Texting, emailing and messaging patients and service users guidance for IG professionals

Where messages are sent to patients or service users about their care, the UK General Data Protection Regulation (UK GDPR) legal bases most likely to apply are:

• 6(1)(e) public task
• 9(2)(h) provision of health and social care services

This is because it is necessary for you to send individuals messages about their care for you to effectively perform your public task or function.

Contacting individuals to communicate with them about their own care does not contravene the common law duty of confidentiality because the purpose is to share information with the patients or service users themselves.

However, the common law duty of confidentiality is engaged where information is used by, or disclosed to, health and care professionals and support staff for the purposes of communicating with individuals about their direct care.

For example, where health records are accessed by a staff member to decide which patients should be messaged about vaccinations before the messages are sent.

It is appropriate to rely on implied consent to communicate with people about their care, as patients will reasonably expect their confidential patient information to be disclosed to relevant staff members who will use it to send them messages as part of providing their care.

Where a proxy is nominated to receive messages on someone else’s behalf, the common law basis for communication with the proxy for direct care purposes remains implied consent, as the proxy effectively becomes a stand-in for the patient.

The proxy relationship itself may exist as a result of explicit consent or another basis, but once the proxy relationship is established, your common law basis for communicating with proxies is the same as the one for communicating with patients.

There are some situations where you will need to consider ethical implications of sending a particular message beyond whether or not it is legal.

See the services individuals may feel sensitive about in the health and care professionals section for a practical example, and consider whether your organisation needs to produce any specific guidelines for staff members.

It is good practice as part of registering and interacting with patients and service users to confirm their contact details and allow patients and service users to indicate their contact preferences. However, contact preferences should be considered as a separate issue to legal bases and objections.

Patients and service users expressing a contact preference, for example to be contacted by letter or text rather than instant messaging, is not equivalent to them giving consent under UK GDPR or common law to be contacted exclusively or at all by those methods. The appropriate legal bases for processing information to contact people under UK GDPR and common law are set out in the UK GDPR and Common law duty of confidentiality sections above.

Not selecting a method of contact is also not equivalent to an objection. Although it is good practice to respect contact preferences wherever possible, if a message needs to be sent to a person about their care and their preferred methods of contact are not possible or impractical, non-preferred methods of contact can be used.

Objections

Objections are different to contact preferences. An individual exercises the right to object under UK GDPR by contacting your organisation, asking for their data not to be used to contact them in a particular way, and giving a specific reason why.

An individual can object to:

• the processing of their personal data for the purposes of their care, for example their individual care entirely or a specific health and care service such as screening
• the processing of their personal data using a particular communication method, whilst not objecting to the processing of their personal data for the purposes of their care. For example, objecting to be contacted by electronic forms of communication such as email, text or messaging app because they want to be contacted by letter instead

There is a legal obligation to uphold a person’s objection to the processing of their personal data for the particular purpose unless you demonstrate that there are compelling legitimate grounds to override it. For this reason, it is important to understand the individual’s specific reason for objecting.

In some circumstances, you may be able to demonstrate that you have compelling legitimate grounds to override a patient or service user’s objection to the processing of their personal data using a specific communication method to send them information about their care. You would need to demonstrate that your reasons for using the particular method to communicate with the person about their care override the interests of the individual who has objected.

Examples of situations where compelling legitimate grounds may override a patient or service user’s objection to receiving messages via a certain method include:

• where individuals have a communicable disease which might put others at risk if they are not quickly made aware of it, so you need to issue a communication advising all of them to call your organisation immediately
• verifying if individuals on a waiting list still require treatment, where the list is so long that it is not practical to call or send letters to each person individually
• informing patients or service users that appointments they have within 48 hours are cancelled, postponed or changed location, where allowing them to turn up for the appointment with no warning would cause wasted time and frustration
• contacting vulnerable people following extreme weather, power or water outages
• where a primary contact method does not work, for example a mobile number is not recognised or an email receives a bounce back, so the individual is uncontactable without using a method they have objected to
• sending invites for virtual consultations, where it is not possible to issue the correct link to click on without using digital methods of contact such as email, text and secure messaging
• where credible threats are made about an individual in the presence of a health and care worker, so the individual needs to be immediately messaged with an instruction to contact their health organisation so they can be appropriately notified
• where an individual has been prescribed incorrect medication, and they need to be urgently informed to contact your health organisation before doing anything with their prescription to avoid harm

Any decision to overrule an individual’s objection should be taken on a case-by-case basis and considered carefully, taking into account an individual’s circumstances and reasons for objecting to the processing of their personal data by using a particular communication method to contact them. It may be helpful to involve your Caldicott Guardian and make a shared decision on whether to override an objection.

Where a patient or service user objects to communications that are about their individual care, either entirely or by using a particular communication method which is likely to be the most effective and timely way of communicating with them about their care, measures should be put in place to ensure that they are aware of the potential negative implications of their objection for their health and wellbeing.

You should also have a process in place for ensuring that patients or service users who have objected to the processing of their personal data to receive communication about their care, either entirely or by a particular communication method, are easily identifiable to staff to ensure objections are upheld.

For example, they could be identifiable via a note in their record for individual messages, or via an internal list of objected recipients for larger group messages.

NHS Notify is a messaging service operated by NHS England that is integrated with the Personal Demographics Service (PDS). It can be used to send NHS App messages, emails, texts and letters to patients, service users and the public.

Although the PDS system used by NHS Notify holds some details relating to your patients’ and service users’ contact preferences, you are likely to hold more information locally. You are responsible for ensuring that each communication delivered through NHS Notify is configured appropriately to reflect the contact preferences, objections and reasonable adjustments of your patients and service users.

You are responsible for determining which security controls should be in place for:

• devices used for messaging – for example, phones which are used to message an individual about their care. You may want to think about specific risks posed by staff using personal devices for this purpose, and how best to mitigate them depending on the services your organisation delivers
• apps, services and platforms used for messaging – for example, an email service which staff members can log into from any device

Controls should be applied based on the security and privacy risks associated with the particular device, app, service or platform. Important measures include:

• applying multi-factor authentication (MFA)
• disabling the ability to install unapproved software and add-ons
• encrypting data at rest
• enabling remote wiping for devices used to send messages
• minimising staff access permissions to what is strictly necessary for them to perform their role

If you assure your information security practices using the Data Security and Protection Toolkit, you will already have applied some of the most important security controls to your devices, apps, services and platforms. You should speak to your cyber security or IT teams for more information or assurance on security controls in place for your organisation.

You must be transparent about how you process data, including the communication methods your organisation uses. Where you use text, email, or other messaging apps to contact individuals about their care, this should be reflected in your privacy information.

You should also inform individuals about their right to object in your privacy information. This can be a general statement about individuals’ right to object to your uses of their personal information. It does not have to specifically be about their right to object to texting, emailing and messaging.

In line with Information Commissioner’s Office (ICO) guidance on transparency in health and social care, you should think about additional ways of communicating information about your organisation’s messaging practices which are most effective for your patients and service users.

You can establish guidelines for staff members to follow when drafting messages to help individuals differentiate suspicious messages from your organisation’s genuine ones. See suspicious messages in the patients section of this guidance for more information.

You can also help raise patient and service user awareness of scam messages through face-to-face interactions, patient participation groups, and local campaigns using posters and leaflets.

If you are made aware of a particular scam message being fraudulently sent in the name of your organisation or being received by people in your local area, consider issuing a public communication with specific details of the message. Patients and service users would then have confirmation of the message’s inauthenticity without having to directly contact you