Privacy management
The fourth knowledge-transfer element covers privacy management, including what a receiving organisation needs to protect health information in use.
What the public record carries
Not stated in the public record beyond the element title, the introduction's note that this cross-organisational element adds material on what is exchanged at a handover, and the abstract's treatment of privacy as part of security. The text of 5.3.5 is not public.
Basis. The public contents name the element and the introduction says it carries extra communication sub-clauses. The public abstract includes privacy within security. The text is not public.
Why it matters in a health estate
Privacy in health software is not only a legal question, although the legal question is real and differs by market. It is also an operational one: who can see which record, what is logged when they do, how a correction propagates and what happens to a copy in a reporting system. The element sits in knowledge transfer because the operating organisation inherits obligations it did not draft, and it needs the facts to meet them.
What to do now
Record the privacy obligations that cross each boundary, the data flows they attach to, and the facts the receiving organisation needs to meet them. Test one access request and one correction end to end across the systems.
The evidence a reviewer will ask for
| Evidence | What it is |
|---|---|
| Obligation list | The privacy obligations that attach to each data flow |
| Access test | One access request followed end to end, with the time taken |
| Correction route | How a correction propagates to every copy of the record |
| Retention and deletion | What is kept, for how long, and how deletion is proven |
What a reviewer will ask
A reviewer will ask how a patient's correction reaches every copy. A route that stops at the main system leaves the reporting copies wrong.
Common gaps
- A correction is made in the clinical system and the reporting copy keeps the old value
- Access is controlled by role but the role list has never been reviewed
- Deletion is performed but cannot be proven to a reviewer
- The privacy notice describes a flow the system does not follow
Before the draft publishes
Follow one access request and one correction across every system that holds the record. Fix the first break.
If the draft changes this row
The draft is edition 2 and 62 pages, one page more than the first edition. Its text and any change summary are not public as at 21 October 2026. This row follows the published first edition's structure, which is what your procedure should name today. The change watch emails you when the record changes or the draft text lands, and the row is re-read then. No one can tell you what moved before that, and this page does not guess.
Related rows
Who this binds. The data protection lead and the CISO, because the public abstract includes privacy within security and the element carries privacy across the boundary.