Hospital privacy notices and consent

Overview

A hospital asked the NPC to review a combined notice and consent document. The NPC explained that a privacy notice informs patients about processing; it is not itself consent. It called for clearer purposes, recipients and retention periods, with a stated basis for those periods.

Practice implications

Parao Law practice guidance

For physicians

Make the notice readable at registration and explain who may receive information, why it is used and how patients exercise their rights. If a signature merely acknowledges receipt of the notice, label it that way. Seek a separate, purpose-specific consent when consent is the lawful basis.

For lawyers

Inventory each processing purpose and identify its lawful basis. Describe categories of data, recipients and retention in the notice. Verify any stated retention period against the relevant rule or policy; the periods in the hospital’s draft were not NPC-wide mandatory periods.