Glossary, regulation and privacy
What is a DPIA?
A data protection impact assessment (DPIA) is the documented assessment an organisation carries out before processing personal data in a way likely to put people at high risk. It describes the processing, weighs the risks to the people concerned and records the measures taken to reduce them.
Updated . Defined by the wai team for clinics, groups and health systems.
Also called data protection impact assessment.
Why DPIA matters to a clinic
Under UK GDPR a DPIA is mandatory for large-scale processing of special category data, which includes health data, and the ICO gives a hospital as an example of large scale.1 New technology such as AI counts towards the need for one when it is combined with another risk factor.1
In practice, clinics and groups introducing an AI scribe or a new patient messaging channel are usually asked for a DPIA by their data protection officer, their insurer or the NHS body they work with. The vendor's answers on hosting, access, retention and subprocessors are what fills it in.
Questions
Who writes the DPIA, the clinic or the vendor?
The clinic, as the controller of its patients' data. The vendor supplies the facts about its processing, and a good one answers every question in writing. See security.
Does an AI scribe need a DPIA?
Usually. It processes health data with new technology, which is the combination the ICO treats as likely to need one.1
Sources
See wai on your own clinic.
A 15 minute video call on your own diary, notes and inbox. Prices for clinics, groups and hospitals are on the pricing page.