses, dates of birth, medical history, etc).
  • Do you collect it as paper forms, electronic forms, etc?
  • Will the information for marketing, research, evidence of permission?
  • Who will share the data?
  • Will there be an effect on the individual concerned and is it likely to cause any individuals to object or complain?

ALTERNATIVE THERAPISTS CLIENT’S RIGHTS UNDER GDPR

  • The right to be aware, of data you hold on them.
  • To have timely access to their personal data.
  • The right to request rectification, without delay.
  • To have personal data deleted.
  • The right to data portability, which allows individuals to obtain and reuse their personal data.
  • The right to object, for example, using their data for direct marketing.

If you lose data and let’s face it losing a paper form is easy to do even in the best run surgeries, this counts as a breach.

GDPR WHAT ARE THE RISKS FOR THE HYPNOTHERAPY PRACTITIONER?

If someone gains unauthorised access to your client’s private information, you have 72 hours to report the data breach to both your customers and any data controllers, if your company is large enough to require a GDPR data controller. Failure to report breaches within this timeframe can lead to heavy fines. 

For most practices, GDPR creates the need for greater investment either in consultant’s fees or in your own valuable time. Ensuring your operational processes are up to the required standards, ensuring websites, forms etc are designed and optimised for the latest protocols.

THINGS TO CONSIDER WHEN CONTROLLING DATA

  • Are you or someone on your team trained on data protection?
  • What changes have you made this year to become GDPR compliant?
  • Have you built client consent into your system ?

Clients can give consent in various ways, such as email, a contact form on the website, a check-box on your landing page, tick box on the form etc.

Consent records must specify the time and date when consent was given, as well as the exact means they delivered consent. 

COMPLIANCE INSPIRES TRUST

Compliance not only protects the patient, but it also protects your surgery from overstepping the boundaries.

Companies who seem to cut corners with data protection might well cut corners elsewhere. Most of us are members of a National Hypnotherapy association and have no problems with Hypnotherapy ethical issues. Cutting corners is not in our DNA we understand Our ethics and professionalism are all we have. So going digital make sense.

Can you simply and rapidly process data deletion for clients. Is it at the press of a button or will it take hours of work?

Do any 3rd parties have access to your client’s data? Third party access to data is all too common, third parties who might be using the same network or facilities, you need to be aware of any other parties who might have access to the data you’re collecting. This can be a particular problem in mixed therapy practices. Is it kept in a filing cabinet where others have access or a shared network?

How easy is it to export your data? Is it available at the touch of a button or is it a trip down to the cellar and a root through the filing cabinets?

PRIVACY BY DESIGN

One component of GDPR is privacy by design. This requires therapists to design their systems with the proper security protocols in place from the start. Failure to design your systems of data collection the right way will result in a hefty fine. It is a good idea to take a good look at your website if it hasn’t had a design overhaul in the last year or so.

Are your forms easy to find and wipe? Who has copies? Are you holding data on your phone, laptop or PC and do others have access to these devices?

GDPR seems complex, but essentially it refers to the need to have business systems designed with proper security and privacy measures integral. iPEGS paperless forms, for example, is such a system.

If you would like to find out more about how a system such as iPEGS can help you manage your client data, please check out our website www.ipegs.co.uk or contact me directly steve @ipegs.co.uk or call me on 01244 955350, I will be pleased to help.

Paperless Photo/Video Consent Forms

January 8th, 2019 Posted by Consent forms, Consultation Forms, Photography No Comment yet

 

In this weeks Going Paperless article we are going to be looking at Paperless Photography & Video Consent Forms and how going paperless with these types of forms has a multitude of benefits for all involved.

There are many different types of scenarios where you may want to take photos or videos of individuals and groups from events at schools, colleges, universities, graduations, community events, sports events, charity events…this list goes on. Depending what country you are in will depend on the privacy and data protection laws associated with taking photos and/or video of people. For the most part you will always need to inform individuals that you will be taking photos or recording video, what the photos/video will be used for and in most cases you will be required to get some form of consent. If you are taking photos/videos of children then you will absolutely need to get consent.

This article is by no means giving advice in relation to what is required in relation to your specific scenario and you should seek your own legal advice for your own circumstances. What we are looking at is the utilisation of technology to make the process of gaining consent as easy and efficient as possible.

 

Photo/Video Consent Forms are still very much completed in the traditional way of pen and paper. While this method works it poses a number of issues and risks including:

  • The time and cost associated with printing the forms
  • Printing the correct amount of forms which often leads to wasted paper
  • Difficult to read or even unreadable handwriting (we are writing less and typing more meaning handwriting is getting worse)
  • Distributing the forms effectively
  • Collecting all of the forms back in (and on time)
  • Missing or lost forms (which could lead to Data Protection issues/GDPR)
  • Sorting, transporting and storing of the paper forms

With our ever increasing use of mobile technology such as Smartphones and Tablets and the more traditional devices such as Laptops and PC’s — using paper based consent forms should be a thing of the past.

 

iPEGS offers an easy to use, cost effective way of creating Electronic Photography & Video Consent Forms that can can be accessed on ANY device, completed easily, signed electronically and submitted in a matter of minutes if not seconds.

Making it as easy as possible for the end user is absolutely key to getting your Consent Forms submitted quickly and by using a Paperless System such as iPEGS facilitates this effectively and efficiently.

Forms can be distributed to large numbers of people to be completed immediately or they can be sent ahead of time — with due dates and reminders set ensuring that no one forgets to complete and submit the form on time.

There are also more advanced features such as pre-population of the form fields making it even easier for the end user to complete the form.

Once a form has been submitted a copy of the form (PDF) can be sent to the user for their own records and you can either have the form sent to the ‘Form Owner’ or it can be submitted securely to the iPEGS Web Portal where you can access the forms as and when required. No more collecting in mountains of paper, no more risk of losing the forms and no more having to store them in a filing cabinet!

 

The vast majority of us are so used to using our Smartphones for all kinds of daily tasks such as shopping, banking, social media and much more — so the completing of consent forms electronically makes absolute sense.

So the next time you are printing out dozens of Photo & Video Consent Forms — think again…save yourself some time, save some paper, make it easy for people to complete these important forms and save some money while doing it!

For more information about how you can create your own electronic Photo and Video Consent Forms with iPEGS please click here.