Healthcare: Completing a Data Protection Impact Assessment (DPIA)

Will the service/project use systematic and extensive profiling or automated decision-making to make significant decisions about people?

If you have selected ‘Yes’ above, where? 

Video: Dublin, Ireland (Amazon Web Services)

AI Analysis of video transcripts: Sweden (Microsoft Azure) - Optional Feature

The organisation wishes to implement iConnect, a secure digital platform that enables trainee healthcare students, healthcare professionals, supervisors, and trainers to record, share, and review learning and practice-based activities through a role-based login system. Once uploaded, recordings, reflective notes, or case-based discussions can be selectively shared with supervisors, trainers, or peer groups within the organisation, or across partner institutions, subject to approval by Data Protection Officers.

The platform provides tools that enable analysis of recorded practice, structured feedback, and reflective discussion in line with high-quality professional education and training standards. Trainees and professionals can use iConnect to reflect on their clinical practice, receive constructive input from supervisors, and access examples of best practice. Over time, the system supports healthcare professionals to refine their clinical and professional skills, strengthening both individual competence and overall quality of care.

This data processing has a number of risk considerations which must be taken into account:

1. Use of New Technologies 

 The AI analysis tools within the iConnect system are supplementary and optional but can potentially introduce new risks. The iConnect implementation and advice on how to use them reduces the risks associated with such processing such as not supporting automated decision-making, profiling, or large-scale analysis of personal data.

 While digital video platforms are becoming mainstream for trainee professional development, the system is still relatively new to the sector and therefore may be considered an innovative organizational solution.

2. Processing of Genetic Data

Whilst the processing of genetic data may only occur incidentally, through captured conversations with patients, it remains possible. A DPIA is therefore required when processing special category data, as this type of information is highly sensitive and, if misused or exposed, could cause significant harm such as discrimination, loss of privacy, or damage to an individual’s rights and freedoms.

3. Processing and Storage Outside the UK
   iConnect involves the processing and storage of personal data in jurisdictions outside the UK, namely, in the EU. While that may be considered a risk, the data storage in the EU is compliant with UK data security regulations, such as the UK GDPR and the Data Protection Act 2018 (DPA 2018), because the UK government has made an adequacy decision for the EU, recognizing its data protection regime as providing an equivalent level of protection.
4. Risk of Harm

Whilst the processing of special category data may only occur incidentally, through captured conversations with patients, it remains possible. A DPIA is therefore required when processing special category data, as this type of information is highly sensitive and, if misused or exposed, could cause significant harm such as discrimination, loss of privacy, or damage to an individual’s rights and freedoms.

Describe the nature of the processing:

how will you collect, use, store and delete data? What is the source of the data? Will you be sharing data with anyone? You might find it useful to refer to a flow diagram or other way of describing data flows. What types of processing identified as likely high risk are involved?

Data Collection:

Video data is collected via the dedicated iConnect ‘Record’ mobile application which encrypts the video locally and automatically uploads to the user’s account on the iConnect servers. All data in transit is encrypted. Once the upload is completed the video is automatically deleted from the local device. 

For further information about the Record app - see here

Data Access:

Data is accessed via the iConnect platform. This is a highly secure closed system which operates role-based login and privacy by design. Once the video is uploaded only the user who recorded the video has full access to it.  

Further information about the iConnect security measures and controls can be found here

The user has control of the deletion and sharing of the video. Sharing between users of the same organisation is enabled by default. By mutual agreement DPOs at different organisations may vary this scope to enable sharing between users at their organisations under the auspices of a separate data sharing agreement. 

Downloading of video is disabled by default. 

Further information about iConnect’s approach to downloading can be found here

Sharing can only take place via the iConnect web platform via user accounts. If user A shares a video with user B, user B does not have the ability to share or download the video. 

Further information regarding sharing can be found here.

iConnect operates strict controls over who may access data and protocols for gaining permission from clients if access is required.

SARs can be managed through the videos being tagged automatically by date and the user who recorded it. Additional data of title and tagging is recommended to be added by the user post recording. 

Administration:

The following users will be set up as system administrators:

1)

2)

3)

Administrators have access to thumbnail images drawn from the videos uploaded, so that they can see a basic preview of the content to ensure that all video uploaded is appropriate.  

Further information regarding the roles and responsibilities of administrators can be found here.

Data Compliance and Safeguarding

Appropriateness will be based upon the videos meeting the purpose of the data processing; user professional development, and to consider any safeguarding needs are being met.

Thumbnails provide a general overview of a video to highlight any obviously inappropriate content. When reviewing the thumbnails, if the admin has any concern of the content and appropriateness of the recording they can request full access via the feature within the platform. The admin can also delete any video from this interface. 

Further information regarding the safeguarding features of the system can be found here. 

Personal Data

Personal data that will be captured within the iConnect system includes:

1) User account information:

User’s avatar (profile picture), email address/username, first name and second name

2) Video data:

Recordings will include faces and voices of anyone present within the room, although this can be minimised through the use of camera placement/audio only mode/ anonymisation mode and the editing feature. 

Further information on data minimisation tools of the iConnect system, can be found here.

Video will be gathered with full knowledge of data subjects. This will be made clear to the patients by the healthcare professionals  conducting the recording and in compliance with the NHS Guidance on recording patients consultations for training, education and assessment purposes.

The purpose for data collection is for professional development.

Describe the scope of the processing:

Thinking about the proposed processing of personal data, describe the flows of personal data, i.e., where it is first collected, where it is used, how it is used, where it is shared, how it is stored and when it is deleted. 

Collection of data:

The nature of the data collection is video of patient consultations with both real patients and role play. The video may be anonymised via the use of the iConnect anonymisation feature. If the video is not anonymized, the participants’ appearance will be apparent. 

The anonymisation feature will be off by default, however the organisation may decide to utilise this feature for particular needs such as with data subjects who require additional safeguarding, or when sharing data outside of the organisation. 

Additionally, if the user refers to the patient by name, the video may include the name of and appearance of a data subject.  

The organisation plans to enable each user to use the system several times per year. Therefore we envisage an average of 20 recordings of an average duration of 15 min, so 5 hours per year, per user. [update for planned usage]

The recording start and end time are controlled by the individual user. Recordings can range from a few minutes to full consultations. 

All members of organisation staff and all patients are potentially subject to data processing within the iConnect.

iConnect recordings will be exclusively restricted to learning environments on the organisation site.  The devices used for video capture are mobile devices that can record sections of a room (less than 180 degrees), however dual view recordings with two devices used at the same time may be used.

The aim of the recording is to capture as much of the environment as possible. Both staff and patients will be recorded in the video, so that the system can provide a high-quality professional development experience to the user. It is understood that the personal data of both staff and patients will be processed by the system.

Use of data:

Only a small proportion of this data is likely to be shared between users and an even smaller fraction shared via inter-organisation collaboration.

Within the iConnect platform, users are able to share with other users within their organisation, who also have an iConnect account. Sharing can only take place via the platform. 

The platform supports collaboration with other users from other organisations. This must be requested and then approved by the organisation’s administrators. Further information regarding sharing can be found here

Sharing can only take place via the iConnect web platform via user accounts. If user A shares a video with user B, user B does not have the ability to share or download the video. 

Further information regarding sharing can be found here.

iConnect operates strict controls over who may access data and protocols for gaining permission from clients if access is required.

Storage of data:

Data will be stored with the iConnect platform for the entirety of its lifecycle. Any requirements to export outside of the platform must be approved by the administrator and enabled by iConnect. 

Data Retention/Deletion of data:

Customer data is deleted by the user when no longer required or by the organisation in line with their data retention policy or by iConnect in line with its data retention policy. 

The organisation will keep the data whilst it is still needed for user professional development.

The organisation will delete data when:

- it is no longer useful for the user’s professional development. This will be managed by the individual users who will review their recordings as required by their organization policy. This will be communicated to the users via the DPO)

- the user leaves the organisation. This will be managed by the administrator.  

Many videos will cease to be useful after an initial round of review and feedback and will be deleted. 

The data subjects are the healthcare professionals and the patients. 

• The healthcare professionals will have control over what and when to record and who it will be shared with.
• The patients will have the option to opt out of being recorded or can request the camera does not capture them either through the use of the anonymisation filter, camera placement, or using audio recording only.

There has always been a degree of concern within society pertaining to the collection of video data, however, once the purpose, scope and security measures are explained this tends to lead to very low levels of objection.  Patients will be informed by our privacy notice and will have the right to opt out of being recorded.

Recording of minors and vulnerable groups will not take place [delete according to your usage plans]

There are no known security flaws in the iConnect system which has operated for over a decade without incident. The iConnect system is a mature platform which is well supported and has a high level of compliance with data security best practices. 

iConnect has completed the DSPT, and is annually certified with Cyber Essentials Plus
 

Is what you are proposing to do part of a project?

Please populate below according to your usage plans

Section 2: Necessity and Proportionality

The only alternative to video-based observation and professional development is in-person observation and monitoring. The limitations of this, covering time, ineffectiveness, and lack of scalability lead to video being deemed the only effective approach for professional development, both in terms of cost and results.

Explain your answer to 2.2. 

Describe the purposes of the processing: what do you want to achieve? What is the intended effect on individuals? What are the benefits of the processing – for  you, and more broadly?

Purpose, Intended Effects & Benefits

Significant educational and clinical research shows that the quality of healthcare professionals, and therefore the quality of their training and ongoing professional development, is the single largest controllable factor affecting patient outcomes and the safety of care. Consequently, there are multiple statutory and regulatory requirements for healthcare staff to engage in and promote continuous professional learning within and across healthcare organisations. Yet, such obligations are often difficult to achieve given the barriers of time, distance, staffing pressures, and cost.

These barriers can be overcome through the use of secure digital video and collaboration technology. By removing the practical obstacles to effective professional learning, we can engage more healthcare professionals more frequently in high-value development activities such as reflecting upon their practice, analysing and refining their impact on patient care, observing examples of best practice, and giving and receiving high-quality contextualised feedback from supervisors.

In educational settings, 95% of users using iConnect report improvements in their professional practice. Our objective is to achieve these same benefits in the healthcare context, supporting trainees, supervisors, and practising professionals to continually improve. In turn, this will lead to safer, higher-quality care and improved outcomes for patients, with significant and wide-reaching societal benefits.

Why is the use of video necessary to achieve these objectives?

There is now a substantial body of evidence demonstrating that the use of video enhances both healthcare professional self-reflection and clinical supervision and training, as it helps to address fundamental cognitive biases and flaws in recollection that arise during practice.

 For trainees, video-based learning provides a powerful tool for structured training, enabling them to observe and reflect on their own performance, receive targeted feedback from supervisors, and access a wider range of examples of best practice. 

Video also supports a higher frequency of supervisory interactions, as well as broader access to training opportunities, than traditional in-person observation methods alone.

We therefore deem it justifiable to collect the data items listed with this document. 

Function creep will be avoided through our commitment to the use of iConnect solely for the use of training and professional development. 

This is a requirement of the iConnect system and stated within the DPA:

4.4 Management of Use:

The iConnect system is for professional development, educational research and learning development, consequently, you agree:

4.4.1 To ensure that the use of the system is aligned with the stated purpose and that the system is not used for surveillance of staff or learners

Users will be made aware of this during their iConnect training and a communication will be sent out to all staff from the DPO.

Additionally, we will maintain an ongoing open door policy for staff to be able to report use of the system which is not aligned with the purpose.

Data Retention

Data will be minimised to what is necessary through ensuring the users only record and retain what is useful for their professional development. This will be managed by the individual users who will review their recordings on a [enter time frame] basis. This will be communicated to the users via the DPO and added to the organisation’s data retention policy. 

Additionally data will be deleted when the trainee/GP leaves the training cohort GP/practice. This will be managed by the iConnect administrator. 

Reporting

We will have a clear procedure for users to be able to report inaccurate data which will be communicated by the DPO

Minimisation tools

iConnect has several tools that assist users achieve data minimisation such as editing and anonymisation. See these articles on data capture and data retention.

Quality of Video Data: iConnect ensures that the video data is of high quality and clearly captures the necessary details, sufficient to fulfil the purpose for the data processing. This involves having good resolution, good quality microphones and tripods to aid the recording quality and to avoid misinterpretation. Videos can be easily edited within the platform if any discrepancies are identified. Please see here for editing information.

Metadata Accuracy: Users will be instructed to ensure that the metadata associated with the video data, such as title, comments and tags are accurate. These elements can be easily edited within the platform if any discrepancies are identified.

Data Storage and Handling: By using iConnect system for storage this will ensure the data is robustly and securely stored to prevent data corruption or loss. Regular backups and data integrity checks are part of their security measures and controls.

User Training: We will ensure staff who will use the iConnect system are trained in proper procedures to ensure consistency and accuracy in recording and processing the data.

We will operate a multi-faceted stakeholder engagement and consultation. We will actively inform patients including the purpose and provide them with clear mechanisms to ask questions and object to processing.

We will engage users from the healthcare profession in a programme of orientation and induction which makes clear the system's privacy by design model, as well as their rights and obligations in the use of the system. 

We will clearly communicate that the use of the system is on an opt-in basis. [delete if use if required for your users]

We will engage our network manager in a review of the iConnect system to ensure that it is compatible with our network and does not present a security risk.

Section 3: Special Characteristics

This section considers the special characteristics of the personal data that could be processed. The law establishes that certain types of personal data presents greater degrees of risk than others, and as a consequence has to be treated differently.

Financial Information…………………………...

If “Yes”, does this include credit card info?.....

If “Yes”, please provide additional details about the personal data:

Likely to be collected through video and audio recordings

If “Yes”, please provide additional details about the personal data:

Likely to be collected through video and audio recordings

If “Yes”, please provide additional detail about the personal data:

Likely to be collected through video and audio recordings

If “Yes”, please provide additional details about the personal data:

Possibly collected through video and audio recordings
 

If “Yes”, please provide additional details about the personal data:

Likely to be collected through video and audio recordings

If “Yes”, please provide additional details about the personal data:

Possibly collected through video and audio recordings
 

Section 4: Lawfulness of Processing

In order to assess the level of risk associated with the personal data and its proposed use, it is necessary to look to the justification for processing.

On what basis will the personal data be processed? Tick all relevant conditions below.

For information on the Lawful Bases set out below, click here.

Please note that if you have identified that the processing will involve special category data (2.2). above, then additional conditions for processing detailed in 3.7. – 3.16. will need to be identified. 

For more information on the lawful bases for processing special category personal data, click here. 
 

☐

Processing is necessary for compliance with a legal obligation

If so, what legislation places this obligation on the organisation?

☐

☐

Processing is necessary for the performance of a public task. 

☐

What legislation supports the public task being carried out? 

Does the processing actually achieve your purpose? 

Is there another way to achieve the same outcome? 

How will you prevent function creep? 

How will you ensure data quality and data minimisation? 

What information will you give individuals? 

How will you help to support their rights? 

What measures do you take to ensure processors comply? 

How do you safeguard any international transfers?

Answer below:

    ☐

If consent (3.6) has been selected, then please answer the following: 

Can an individual(s) withdraw their consent with ease and whenever they want to? *

 *Individuals should be able to withdraw consent at any time and every step the processing of their information without detriment. It should be as easy to withdraw consent as it is to give it. Consent requires prior information and an explicit indication of the consent, separate from other individual options (like accepted terms and conditions)

Yes:

   ☒

No:

☐

Lawful Basis for Processing

The lawful basis for processing video data in the context of healthcare professional development and training is Consent

Providing Consent

Patients will be asked prior to recording if they consent to being recorded

Following a positive response the user will start the recording and get the consent from the patient recorded on the video.

At the end of the recording, before stopping the recording the user will again ask the patient if they still consent and then will subsequently save or delete the file.

A note will be made on the patients file that the consultation was recorded so it will be easy to locate later on if consent is withdrawn.

Withdrawing Consent

Users can contact the organisation if they subsequently decide to withdraw their consent. 

Is there another way to achieve your objectives:

User reflection central to professional development is virtually impossible to achieve meaningfully without the use of video. 

To provide users with the same frequency of high impact professional learning interactions would be impossible for the organisation through other means. The process of experiencing high quality teaching and giving and receiving high quality feedback, in the absence of video collaboration, would require in-person consultation observation.  

In-person consultation observation represents a subjective one-off experience, with no record for analysis and discussion post event. This leads to low quality professional discussion with lower impact upon professional practice. 

Additionally in-person observation requires another professional to be available to provide the physical observation and debrief process. Within a busy organisation environment this will entail significant additional cost for the organisation as we would have to employ more cover staff to free up the observer. 

The process of providing high quality examples of teaching practices is even more difficult to achieve through other means. It is difficult to know when it would occur so you would have little control of whether the observing user would get the experience they would need from their observation. Furthermore, the organisation would like all staff to have a shared understanding of what a high quality practice looks like. It is physically impossible to fit the entire teaching staff in a single classroom on the off chance a particular high strategy will be demonstrated with sufficient quality.

Finally inter-organisation collaboration would be very difficult through other means. It would have all of the drawbacks already identified with the addition of significant travel and accommodation costs.  

Function Creep:

We will prevent function creep by making a clear declaration of purpose and maintaining an ongoing open door policy for staff to be able to report use of the system which is not aligned with the purpose.

Data quality and data minimisation:

The iConnect system will collect high quality video and audio sufficient to fulfil the purpose. We will ensure that all analysis and data entry is as accurate as possible. We will have a clear procedure for users to be able to report inaccurate data. Video data will not be kept for longer than its useful purpose in line with the organisation’s data retention policy. 

Information and rights: 

Organisation staff will be informed via our onboarding consultation and training process, the DPO will be responsible for ensuring that staff are aware of their rights and know how to exercise them. Patients will be informed via appropriate notices and will have a clear pathway to raise their objections. 

Compliance of Processors

We have engaged with iConnect to ensure their policies and procedures are compliant with the GDPR.

For the processing of special category data, you need to identify a legal basis (4.1 – 4.6) as well as at least one of the conditions below (4.7 – 4.16):
 

The data subject (or subjects) has given explicit consent. (Seek DPO advice)

If consent (3.16) has been selected, then please answer the following: 

Can an individual(s) withdraw their consent with ease and whenever they want to? *

*Individuals should be able to withdraw consent at any time and every step the processing of their information without detriment. It should be as easy to withdraw consent as it is to give it. Consent requires prior information and an explicit indication of the intent to consent, separate from other individual options (like accepted terms and conditions)

Yes:

☐

No:

☐

Section 5: Secondary Uses of Personal Data

This section examines whether the processing will involve secondary uses of personal data, for example by re-using information which was gathered for a different purpose originally.  

Will the proposed processing involve the use of existing personal information for new purposes?

(For example a CRM system that will enable certain data about clients to be combined with other data and used in a new way.)

Yes:

☐

No:

☒

Yes:

☐

No:

☐

Section 6: The Rights of the Data Subject

This section examines whether the rights of individuals are protected and supported. 
 

Individuals have the following rights in respect to the processing of information about them. They are:

• The right to be informed;
• The right of access (Subject Access Request);
• The right to rectification;
• The right to erasure (deletion);
• The right to restrict processing;
• The right to data portability;
• The right to object;
• Rights in relation to automated decision making and profiling.

You can find more information on these rights here.  

Yes

☒

No

☐

Yes

☒

No

☐

Yes

☒

No

☐

Yes

☒

No

☐

Yes

☒

No

☐

Yes

☒

No

☐

Yes

☒

No

☐

Yes

☐

No

☒

Section 7: Accuracy and Currency of Personal Data as a Safeguard

Yes

☒

No

☐

Quality of Video Data: iConnect ensures that the video data is of high quality and clearly captures the necessary details. This involves having good resolution, good quality microphones and tripods to all aid the recording quality and to avoid misinterpretation. Videos can be easily edited within the platform if any discrepancies are identified. Please see here for editing information.

Metadata Accuracy: Users will be instructed to ensure that the metadata associated with the video data, such as title, comments and tags are accurate. These elements can be easily edited within the platform if any discrepancies are identified.

Data Storage and Handling: By using iConnect system for storage this will ensure the data is robustly and securely stored to prevent data corruption or loss. Regular backups and data integrity checks are part of their security measures and controls.

User Training: We will ensure staff are training who will use the iConnect system in proper procedures to ensure consistency and accuracy in recording and processing the data.

☐

☐

Mostly LOW

Low has been selected here due to the purpose of the data collection on iConnect. The data is being used solely for professional development. Therefore, if video data or user account data that is being processed and stored within iConnect is not accurate or up to date there is limited impact to that professional development process or any secondary impacts.

☒

Section 8: Third parties and Commercial Partners

Yes

☒

No

☐

(If selected, please proceed to the next Section).

iConnect and the organisation will enter into a Data Processing Agreement. A copy of which can be found here

Is it likely that the organisation will engage with sub-contractors (known as sub-processors)

These are listed within Appendix B of the DPA

Yes

☒

No

☐

A CONTROLLER: 

A natural or legal person or organisation which determines the purposes and means of processing personal data.

☒

A PROCESSOR:

A natural or legal person or organisation which processes personal data on behalf of a controller. The organisation’s Contractors and suppliers are usually processors if they process personal data solely on its behalf.

☐

A JOINT CONTROLLER (Controller in common):

A natural or legal person or organisation which, with another Controller or Controllers jointly determines the purposes and means of processing personal data.

☐

Section 9: Security Measures

The iConnect system is a closed system that requires user authentication to record and access uploaded data. Taking into account the existing policies that are in place with regard to cyber security and passwords, no additional measures are required. 

Please follow this link to access a full list of iConnect’s security measures and controls.

Yes

☒

No

☐

Yes

☐

No        N/A

☒          ☐

iConnect is used by 1000s of organisations internationally. They have very high security standards and have achieved Cyber Essentials Plus and conform to NIST standards.

All data covered under this DPIA will be processed and stored by iConnect. 

Yes

☒

No

☐

Section 10: Retention of Personal Data

☐

Information is to be retained for a specific period after the completion of the proposed processing.

☒

For how long?

As long as the user remains an employee of the organisation or until the data is no longer useful for the user’s professional development. Users will review their recordings [enter time period].

Section 11: International Transfers of Personal Data

This presents a risk as not all countries ensure the same level of protection for personal data.

Will the proposed processing involve transferring, storing and/or disclosing personal data to a country or territory outside of the European Economic Area (EEA)?

The EEA consists of the following countries: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Liechtenstein, Lithuania, Luxemburg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, and Sweden, 

Yes

☐

No

☒

(If selected, please proceed to the next Section).

The data is processed in Ireland, Dublin

If yes is selected in 10.1., are measures in place to ensure an adequate level of security if personal data are transferred outside the EEA?

Yes

☐

No

☐

☐

☐

☐

Section 12: Consultation Process

This section describes when and how individual’s views will be sought, or details why it is not appropriate to do so. 

Yes

☐

No

☒

Yes

☐

No

☒

Yes

☐

No

☒

Documentation 

Please provide a copy of, or a link to, any supporting data protection documentation, such as a privacy notice (either produced by the service or a third party), sharing agreements or contracts etc.

Describe the source of risk and nature of potential impact on individuals 

(Include associated compliance and corporate risks as necessary)

Data breach  

Subjects not expecting their data to be processed in this way

The system not being used for the intended purpose

Individual patients withdrawing consent on an ad hoc basis

The iConnect system adheres to the highest standards of data protection and security. 

Further information about the iConnect security measures and controls can be found here

Password policy strictly enforced throughout the organisation

Clear privacy notices, patients, staff and trainees engaged and informed. Home organisation agreement aligned with use and clear pathways to opt out open to all parties

A clear organisationwide statement of purpose and an open door policy for users to report instances of the system being used in a way which is not aligned with purpose.  

Training provided to all users. 

Use of data minimisation strategies to not capture certain data subjects  - anonymisation/editing/camera positioning or not recording some consultations if patients have opted out.

Likely

4

8

12

16

20

Possible

3

6

9

12

15

Unlikely

2

4

6

8

10

Rare

2

3

4

5

Insignificant

Minor

Moderate

Major

Catastrophic