Data protection for phlebotomists
Handling patient information under UK data protection law.
The law
UK GDPR and the Data Protection Act 2018 apply to anyone handling patient information. Health information is special category data and needs extra care.
Where you handle data
Request forms, tube labels, appointment details, your own records and anything you pass to a laboratory or clinician.
In practice
Keep paperwork out of sight and secure in transit, do not discuss patients where you can be overheard, protect any device that holds patient information, dispose of paperwork confidentially, and keep information only as long as it is needed.
If something goes wrong
Lost paperwork, information sent to the wrong person or a stolen device can be a personal data breach. Some breaches must be reported to the Information Commissioner’s Office within a fixed deadline. The ICO publishes guidance on this and on whether you need to pay the data protection fee.
General information only, not legal advice. Rules differ between the UK nations and change over time; check official guidance or take advice for your situation.
Related topics
Infection prevention and control
Hand hygiene, PPE, skin preparation and cleaning equipment in phlebotomy.
Sharps
Using, containing and disposing of sharps safely.
Temperature control for samples
Keeping blood samples within the laboratory’s temperature and time requirements.
Consent
Valid consent for blood collection, and what to do when a patient may lack capacity.
Lola Dispatch is invitation-only
Lola Dispatch offers mobile blood draw jobs to approved phlebotomists. We add phlebotomists by invitation.
Request access