Records, Confidentiality and Data Protection [T-11-EN]

Records, Confidentiality and Data Protection [T-11-EN]

Failures in health records management and data protection are not administrative technicalities — they carry direct consequences for patient safety, institutional liability, and public trust in health systems. The WHO Global Patient Safety Action Plan 2021–2030 identifies information governance as a foundational element of safe care, and the Joint Commission International (JCI) accreditation standards require demonstrable, documented systems for record access control, breach notification, and data release authorization. In Georgia and across the South Caucasus, accelerating digitization of health records — combined with the obligations imposed by Georgia’s Law on Personal Data Protection and its alignment with GDPR principles — has made these competencies urgently relevant for frontline and administrative healthcare staff alike. Unlawful record access, missed breach-notification deadlines, and undocumented data releases remain among the most frequently cited compliance failures in regional accreditation reviews, exposing patients and institutions to preventable harm.

This course is grounded in the normative frameworks of the European General Data Protection Regulation (GDPR), ISO/IEC 27001 standards for information security management, and JCI hospital accreditation criteria governing medical record content and confidentiality. Instructional design follows a competency-based methodology: participants engage with realistic case scenarios drawn from clinical and administrative contexts, analyse documented compliance failures, and practise the decision-making steps required to act correctly under time pressure. Each module maps explicitly to verifiable performance outcomes, enabling participants to assess their own readiness against international benchmarks before returning to practice.

By the end of this course, participants will be able to:

• Distinguish lawful from unlawful bases for accessing, sharing, and releasing patient health records under GDPR-aligned Georgian data protection legislation and JCI standards.
• Implement a structured, step-by-step breach-response procedure — including the 72-hour supervisory notification requirement — using a reproducible institutional checklist.
• Apply minimum-necessary and role-based access principles to routine clinical and administrative record-handling situations across inpatient, outpatient, and digital environments.
• Construct compliant documentation for third-party data release requests, patient consent records, and information-access logs that satisfy both internal audit and external regulatory review.
• Analyze a given security or confidentiality incident to identify the point of failure, the affected data categories, and the proportionate corrective action required.
• Evaluate the effectiveness of an institution’s data protection controls by interpreting audit findings against ISO/IEC 27001 control objectives and identifying residual compliance gaps.

Who Should Attend

This course is designed for all healthcare professionals and support staff who create, access, transmit, or store patient health information in any format — including physicians, nurses, allied health practitioners, medical records officers, IT staff, and hospital administrators. It is equally relevant to compliance officers and quality managers responsible for overseeing data governance systems in primary care centres, district hospitals, and tertiary referral facilities undergoing JCI or national accreditation. No prior legal training is assumed; the course is appropriate for both early-career staff completing mandatory data protection induction and experienced professionals seeking to formalise and update their existing practice.

Course Structure

The course is delivered entirely online through GMJ Academy’s self-paced learning environment, with an estimated study time of four to five hours including embedded scenario exercises and knowledge checks; participants complete a summative assessment achieving a minimum pass mark of 75% to qualify for the certificate of completion. Successful participants are eligible to claim verified CME/CPD credits in accordance with the requirements of the Georgian Medical Chamber and applicable continuing professional development frameworks.