Scope, consent, and jurisdiction
This guide covers the handoff of records or identity documents during an initial care-coordination inquiry. It does not decide which legal basis permits a transfer. The European Data Protection Board guidance describes security duties under the GDPR for organisations in that legal context; the UK Information Commissioner’s Office describes the UK GDPR. The law of the patient’s home, the service provider, and the destination may each matter.
Consent should be specific enough for the patient to understand what will be sent, to whom, for what purpose, and whether a withdrawal changes future processing. Ask whether the recipient is a controller, processor, hospital, insurer, or coordinator, and whether another organisation will receive the file. A consent checkbox does not prove that a portal is genuine or that a provider has agreed to review the record.
Make the first inquiry minimal and verifiable
Start with a short, non-identifying description of the request, the patient’s preferred language, and the administrative question. Ask for the official domain, portal address, named team, accepted file types, maximum size, and whether an appointment or case reference is required before any clinical record is sent. Confirm the recipient through a separately found official contact route when a message creates urgency or asks for an unusual upload.
Before selecting Upload, ask in plain language: who will have access, whether access is logged, whether the link expires, where the file is stored, how long it is retained, and how correction or deletion requests work. Ask whether data crosses a border and which privacy notice applies. If those answers are unavailable, keep the inquiry non-identifying and wait for a verified channel rather than attaching a passport or full medical record.
Control upload, access, and versions
Use the provider’s authenticated portal or another channel whose security and ownership have been explained. Prefer a unique account, strong authentication, restricted permissions, encryption in transit and at rest where offered, and an expiring link over a public folder or open chat. Send a document password through a separate channel only when the recipient has confirmed that procedure. Never reuse a shared password or leave a logged-in portal open on a public device.
Prepare a minimum pack: remove unrelated pages, redact identifiers that are not required, and label each file with its source and date. Keep the original locally and record the exact filename and version submitted. Check the access list before sending and ask the recipient to confirm that the intended team—not an unexplained third party—can open the file. Security protects confidentiality, integrity, and availability; a locked upload that no one can retrieve is still a failed handoff.
Ask about retention and future use
Retention is a decision to document, not an assumption. Ask the provider’s retention period, deletion schedule, backup treatment, archival rules, and whether the file may be used for another purpose such as service improvement, research, or marketing. Ask what happens if the patient withdraws consent, corrects a file, or decides not to continue. The answer can differ by jurisdiction and by whether the organisation must keep a clinical or financial record.
Pseudonymisation can reduce direct identifiers but remains personal data when re-identification is possible; it is not a promise of anonymity. Keep a local register of what was sent, the consent or notice relied on, the recipient, access confirmation, and any deletion or correction request. Do not delete the only copy needed to prove what the provider received, but do not retain extra drafts indefinitely either.
Close the loop after sending
Request a receipt that names the file, version, time, and receiving team. Ask the team to confirm that the file opened correctly and to identify any missing or unreadable page before you send more material. If a wrong recipient, broken link, or unauthorised access is suspected, stop further sharing, preserve the evidence, and notify the relevant provider or privacy contact using the official route.
Maintain a small transfer log with the source URL, the privacy notice version, the permission granted, the review status, and the next owner. A safe first inquiry can ask for the minimum required documents and the applicable retention rule without naming a diagnosis. For a cross-border transfer, obtain jurisdiction-specific advice from the responsible provider or a qualified adviser; do not present one country’s privacy rule as universal.
