Clinical privacy

A patient’s record holds the most private facts about them: their allergies and conditions, their vital signs, what the clinician wrote and found, and what the tests showed. Kila keeps these clinical details closed to everyone except the clinical staff caring for the patient, logs every time someone opens them, and keeps them off exports, reports, notifications and receipts. Kila calls these the Clinical privacy rules.

Every kind of health care business starts with them: a clinic, a dental or optical practice, a medical laboratory, a home care service.

The law says, Kila does

The law says	Kila does
A patient’s health information is sensitive personal data. A health facility that holds it registers with the Office of the Data Protection Commissioner (ODPC) and keeps it secure. Data Protection Act, 2019.	The clinical details of each patient are kept apart from the rest of their record and open only to the clinical staff caring for them. Data controller registration (ODPC) is on the compliance calendar with its renewal date.
Information about a patient’s health and treatment is confidential. Health Act, 2017.	A practitioner reads the patients they are seeing, or saw in the last 90 days. Nurses and the lab read the patients with a visit open at their branch. Everyone else sees the visit, its services and its bill, not the clinical record.
Everyone has the right to emergency treatment. Health Act, 2017.	In an emergency, a clinician who is not caring for the patient opens the record with a reason: Emergency access. It stays open for 60 minutes and waits for an owner’s review.
A patient is treated only with their informed consent. Health Act, 2017. The business must be able to show the consent it relies on. Data Protection Act, 2019.	The desk records each consent on the patient’s file, with the date and who recorded it. Without consent to Treatment, Kila opens no visit. Without consent to Sharing visit details with the insurer or scheme, Kila bills no insurer.
A patient may ask for a copy of their personal data, and for its correction or deletion. Data Protection Act, 2019.	The requests are recorded under Administration › Data and privacy. An owner gives the patient their data bundle, clinical record included. A request to erase is refused while the clinical records are kept.
Personal data is kept no longer than it is needed. Data Protection Act, 2019.	Clinical records are kept for 10 years after the last visit, or for the longer period you set.
Personal data is kept secure, and only what is needed is shared. Data Protection Act, 2019.	Clinical details stay out of the business data export, out of the clinic reports for staff who are not clinical, and off receipts, notifications and the waiting-room screen.
A health facility works only under a valid licence from its regulator. Your regulator, such as the KMPDC.	Settings keep the licence number, the regulator and the expiry date, and the licence shows on the compliance calendar with that date.

The law says

Kila checks what it can check: who is caring for the patient, the consents on their file and that a reason is given for emergency access. It cannot check that the reason is true, or that the patient understood what they agreed to: the owner’s review and the desk’s care do that. Kila’s 10 years is a starting period, not one taken from the Acts above. Ask your regulator or your data protection adviser how long your facility must keep its records, and set a longer period if you need one.

Set it up

The owner records these once, under Administration › Settings › Clinical privacy: “The facility’s registration, who answers data protection questions, the consent patients give, and how long clinical records are kept.” Kila’s set-up list has it as Facility licence, MFL code and data protection contact.

1. Enter the Facility registration or licence number, the Regulator and when the Licence expires. Then the MFL code (KMHFR), “Printed on MOH returns, claims and documents.”, the Facility level and the SHA facility code.
2. Enter the Data protection contact, with an Email and a Phone: the person who answers patients’ questions about their data.
3. Check the Consent read to patients at registration: what the desk reads to a new patient before recording their consent.
4. Leave Keep clinical records for (years) empty to keep them for 10 years after the last visit, or enter more years: “A longer period here wins.”
5. Under Clinical staff by role, tick the roles in each group: Practitioners (“Doctors, clinical officers, dentists, optometrists.”), Nurses (“Triage and nursing care.”) and Laboratory (“Lab staff who enter and release results.”). Kila ticks the roles whose names match, under Suggested from your roles’ names. Check them. “Only owners change this.”
6. Tap Save changes.

Zoom

Steps 1 to 4.

Zoom

Step 5.

Each practitioner set up under Clinic office › Practitioners and rooms reads their own patients’ records too: Set up practitioners and their registrations.

Who reads what

Part of the record	Who reads it
Allergies and conditions	Practitioners and nurses
Vital signs	Practitioners and nurses
Notes and diagnoses	Practitioners
Results	Practitioners and the lab

Each of them only for the patients they care for: a practitioner for the patients they are seeing or saw in the last 90 days, nurses and the lab for the patients with a visit open at their branch. A nurse who opens a visit reads the allergies and the vital signs, never the doctor’s notes.

Everyone else, such as the desk and the managers, works with the visit, its services and its bill. Where the clinical record would be, they see:

Kila shows:

Clinical notes, diagnoses and results are visible only to the clinical staff caring for the patient.

In an emergency

A clinician who is not caring for the patient sees, on the patient’s visit:

Kila shows:

You are not caring for this patient, so their clinical notes are closed to you.

When the patient needs care now and their record matters, such as their allergies before giving a medicine:

1. Tap Emergency access.
2. Under Why do you need it now?, write the reason. “Your reason, the time and what you read are logged and reviewed.”
3. Tap Open the record.
4. Kila says “Record open for 60 minutes. This access is logged and will be reviewed.” The record opens, marked Emergency access: “You opened this record in an emergency. Your access is logged and will be reviewed.”

Zoom

Step 1.

Zoom

Steps 2 and 3.

Zoom

Step 4.

Only clinical staff have Emergency access. The desk, the cashier and the managers do not: they call a clinician.

Review emergency access

Each emergency access waits for an owner’s review, under Clinic office › Clinical access log: “Who opened or wrote which patient’s clinical record.”

1. The notice at the top says how many wait, such as 2 emergency accesses to review: “Check each reason with the person who opened the record.”
2. Choose Emergency access to review.
3. Tap Review on a line. The review shows who opened the record and their reason.
4. Ask them about it, and write What you found.
5. Tap Mark reviewed. The line then shows “Reviewed:” and your note.

Zoom

Steps 1 to 3.

Zoom

Steps 4 and 5.

Every access lists the whole log, each line marked Opened, Wrote, Refused, Emergency access or Data request, with the patient and any reason.

When a patient asks about their data

Record the request under Administration › Data and privacy, which covers “your customers’ rights under the Data Protection Act, 2019”: tap New request, choose what they asked for, find the patient, and tap Record request. Kila says “Work through it from the request. Aim to answer within 7 days.”

A copy of their data (access). On the request, under Give them a copy, an owner taps Download data bundle. The bundle has the patient’s clinical record, their allergies, notes and diagnoses included, and the Clinical access log shows it as a Data request. Write How it was provided and tap Complete request.

Erase their personal data. While the clinical records are kept, the request shows Cannot erase yet:

Kila shows:

Cannot erase yet

Clinical records are kept for 10 years after the last visit (until 2036-10-30). Tell the customer what is kept and why, then close the request with that explanation, or erase once these are cleared.

Tell the patient, then tap Close without action, with an explanation, write the Explanation to the customer and tap Close with explanation.

Zoom

What stays private

• The business data export. “Only owners export; passwords, keys and secrets are never included. Links work for 24 hours.” In the export, a patient’s allergies, vital signs, notes and diagnoses read (clinical: left out).
• The clinic reports. Where the diagnoses would be, staff who are not clinical see “Diagnoses are clinical details: clinical staff see their counts here.”
• Receipts list the services and the amounts, never the diagnosis or the notes.
• Notifications about a patient name the visit, not the patient: see Enter and release lab results.
• The waiting-room screen shows numbers and rooms only: see Run the front desk.

Registers and reports an inspector may ask for

• Clinic office › Clinical access log: every opening of a clinical record, every change and every refusal, with the emergency accesses and their reviews.
• Clinic office › MOH reports: “MOH 705A, 705B and 717 from the month’s visits, diagnoses, lab work and admissions: counts only, ready for KHIS.”, with your MFL code printed on them.
• Branches › Compliance: the facility licence from Settings, Health facility licence (KMPDC), Data controller registration (ODPC), MOH monthly returns to KHIS (705A, 705B, 717), SHA contract (empanelment), Health care waste collection contract, Laboratory licence and Radiation licence for X-ray equipment, each with its date, and each practitioner’s practising licence.
• Administration › Data and privacy: the patients’ requests, each step of them audited.

Common questions

Why does the nurse not see the doctor’s notes? Nurses read the allergies, the conditions and the vital signs. The notes and the diagnoses are for practitioners. To change who reads what, the owner moves the role to another group under Clinical staff by role.

A patient wants their records deleted. Kila keeps clinical records for 10 years after the last visit, so the request cannot be completed now. Tell the patient, and close the request with that explanation.

Can the desk open a record in an emergency? No. Emergency access is for clinical staff, and only for the patients they are not already caring for. The desk calls a clinician.

Related

• Health care: how Kila works for a clinic.
• Register a patient: consent and allergies at the desk.
• Bill a visit: consent before an insurer is billed.
• Set up practitioners and their registrations.
• Selling medicines: the rules for a clinic’s own pharmacy.