The Data Protection Act 2018 recognises that recorded conversations have the potential to contain a host of personal information, which was previously covered in the Data Protection Act 1998. Updates and changes made in the new Data Protection Act 2018 (incorporating the EU GDPR) mean that practices wishing to record calls will be required to demonstrate they have a legal requirement to do so that fulfils the following six conditions under GDPR;

• The people involved in the call have given consent to be recorded
• Recording is necessary in order to fulfil a contract
• Recording is necessary for compliance with a legal requirement
• Recording is necessary to protect the vital interests of one or more participants in the call
• Recording is in the public interest, or it is necessary for the exercise of official authority
• Recording is in the legitimate interests of the recorder, unless those interests are overridden by the interests of the participants in the call

There must be explicit consent - there may be situations where call recording is deemed lawful (e.g. financial institutions that are required by law to record all calls, emergency services calls are in the interest of public protection and there are other sector-specific regulations).

This means that a practice will need to apply the following;

• Active consent – All callers must give consent to be recorded. This can be achieved in different ways, such as an oral acceptance during the call, consent after receiving a message, or as part of a customer agreement.
• Delete the data – How long the recording is stored for depends on the purpose for recording, and this should be communicated to the caller. Calls are held for a 3 month period and then deleted. The responsibility rest with the organisation recording the call to delete the data at the end of the specified time.
• The right of access to personal data – Patients and employees can request access to the data stored on them, and the Practice is obliged to make this information available without delay.
• The right to be forgotten – Patients (“data subjects”) have the right to the erasure of personal data concerning them. This means that Practices MUST delete someone’s personal data without delay if that data is no longer necessary in relation to the purpose of the recording. NOTE: ‘The right to be forgotten’ does not override legal and compliance obligations
• Easy access to recordings – All stored data that can be used to identify an individual, including recorded calls, must be accessible if a patient requests it.

Under GDPR, organisations are prohibited from recording the personal conversations of staff, even with consent, and therefore need to ensure that while business calls are recorded, personal calls always remain private.

If a Practice records incoming and/or outgoing calls, then it is recommended that the Practice contact their individual telephony provider to clarify their system’s ability to satisfy the current Data Protection and privacy laws.

RAVENSWOOD MEDICAL PRACTICE

RECORDING CALLS POLICY

Introduction

This policy outlines the practice’s call recording process. The purpose of call recording is to provide a record of incoming and outgoing calls which can:

• Identify practice staff training needs
• Protect practice staff from nuisance or abusive calls
• Establish facts relating to incoming/outgoing calls made (e.g. complaints)
• Identify any issues in practice processes with a view to improving them

Purpose

The purpose of this policy is to ensure that call recording is managed in line with DPA & Data Retention requirements. This will generally involve the recording of telephone conversations which is subject to the Telecommunications Act 1984.

The practice will make every reasonable effort to advise callers that their call may be recorded and for what purpose the recording may be used. This will normally be via a pre-recorded message within the telephone system. The voice file may be stored within the clinical system or within the telephone system to which the same rules of confidentiality will apply.

Where a patient requests to listen to a recording then this should be allowed within the general provisional of data subject access under the Data Protection Act 2018.

Scope

This policy applies to all practice staff including any contracted or temporary workers.

All calls via the telephone systems used in the practice will be recorded, including:

• All external incoming calls
• All external outgoing calls made by practice staff
• Call transfers

Recording will automatically stop when the practice staff member terminates the call or the patient states they do not wish the call to be recorded.

Callers must be advised that the call will be recorded for quality/training purposes - this can be in the form of an automated voice message or similar.

Playback / Monitoring of Recorded Calls

Monitoring of the call recordings will be undertaken by the Management Team.   Any playback of recordings will take place in a private setting and where applicable, individuals should be given the opportunity to listen to the relevant recordings to receive feedback and developmental support.

All recordings and call recording equipment will be stored securely, and access to these should be controlled and managed by the Management Team.

Access to the recordings will be by:

Log in to dedicated computer system.

Confidentiality

The Data Protection Act allows access to information that is held about them and their personal data. This includes recorded telephone calls. Recordings should be stored in such a way that will enable easy access to the information relating to one or more individuals.

Requests for copies of telephone conversations can be made under the Data Protection Act as a “Subject Access Request”. This must be done in writing and after assessing whether the information can be released, the requestor can be invited to the practice premises to hear the recording.

If there is a request from an external body relating to the detection or prevention of a crime (e.g. police), then requests for information should be directed to [enter name of Data Protection Administrator or similar] to carry out the request for the recording.

OPTIONS IF THE PRACTICE RECORDS CALLS

Telephone calls to the Practice are routinely recorded for the following purposes;

• To ensure practice staff act in compliance with procedures
• To ensure quality control
• Training, monitoring and service improvement
• Prevention of crime, misuse and the protection of staff.

All telephone calls to the Practice are recorded. This is to help us ensure that we provide the best possible services to our patients and helps us to deliver care and identify ways that we can provide a quality service.

Call recordings are kept secure and the data is retained for 3 months.