What to do when your client requests that you destroy all of the notes that you hold on them
By Claire Squire, Balens Ltd
Have you ever thought about what you would do if a client told you they want you to erase all the data you hold about them? What does this mean? What would the implications be if they later made a complaint or claim against you, and you had no records of what was said or done to defend yourself? This short article will explore an individual's legal Right of Erasure as defined by the 2018 Data Protection Act, and your rights as a practicing Therapist to retain information to defend yourself in the event of a potential Claim situation.
Right of Erasure
The 2018 Data Protection Act gives all natural persons a Right of erasure where a business or organisation holds personal information about them. However, this Right is not absolute, and there are certain circumstances in which the business or organisation may refuse such a request for data to be deleted. These are, as noted on the Information Commissioner’s Office website:
to exercise the right of freedom of expression and information;
to comply with a legal obligation;
for the performance of a task carried out in the public interest or in the exercise of official authority;
for archiving purposes in the public interest, scientific research, historical research or statistical purposes where erasure is likely to render impossible or seriously impair the achievement of that processing; or
for the establishment, exercise or defence of legal claims.
Please see: Right to erasure | ICO
How long should data be kept?
Insurance policies are contracts, and thus legal documents, between the Insurer and the Insured, and will have attached Terms and Conditions that both parties must comply with. For a Professional Liability Insurance policy, these typically include record-keeping requirements, including a condition that notes from any Treatment sessions be kept for a specified period. For example Balens Professional Liability Insurance policy requires therapists to hold client records for a period of 7 years. The policy wording specifically notes:
The record shall be kept for at least 7 years following the last occasion on which
treatment was given. In the case of treatment to minors, it is advisable that records
should be kept for at least 7 years after they reach the age of majority (18).
The policy wording notes ‘at least X years’ to account for the Statute of Limitations on the different types of Claims that the policy will cover. When treating minors, it is important to note that the period of the Statute of Limitations is from the date when they reach the age of majority, not the date of the treatment, or when an issue that may give rise to a claim was discovered. However, in certain instances these Statutes may be extended, for example, in the case of ‘vulnerable adults’ depending on the vulnerability, hence the term ‘at least’. The practitioner may choose to stipulate an extended period under specific circumstances, where they can justify this need.
Therapist’s records will form part of their defence should any client wish to make a claim against them, which is why insurers require the records to be kept. As noted above, the 2018 Data Protection Act allows records to be kept ‘for the establishment, exercise or defence of legal claims’ and therefore exempts individuals and businesses from any Right of Erasure request they may receive until at least the period stated in their insurance policy wording has elapsed. This principle does not apply to any one practitioner or client. It is standard for all Professional Liability Insurance policies where the Insurer requires records to be kept, as noted within their Terms and Conditions and policy wordings.
Privacy Notices
In the UK, all businesses and organisations that hold personal data about any living natural person must, by law, have a Privacy Notice that advises their clients of how they will process their personal data. The document should note the business’s data retention policy, i.e., how long it will hold personal information. As noted above, if your insurance policy documents require client information to be held for a minimum of X years, or X years past the age of majority for minors, this should be noted within the Privacy Notice.
Anyone who processes Special Category data, which for many Health and Wellbeing Professionals would include their client’s ‘Health’ data, must have a Lawful basis for processing this information. Following consultation, the UK 2018 Data Protection Act has included the processing of this special category data under ‘processing in the substantial public interest for Counselling etc.’ and ‘insurance’. This information should also be noted in your Privacy Notice if and where applicable.
What information to retain?
The 2018 Data Protection Act notes that records should be kept for ‘no longer than is necessary’, but does not stipulate what this means in terms of types of information or length of time. The individual therapist would determine what information they need to retain to comply with their insurance policy terms. At Balens, we note that the purpose of the records is to provide a defence in the event of a potential claim, and therapists therefore need to record, as a minimum, details of the Treatment provided – specifically related to processes and procedures. These should include a record of:
Dates, times, locations of the treatment given and for whom;
What treatments were performed/given;
Details of any products used;
Confirmation of patch testing where necessary (check product and policy wording requirements);
Any advice given, including aftercare;
Details of medical information, but only where this may result in a contraindication; for example, it would be relevant for a Massage Therapist / Aromatherapist to know and note in their records if a client is pregnant or has a nut allergy, as this would have an impact on the oils that are used.
It will generally not be necessary for you to retain other sensitive personal information that a client may have divulged, although your Professional Association may have additional requirements regarding record keeping, and for Counsellors or similar professions the therapist may determine that there are specific elements that will need to be kept, that may be relevant to the therapeutic process.
How to respond to a Right of Erasure request
Where a therapist has received a request from their client regarding a Right of Erasure, they will need to respond to this within one calendar month.
We recommend that the therapist advise their client that they (the therapist) must comply with Insurers’ Terms and Conditions, as allowed by the Data Protection Act, and retain the records necessary to defend a legal claim if required. Any additional or supplementary data that is not relevant to the defence of a potential claim can be deleted as required. We also suggest that therapists advise their client that they will note when the insurance policy retention period has lapsed and can then erase the full records, as requested. These details should then be noted on the client’s file and the erasure acted upon at the appropriate time.
In summary
Whilst Individuals do have a Right of Erasure, this Right is not absolute.
Therapists and practitioners have a Right to retain notes on their clients where required to defend themselves in the event of a potential complaint or claim.
Privacy Notices are required where you retain client information; these should note your Data Retention periods, and that any special category data (e.g. Health information) is retained under the Lawful Basis of ‘processing in the substantial public interest for Counselling etc.’ and ‘insurance’.
Not all information needs to be retained, and if a Right of Erasure is exercised, the documents can be put beyond use once the data retention period for insurance purposes has lapsed.
If you have any doubts, please contact your Insurance Broker or the Information Commissioner's Office. Get help and support from the ICO | ICO
Further details may also be found on Balens ' website at: Data Protection | Balens and Advice & Articles | Balens
Balens is a Specialist Insurance Broker for Health, Well-being, Fitness and Beauty Professionals. Further articles and information regarding insurance and risk management may be found on Balens website at www.balens.co.uk
