The National Health Service (Primary Medical Services Section 17C Agreements) (Scotland) Regulations 2018

Provider and Health Board Obligations

35.—(1) The provider must—

(a) take all reasonable steps to ensure the accuracy of patient records;

(b) verify the accuracy of any templates and notices provided to it by the Health Board in accordance with sub-paragraph (2)(b), and once verified, use such templates and notices;

(c) comply with the Health Board’s current policies concerning data security, personal data or IT security notified by the Health Board to the provider under sub-paragraph (2)(c);

(d) maintain a record of all of the provider’s processing activities carried out in performance of the agreement and make the records available to the Health Board on request;

(e) where the Health Board and the provider have not appointed a jointly designated data protection officer; the provider must nominate a person with responsibility for working together with the Health Board’s data protection officer in matters relating to the protection of personal data and the implementation of the Health Board’s guidance, templates and policies on such matters set out under paragraph (2)(b); and

(f) ensure that any person under its direction who has access to patient records has undergone adequate data protection training.

(2) The Health Board must—

(a) take all reasonable steps to confirm the accuracy of patient records provided to or accessed by it;

(b) provide to the provider, guidance, templates, and privacy notices, relating to the provider’s processing of personal data and the provider’s maintenance of a record in accordance with sub-paragraph (1)(d);

(c) notify the provider timeously of its current policies regarding data security, personal data security and IT security processes;

(d) maintain a record of its processing activities carried out in relation to a provider’s patient records;

(e) where the Health Board and provider agree, appoint a jointly designated data protection officer;

(f) ensure that any of its employees who have access to the provider’s patient records and practice data has undergone adequate data protection training; and

(g) make available appropriate data protection training to the provider and its employees.