Section 164A for healthcare providers
In healthcare the data is special category, so complaints escalate faster and expectations are higher. Section 164A adds a statutory 30-day acknowledgement to a sector that already runs clinical complaints processes.
Does section 164A apply to you?
Private clinics, dental practices, therapists, pharmacies, care homes and domiciliary providers are all controllers of patient and staff data.
The complaints you are most likely to get
- Records disclosed to a family member without authority
- Reception conversations overheard, or notes visible at a desk
- Appointment reminders sent to a shared or old contact number
- Records kept after a patient moves to another provider
- Third-party portals or booking systems exposing more than expected
Channels to watch
The 30-day clock starts when a complaint reaches your organisation by any route, so every channel below needs a named owner.
- Reception in person and by phone
- The practice inbox and clinicians' individual inboxes
- The clinical complaints procedure
- Online booking and patient portals
- Letters, including those addressed to a named clinician
Worked examples
| What arrives | How to treat it |
|---|---|
| A patient complains their appointment details were given to a relative who called | A complaint about disclosure. Acknowledge, establish what was said, and be specific about what you change |
| A clinical complaint letter includes a sentence about records being shown to another patient | Two processes. Handle the clinical element as usual and run section 164A on the data element |
| A former patient asks why you still hold their notes | A complaint about retention. Explain the professional retention requirements you rely on |
A minimum viable process
- Publish a complaints route with an electronic option and another means. Use the complaints policy template.
- Add the section 164A wording to your privacy notice and your subject access request template. Use the privacy notice wording.
- Log every complaint with the date it was received. Use the complaints log template.
- Acknowledge within days, not weeks. See the 30-day acknowledgement rule.
- Investigate, update the person, decide, tell them the outcome and signpost the ICO. See how to handle a data protection complaint.
Prove you met the duty, not just that you meant to
The work in section 164A is operational: spotting the complaint, dating it, acknowledging it within 30 days, keeping the person informed and recording the outcome. PrivacyComplaints does that part for small organisations.