A loss of patient record access stops a practice from functioning, as opposed to simply making life difficult for it. And in situations where there may also have been an exposure of personal data, a regulatory clock begins at the exact same time. We support practices, clinics and care providers throughout Cambridgeshire on both sides of this issue: restoring clinical system functionality, and preserving the evidence necessary for them to provide honest responses to the regulator. This is done in-house by our own engineers within the UK.
Clinical databases, imaging storage and practice servers: recovered under a signed data processing agreement, held only for as long as you want them to be, and not sent outside the United Kingdom.
Before the technical issue with your system, there is a regulatory issue, which has a deadline that is shorter than most people think.
If personal data has been either lost or made unavailable and there is a risk of harm being caused to those whose personal data was lost, UK GDPR requires that the ICO be notified no later than 72 hours after it becomes apparent that such loss occurred. It does not matter if it takes longer than 72 hours to finish the recovery or to determine the extent of the breach.
The reporting decision and the recovery will happen simultaneously (i.e., at the same time) rather than sequentially. We can provide you with information about what was impacted by the outage, and if it is readable, very early into the process; this information typically influences the initial notification. However, please do not delay the start of the clock until after receiving such an update.
Because clinical data may need to support ongoing patient care rather than record keeping, it will always carry a different level of importance. If this applies, state this during your initial call. This would also require us to adjust our priorities accordingly.
Practice management and imaging systems are generally deployed on either one server or a small array, and many times these systems have been backed up, but nobody has verified for some time whether the backups still work or not.
Radiology and imaging archive systems are an example of how the format in which images are stored can be as important as the storage media. In addition to restoring the image files themselves, the viewer must also be able to mount those restored image files.
Trial and/or study data fall under specific governance models, where maintaining both a chain of custody and an audit trail matters as much as recovery.
Diagnostic equipment writes data to either an internal drive or card. This is often on a legacy interface, because the device has outlived the software.
All work takes place internally. We do not sub-contract any of our services. Data never leaves the United Kingdom. One named engineer completes all work, from diagnosis to delivery. Therefore, the number of personnel who have access to the data is limited and documented.
We are also ICO registered, and documentation regarding chain of custody will be done as standard on this type of work (regardless of whether you request it). Also, prior to the media's arrival, we will sign your organisation's information governance terms. If a Data Processing Agreement is necessary, please advise at the diagnostic and we will have it completed by the time the data is sent.
Please ring instead of emailing, and say so on the phone call. When data is needed for patient care as opposed to just record keeping, this changes our priorities. We will honestly communicate with you about what data is recoverable and how long it will take.
If a breach affects personal data and puts the individual(s) who were affected at risk, the Information Commissioner's Office (ICO) requires notification to occur within 72 hours of the organisation being made aware. Instead of waiting until after the recovery, start the 72-hour clock now.
Yes, and before the media gets to us. Tell us when the diagnostic is run so that it is in place in advance rather than retrofitted.
That's the second half of the job so we're going to treat that as part of it. We have two different problems: recovering DICOM or a PACS store, and having the viewer mount it. We'll tell you which we can solve.
We have one named engineer working on it in-house, and we document the chain of custody at each stage. We do all our work ourselves, and therefore nothing is subcontracted out and no customer data ever leaves the UK.
The cost for a server or array starts from £500 +VAT. The cost for a single disk starts from £300 +VAT. All prices are agreed prior to commencement in writing after completion of your free 48-hour diagnostic.