Three layers that matter
Health data rules are usually summarised as a consent question. In practice three things decide whether a transfer is defensible:
- Separation. Identity and clinical content are stored and sent separately, so that a translation vendor never holds both.
- Minimal necessary. A physician needs the slice that answers the question, not the whole record. Sending everything is convenient for us and disproportionate for the patient.
- A send log. Who sent what, to whom, when, and on what legal basis. If that log cannot be produced, the transfer cannot be defended.
The consent trap
A blanket consent signed at intake does not cover onward transfers to hospitals, translation vendors and payers. Separate consent for separate purposes is the only version that survives review, and it has to be revocable through a route that actually works.
What a partner should be able to see
- the categories of data transferred, and the recipient;
- the legal basis relied on for each transfer;
- the retention period, and the deletion route;
- the contact who answers a data question inside one working day.
Where we refuse
We do not perform the hospital own cross-border data assessment, and we do not treat a signature as a substitute for a lawful basis. If a partner asks us to send a full record "just in case", the answer is no, and the reason is written down.
真正起作用的三层
健康数据规则常被简化成一个"同意"问题。实际决定一次传输是否站得住的是三件事：
- 分离。 身份信息与临床内容分开存储、分开传输，让翻译供应商永远不同时持有两者。
- 最小必要。 医师需要的是能回答问题的切片，不是整本病历。全量发送对我们方便，对患者却是不成比例。
- 发送日志。 谁发的、发给谁、什么时候、依据是什么。这份日志拿不出来，这次传输就辩护不了。
同意的陷阱
受理时签的一揽子同意，覆盖不了后续向医院、翻译供应商、付款方的多次传输。按目的分开的单独同意，才是能经得起检查的版本，而且必须可撤回，并且撤回路径真的能用。
伙伴应该能看到什么
- 传输的数据类别，以及接收方；
- 每次传输所依据的法律基础；
- 留存期限，以及删除路径；
- 一个在一个工作日内回答数据问题的联系人。
我们拒绝的
我们不代医院做其自身的出境评估，也不把一纸签名当作合法性基础的替代品。如果伙伴要求"以防万一"把整本病历发过去，答案是拒绝，理由会写下来。