Patients' rights and organisational accountability

Organisations remain accountable for how patient information is explained, shared, secured and corrected. A service that meets a digital delivery requirement must also support the person's applicable rights. These responsibilities matter throughout a shared-record service or a handover between care organisations.

For oversight, follow the information from its purpose and recipients to the controls, record of responsibility and response to concerns. The digital requirements table identifies the electronic action being required; this chapter explains the rights and organisational responsibilities alongside it.

Explain sharing and respect rights

UK GDPR transparency requirements concern the purpose, legal basis, recipients and other prescribed information. The rights framework includes access and rectification, with conditions and exceptions for particular rights. The amended law governs request handling and complaints. A privacy notice is part of this responsibility; it does not replace the confidentiality justification. ^{173, 006}

An objection under confidentiality and a data-protection objection are different legal questions. Their effect depends on the basis, circumstances and applicable rules. Care teams need to address the patient's actual concern rather than treat all objections as identical. ^{174, 001}

Communication must be understandable and accessible. Public-sector web/app accessibility rules and disability duties can affect the digital channel. England, Wales and Scotland have a different equality framework from Northern Ireland. The source guidance identifies scope and exemptions; detailed language and equality instruments remain a bounded research gap. ^{019, 092}

Capacity, children and people supporting the patient

Capacity concerns the particular decision. The relevant rules differ nationally. Relatives, informal carers and people with legal decision-making authority have different positions; involvement alone does not create unrestricted access. Professional guidance explains the need to involve the patient, consider relevant wishes and establish the appropriate authority. ¹⁷⁴

Children's care and care for adults who lack capacity are within this wiki's subject. The discharge authority map identifies the principal provisions and roles. Individual disputes, specific instruments and liberty restrictions still need their own analysis.

The organisation remains accountable for digital handling

Article 5 requires the controller to demonstrate compliance. The controller's Chapter IV responsibilities include appropriate measures, defined relationships with other controllers and processors, and safeguards proportionate to risk. A sharing agreement or supplier arrangement needs to reflect those actual roles. ^{171, 172}

Security and continuity support both privacy and care. The Network and Information Systems (NIS) regime may add duties for an operator within its scope. England's Data Security and Protection Toolkit (DSPT) provides an assurance layer in its applicable settings. The organisation must still establish the lawfulness of the particular disclosure. ^{022, 023}

Public authorities must also act compatibly with Convention rights. Article 8 is important when sharing interferes with private life. The statutory public-function boundary can affect a private provider delivering public services. The Scottish information-sharing case in this corpus illustrates the importance of clear safeguards; its specific context must be retained. ^{004, 072}

Records support continuing care

Accurate records and responsible retention enable a receiving team to understand what has happened and what changed. Applicable national care and records regimes add obligations. England's governance regulation, Scottish public-records framework and the other national chapters describe those sources. A requirement to retain a record does not itself give every recipient access to it. ^{018, 070}

Wider freedom-of-information, procurement and government-transparency rules are relevant where they change an identified digital-information responsibility. A general survey of public administration is kept outside this chapter. Continue to the national comparison, care-sharing examples or national service reports for the exchange being assessed.