How we helped a healthcare organisation complete a large-scale DSAR redaction exercise within two weeks

The challenge

We were approached by a healthcare organisation that needed urgent support completing the redaction stage of a Data Subject Access Request (DSAR).

The organisation held over 364GB of data, this equated to 8,122 pages requiring review and redaction.

Much of the material consisted of medical information directly relating to the individual, meaning a substantial proportion remained relevant for disclosure.

There was also considerable time pressure as the organisation had already extended the response period by an additional two months. By the time our team became involved, they had approximately 14 days remaining before the deadline.

Our solution

To keep costs proportionate, much of the review and redaction work was carried out by our in house Privacy Analysts, which are charged out at £200 per day.

We first organised the material into clearly defined bundles, including medical records, emails, attachments and handwritten notes.

Next, we converted the relevant documents into PDF so we could apply a consistent DSAR redaction process across the disclosure.

Where records were scanned or handwritten, we used optical character recognition (OCR) software to make this material searchable. Then we manually reviewed the results and applied redaction’s where needed.

The organisation also provided us with a list of employee names and initials, which helped identify third-party information more efficiently.

Additionally, we advised the organisation on DSAR redaction guidelines on aspects of health information that may be withheld. This can be considered in instances where disclosure would likely cause serious harm to the individuals physical or mental health of the individual or another person.

In these instances, we have to obtain an opinion from the appropriate health care professional who should confirm that the serious harm test is met. When shown this opinion must have been obtained within the previous six months.

The outcome

Within 14 days, we completed DSAR Redaction of all 8,122 pages.

As a result, this reduced the final disclosure to 7,584 pages.

The final disclosure was securely transferred to the individual within the 14 day time-frame using a password-protected link. We always recommend that the password is sent separately and, where possible, using a different method of communication such as SMS or WhatsApp. This helps reduce the risk of a third party gaining access.

Key takeaway

In our experience large DSARs can become difficult to manage when organisations have more data than they require. We always advocate removing any additional information no longer needed and reviewing retention periods. When dealing with sensitive health information, consideration also needs to be given to whether disclosing particular information could cause serious harm to the individual or another person.