than once or not at all.
1 Access to Health Records 1990
2 Consent
3 Contractual
4 Data Protection Act 1998
5 Freedom of Information Act 2000
6 General Data Protection Regulations 2018
7 Legal obligation
8 Legitimate interest
9 Mental Capacity Act 2005
10 Public interest
1 Under the General Data Protection Regulations 2018, all dental workplaces must state the lawful basis for holding personal information about both their patients and their staff. Which one of the options listed is the lawful basis under which a dental workplace holds patients’ addresses so that appointment reminders can be sent out in a timely manner?
2 When an adult patient dies, the dental workplace is obliged to hold onto their records for a minimum amount of time before securely destroying them. Medico‐legally the workplace is advised to maintain the records for 10 years after the patient’s last attendance (so 11 years in total). Which one of the options listed is the Act that allows a relevant person to receive copies of these records when requested?
3 The Information Commissioner’s Office (ICO) produced a document titled ‘GDPR: 12 Steps to Take Now’ to assist all workplaces to become compliant with the new regulations. One of the steps advises how the dental workplace can use the data they hold about their patients for marketing purposes, stating that patients must ‘opt in’ to receive marketing information from the workplace, and that the workplace must also have permission to use a patient’s image or testimonial in any marketing they undertake. Which one of the options listed is the term used in the ICO document that explains this step?
4 Under the General Data Protection Regulations 2018, all dental workplaces must state the lawful basis for holding personal information about both their patients and their staff. Which one of the options listed is the lawful basis under which the workplace can hold the National Insurance numbers of all its employees?
5 Sometimes a situation arises in the healthcare sector where it is considered in the public’s interest for statistical information to be released, such as the number of pre‐school children requiring dental extractions due to caries in fluoridated and non‐fluoridated areas of the country. Which one of the options listed is the Act under which these types of requests can be made by a person, an organisation or the media?
Answers
Multiple choice questions
1 The correct answer is B. If patients can correctly repeat the information they have been given by the dental team at the end of a discussion and after having had the opportunity to ask questions, then it is safe to assume they have understood the treatment proposal. Obviously, stating information to them and having the patient repeat it back verbatim immediately is not the same and does not indicate any level of understanding of that information.
2 The correct answer is E. Patients alone must make the decision to proceed with any treatment proposed, without anyone trying to influence their decision one way or another. The only exceptions to the patient alone giving consent are when a parent or guardian acts on behalf of a child, or when a vulnerable adult is deemed not competent to give consent under the strict Code of Practice of the Mental Capacity Act 2005.
3 The correct answer is A. Patients can communicate their decision in other ways than by speech; such as people recovering from a stroke who have lost the power of speech being able to nod or shake their head or to write down their decision. They must have the ability to communicate their decision somehow, but it does not have to be verbally.
4 The correct answer is A. Usually consent for treatment for a child under 16 years of age would be given by a parent or guardian, but some children under this age are mature and intelligent enough to be able to give their own valid consent – this is called ‘Gillick competence’. ‘Gillick competence’ is accepted by law as the right of a child under 16 years of age to make decisions about treatment that cannot be overruled by the parent or guardian. It applies in England and Wales, and there is a Scottish equivalent.
5 The correct answer is D. Whether the person giving consent is a parent, guardian, carer or Lasting Power of Attorney (or Welfare Power of Attorney in Scotland), all have a duty of care to the patient to make decisions that are always in their best interests under the Mental Capacity Act.
6 The correct answer is E. Previous to the introduction of GDPR it was commonplace for organisations to sell personal information to third parties for marketing, research and financial gain. For example, insurance companies holding clients’ dates of birth could sell the information to an organisation marketing holidays for elderly people, who would then contact these clients out of the blue with offers of tailored holidays for their age group. Apart from the annoyance of these ‘cold calls’, the clients had also not given permission for their details to be passed on in this way – it was a breach of their privacy that GDPR is aimed at preventing in future.
7 The correct answer is C. By definition, the word contemporaneous means ‘existing during or happening during the same period of time’, and while it is not always possible to write notes immediately after a patient leaves the surgery, they must be written that day at the latest, otherwise their accuracy will depend on the memory of the operator alone.
8 The correct answer is E. The workplace should hold subject access request templates for patients to make a written request to access their records. The information must be provided by the workplace within 1 month of receiving the written request, and the patient cannot usually be charged for the cost of printing, photocopying, postage, etc. by the workplace.
9 The correct answer is B. While two patients with the same first and last names does happen, the likelihood of them having the same date of birth too is highly improbable. In small dental workplaces there may only be one clinician (so every patient will be seeing that clinician), and the list of reasons for attendance will be limited too.
10 The correct answer is C. Although NHS regulations allow dental records to be retained for just 2 years (6 years in Northern Ireland), medico‐legally an adult’s records should be retained for 11 years and a child’s for the same or to the age of 25 years old – whichever is the longer. The Data Protection Act and the GDPR stipulate that data must be kept for no longer than is necessary.
11 The correct answer is D. Since the GDPR were introduced in 2018, data controllers (the ‘owners’ of the records) are not allowed to charge the patient an administration fee to copy the records. The only exception to this is if the request is deemed to be excessive – such as making several requests for the same information.
12 The correct answer is B. Under GDPR patients have various individual rights in relation to their dental records, including how the workplace shares their information with others, such as when referring them for second opinions or for hospital care. The actual process undertaken for data sharing should be laid out in the workplace’s Records Management policy, their GDPR policy and their Confidentiality policy.
13 The correct answer is E. Under the Freedom of Information Act a request can be made to any public organisation (such as the NHS) to release statistical information that they hold, such as the numbers of certain procedures performed annually, or the length of wait on a hospital list for a procedure, etc. However, it does not allow for the release
