Informed consent and consent to data processing
from a purely semantic point of view the difference between informed consent and consent to the processing of personal data is misleading. Unfortunately, since the two terms are very similar, there is a risk of misleading patients when the two consents cover very different areas.
Informed consent
Informed consent in medicine concerns agreement to the health treatment proposed by the doctor. Today it is a settled principle that no conscious person may be subjected to health treatment against or without their will.
To collect valid consent, the healthcare professional must give the patient full information about the treatment to be carried out, so as to allow a free and informed choice. In particular, the information should cover at least the following points:
- Clinical situation found
- Description of the procedure to be carried out and the risks of not having the service performed
- Any alternative therapies
- Techniques used in the treatment
- Expected benefits
- Risks and possible complications
- Behaviour and precautions to follow in order to prevent later complications
Consent to data processing
Consent to data processing, on the other hand, is a document that tells patients which types of data are processed and how.
The key point of that document is to tell patients the purposes for which their data is collected and how it will be used in future. Logically, this consent must be requested before any kind of processing of the patient's data begins, such as recording personal details or medical history. This consent must therefore be requested before informed consent is sought.
How should these privacy notices be written? In clear, transparent language, says the GDPR, bearing in mind the patients who come to your practice or to the facility you work with.
Why not combine informed consent and consent to data processing
Referring to what was said above and to the nature of the two documents, we can find at least two reasons why it is best not to merge them into a single document:
- The two notices must be presented to patients at different times: logically, consent to data processing must be requested before carrying out any operation on the patient's data. Let us remember that this consent must be requested before booking, since simply recording the appointment in our diary or sending a reminder sms/email already counts as data processing.
- We must not mislead patients about the purpose of the two documents. The first means the consent given by the patient to the processing of their data, while the second means the consent given by the patient to a particular therapy or medical treatment. If the notices are given to the patient in the same document with simply separate signature lines, we may lead the patient to think they are the same thing, or at least two similar documents.
So it is important to keep these two types of consent clearly separate, so that patients are not confused and understand exactly what they are agreeing to.
