1         Information we collect

The Speech and Language Centre holds personal data as part of conducting a professional service. The data falls under the following headings: healthcare records, educational records, clinical records, general administrative records, and financial records.

1.1       Healthcare records

A healthcare record refers to all information collected, processed and held both in manual and electronic formats pertaining to the service user and their care.  Speech and Language problems can be complex, and a wide range of information may be collected in order to best meet the needs of the client, and to maintain a high quality service which meets best practice requirements. In order to provide a high quality service, a range of information may be collected. Examples of data collected and held on all current and active clients include the following:

• Examples of data collected and held on all current and active clients include the following:
• Contact details: Name, address, phone numbers, e-mail address.
• Personal details: Date of birth.
• Other contacts: Name and contact details of GP and any other relevant professionals (e.g. Healthcare or Education persons) involved.

For child services:

1. Parent/guardian details
2. Description of family
3. Educational placements.
4. Pre- and post-natal history: This can include information relating to mother’s pregnancy, and child’s birth.
5. Developmental data: Developmental milestones, feeding history, audiology history.
6. Medical details: Such as any relevant illnesses, medications, and relevant family history.
7. Reports from other relevant allied health professionals such as: Audiology, Psychology, CAMHS (Child & Adolescent Mental Health Services), Occupational Therapy, Physiotherapy, Ophthalmology etc.

For adult services:

•  Employment/vocational history
• Medical/hospital notes
• Mental health history
• Initial GP/ENT Medical referral letter

1.2       Educational records

Relevant Individual Educational Plans (IEPs), progress notes from educational staff and school reports may be held.

1.3       Clinical records

Specific data in relation to communication skills may be collected and held, such as assessment forms, reports, case notes, e-mails, text messages and transcripts of phone calls. Audio and video files may also be collected and stored.

1.4       General administrative records

The Speech and Language Centre may hold information regarding attendance reports and accident report forms.

1.5       Financial records

A financial record pertains to all financial information concerning the practice, e.g. invoices, receipts, information for Revenue. The Speech and Language Centre may hold data in relation to: payments, receipts and invoices. Information will include name of bill payer, client name, address, e-mail address and record of invoices and payments made.

2         Where we get our information

 

Personal data will be provided by the client, or in the case of a child (under 16 years), their parent(s)/guardian(s). This information will be collected as part of a case history form prior to, or on the date of first contact. Information may also be provided directly from relevant third parties such as schools, medical professionals and allied health professionals, with prior consent from the parent(s)/guardian(s).

 

3      How we use the information that we collect

 

We use the information we collect to provide assessment and therapy as per the relevant professional guidelines, as well as to maintain the general running of the business, such as keeping our accounts and updating you of any changes in policies or fees. Information may also be used for research purposes, with the written consent of the client or parent/guardian.

3.1       Data retention periods

The retention periods are the suggested time periods for which the records should be held based on the organisation’s needs, legal and/or fiscal precedence or historical purposes. Following the retention deadline, all data will be destroyed under confidential means.

3.2       Client Records

The Speech and Language Centre keeps both physical and electronic records of clinical data in order to provide a service.

• We store paper and electronic files securely in a locked filing cabinet in a locked office. There is a high level of security in the pharmacy/GP surgery building, including locked offices and an advanced security system.
• Clinical data is deleted/confidentially destroyed 3 years after discharge from the our services. This timeframe was set in accordance with the guidelines published by the Independent Speech and language Therapists of Ireland (ISTI) professional body.
• Clinical data used for research purposes, may be kept for longer than 3 years with the written consent of the client or parent/guardian.
• Video records / voice recordings relating to client care / videoconferencing records may be recorded with consent, for analysis purposes and to facilitate the monitoring of client progress. All recordings will be destroyed 3 years after discharge. If written consent is provided to use recordings for training purposes, the client will have the option to withdraw consent at any time.
• In order to adhere to our professional guidelines, speech and language therapists working in the Speech and Language Centre engage in Continual Professional Development. This includes case reviews and peer discussion to ensure clinical provision is at a high standard and meets evidence-based practice guidelines. Confidentiality guidelines are strictly adhered to in line with our professional ethics.

3.2.2         Financial Records

The Speech and Language Centre keeps electronic/paper records of financial data from those who use our services.

Section 886 of the Direct Tax Acts states that the Revenue Commissioners require records to be retained for a minimum period of six years after the completion of the transactions, acts or operations to which they relate. These requirements apply to manual and electronic records equally.

• Financial Data is kept for 6 years to adhere to Revenue guidelines.
• Financial Data (including non-payment of bills) can be given to Revenue at Revenue’s request.

3.2.3         Contact Data

Contact Data is kept for 6 years to allow processing of Financial Data if required.  (This may be retained for longer for safety, legal request, or child protection reasons.) Data from enquiries made to the clinic which do not result in subsequent attendance to our service is deleted annually, at the end of each calendar year. This date includes but is not limited to: enquiry emails, voice messages, telephone calls and letters. If you wish to remove your data within the annual timeframe, please contact us.

3.3       Exceptions

If under investigation or if litigation is likely, files must be held in original form indefinitely, otherwise files are held for the minimum periods set out above.

4         Information we share

 

We do not share personal information with companies, organisations and individuals outside the Speech and Language Centre unless one of the following circumstances apply:

 4.1       With your consent:

We will share personal information with other relevant health care providers or educational providers when we have your written consent to do so. We require opt-in consent for the sharing of any sensitive information.

 4.2       For legal reasons:

We will share personal information with companies or organisations outside of the Speech and Language Centre if disclosure of the information is reasonably necessary to:

• Meet any applicable law, regulation, legal process or enforceable governmental request.
• Meet the requirements of the Children First Act 2015.
• To protect against harm to the rights, property or safety of the Speech and Language Centre, our service users or the public as required or permitted by law.

The following third parties are engaged for processing data:

Who?                   Accountant

Type of data?      Financial

Purpose?              Processing financial reports, analysis and filing of company accounts and payroll services.

 

5         Sharing Data

 

5.1       Legal requirements

The Speech and Language Centre is required to share data with external parties in the following circumstances:

• Compliance with local tax and audit laws.
• Compliance with child protection.
• Compliance with law enforcement.

 

5.2       Financial requirements

The Speech and Language Centre is required to share financial data with Adrian McCaffrey Accountants in order to comply with local tax laws. The Speech and Language Centre is obtaining a copy of Adrian McCaffrey Accountants own Data protection policy.

5.3       Other parties

 

5.4       Transfer of personal data outside the EEA

Any transfers outside the above which contain Personal Identifying Information (PII) to third parties such as hospitals, GPs, nursing homes, are only made once the owner of the data has given express written permission by letter or email to do so.

In certain instances, personal data may be transferred outside the EEA, e.g. to the US or other countries. This would be for specific purposes such as web-based appointment scheduling. In such instances, The SLC will use third parties which meet the privacy standards of GDPR.

No third parties outside EEA currently engaged with The Speech and Language Centre Ltd. as of 25th May 2018. This will be reviewed and updated accordingly at the annual policy review.
h1>

6         How and when we obtain consent

 

Prior to initial assessment or consultation, access to our data protection policy will be provided to clients along with a copy of the ‘Clinic Fees and Policies’ document and ‘What To Expect During a Speech and Language Therapy Assessment’ document. A consent form will need to be signed by the client prior to commencing the service. Copies of the signed consent form will be given to both parties. Should a client wish to withdraw their consent for data to be processed, they can do so by contacting the Speech and Language Centre in writing.

7         How we protect your data

 

In accordance with the General Data Protection Regulation (GDPR), we will endeavour to protect your personal data in a number of ways:

 

7.1       By limiting the data that we collect in the first instance

All data collected by us will be collected solely for the purposes set out at 1 above and will be collected for specified, explicit and legitimate purposes.  The data will not be processed any further in a manner that is incompatible with those purposes save in the special circumstances referred to in section 5.1. Furthermore, all data collected by us will be adequate, relevant and limited to what is necessary in relation to the purposes for which it is collected which include, inter alia, the assessment, diagnosis and treatment of speech, language and communication disorders.

7.2       By transmitting the data in certain specified circumstances only

Data will only be share and transmitted, be it on paper or electronically only as is required, and as set out in section 3.

7.3       By keeping only the data that is required

 

7.4       By disposing of/destroying the data once the individual has been discharged from The Speech and Language Centre’s services

Data will be confidentially destroyed 3 years after the date of discharge, apart from the special categories of personal data as set out at 1.1 above.  Where data is required to be held by us for longer than the period of 3 years post-discharge, we will put in place appropriate technical and organisational measures to ensure a level of security appropriate to the risk. These may include measures such as password access to computers, the encryption of electronic devices, and/or safe and secure storage facilities for paper/electronic records.

7.5       By retaining the data for only as long as is required

We will keep data for 3 years post-discharge except for circumstances in which retention of data is required in circumstances set out at part 1.1 above or in certain specific circumstances as set out at Article 23(1) of the GDPR.

7.6       By destroying the data securely and confidentially after the period of retention has elapsed.

This could include the use of confidential shredding facilities.

7.7       By ensuring that any personal data collected and retained is both accurate and up-to-date.

 

8         Protecting your Rights to Data

 

8.1       Adult clients

Adults have the right to request data held on them as per article 15 of GDPR. A request must be made in writing. Further information regarding accessing your personal data are available in the document ‘Rights of Individuals under the General Data Protection Regulation’, downloadable from: www.gdprandyou.ie

8.2 Children

For children under the age of 16, data access requests are made by their guardians. When a child turns 16, then they may make a request for their personal data. However, this is subject to adherence with the Children First Act.

9         Security 

 

The Speech and Language Centre, as with most providers of healthcare services, is aware of the need for privacy. As such, we aim to practice privacy by design as a default approach, and only obtain and retain the information needed to provide you with the best possible service.

All persons working in, and with, the Speech and Language Centre in a professional capacity are briefed on the proper management, storage and safekeeping of data.

All data used by the Speech and Language Centre, including personal data, may be retained in any of the following formats:

1. Electronic Data
2. Physical Files

The type of format for storing the data is decided based on the format the data exists in.

 

9.1       Data Security 

The Speech and Language Centre understands that the personal data used in order to provide a service belongs to the individuals involved. The Speech and Language Centre strives to keep your data safe and secure.

 

9.1.1         Electronic Data

All electronic data is contained in the following systems:

1. LENOVO CLINIC LAPTOP 

• This device is physically located in the Speech and Language Centre office and is not removed from the clinic.
• This has password protection to gain access to the device.
• It is routinely locked in the filing cabinet which is stored in a locked clinic room in the pharmacy building, which has a live security system.

2. GOOGLE EMAIL

• This system is physically located in the European Union.
• This system provider is aware of their requirements for GDPR compliance.
• Google does not have access to client records.
• This system has a Live Update for security enabled.
• All Speech and Language Clinic Therapists working in the Speech and Language Centre have read/write/delete access to their own Gmail account and remote-wipe abilities.
• Client email addresses and emails containing client data and correspondence will be deleted from the account following email correspondance.

3. PHYSICAL FILES

•  All physical data relating to current clients is located in The Speech and Language Centre, 1^st Floor Johnston’s Pharmacy, Main Street, Lanesborough, Co Longford.
• All persons working in the Speech and Language Centre have access to these records.
• These records are kept in a filing cabinet secured with a lock and key.
• All physical data relating to discharged clients is located at The Speech and Language Centre, 1^st Floor Johnston’s Pharmacy, Main Street, Lanesborough, Co Longford.
• All persons working in the Speech and Language Centre have access to these records.
• These records are kept in a cabinet secured with a lock and key.

 

9.2       Security Policy

 

9.2.1

The Speech and Language Centre understands that requirements for electronic and physical storage may change with time and the state of the art. As such, the data controllers in the Speech and Language Centre review the electronic and physical storage options available every year

9.2.2

 

All persons working in the Speech and Language Centre are aware of and refresh the requirements for good data hygiene every year. This briefing compliance is monitored by the Speech and Language Centre Data Controllers and includes, but is not limited to:

• Awareness of client conversations in unsecure locations.
• Enabling auto-lock on devices.
• The awareness of the Speech and Language Centre procedure should a possible data breach occur, either through malicious (theft) or accident (loss) of devices or physical files.