How a Multi-Site Clinic Group Could Handle Patient DSARs with SAR Portal

The Challenge

Consider a multi-site clinic group operating 3 dental practices and 2 GP clinics across Cork and Limerick. A group like this processes sensitive health data daily and faces unique GDPR challenges.

Healthcare-Specific Complications:

• Health data is “special category” under GDPR — highest sensitivity level
• Patient records contain other patients’ information — shared appointment books, family records
• Identity verification is critical — medical records in the wrong hands is catastrophic
• Complaints follow mistakes — a patient can complain to the DPC about a late, incomplete or careless response

A Common Trigger

For a clinic group like this, the wake-up call could be a near-miss: for example, a receptionist accidentally emailing a patient’s record to someone with a similar name. An incident like that can require a breach notification to the DPC and cause real distress, and it could prompt a review of how all data, including DSARs, is handled.

Why Standard Tools Don’t Work for Healthcare

A group like this often starts with its practice management software and manual steps. Common problems:

1. No redaction support — Staff have to black out other patients’ names by hand in appointment lists, referral letters, and clinical notes
2. No consistent verification — There is no set way to check that requesters are who they say they are
3. No audit trail — If a patient complains to the DPC, there is little evidence of the process
4. Inconsistent handling — Each clinic does things differently

How SAR Portal Could Help

Identity Verification

Patients would submit requests through the group’s public request portal, with OTP (one-time passcode) verification. This confirms the requester controls the email address they gave.

OTP alone does not prove who the person is. If someone asks for another person’s records, for example an ex-partner’s, the clinic would still need to check identity, such as by asking for proportionate ID, before releasing anything.

AI-Powered Redaction for Medical Records

Medical records are challenging:

• Referral letters mention other healthcare providers (their data is protected)
• Family medical history mentions relatives (their data is protected)
• Appointment lists show other patients’ names
• Clinical notes may reference conversations about family members

AI suggests redactions for third-party personal data. The clinic’s team would review the suggestions and choose what to redact before anything is applied. Detected items start selected, including the patient’s own details, so the reviewer would use “Deselect Subject Data” to keep the patient’s own information in their copy. AI can miss personal data or redact too much, so the team would check the result before releasing it.

Complete Audit Trail

Key actions are recorded in an audit log. No user can edit or delete entries. If a patient complains to the DPC, the clinic could use the log to show how the request was handled.

Centralised Process Across All Locations

All five clinics would follow one workflow (Starter includes 3 users, so a group needing more staff logins would need Pro):

1. Patient submits a request through the portal
2. OTP confirms the patient controls the email address they gave
3. Practice manager exports the relevant records and uploads them
4. AI suggests redactions
5. A senior clinician reviews the suggestions and the result
6. The patient downloads the response from the portal

Illustrative Outcomes

The comparison below is illustrative of the kind of improvement a clinic of this size could see — it is not measured data from a specific deployment.

Where the time goes:

Instead of spending half a day redacting a single DSAR by hand, a practice manager could start from the AI suggestions and check them. The audit log records each step, so the evidence would be ready if a solicitor or the DPC asks how a request was handled.

Illustrative ROI:

A clinic handling around 5 DSARs a month could save a few hours on each. At a notional €30 an hour, saving about 4 hours per request is roughly €600 a month of staff time, against a Starter plan at €59 a month ex VAT (up to 5 cases a month). Illustrative, not measured.

Key Healthcare Considerations

What Makes Healthcare DSARs Different:

1. Special category data requires extra care — one mistake is a serious breach
2. Clinical notes often contain subjective observations that patients find surprising
3. Third-party redaction is complex — family members, other patients, referring doctors
4. Verification: use all reasonable measures to confirm identity before releasing health data (GDPR Recital 64)
5. Audit requirements are higher — regulators expect detailed records

SAR Portal Features Specifically Valuable for Healthcare:

• OTP verification confirms the requester controls the email address they gave
• AI redaction suggests redactions for third-party data; your team reviews them before release
• Multi-file redaction: upload many files to a case at once
• Audit log of key actions that no user can edit or delete, so you have a record if the DPC asks

Advice for Other Healthcare Providers

1. Don’t rely on one manual pass — It’s easy to miss something in a 50-page medical record, so pair AI suggestions with a careful human check
2. Verify identity seriously — OTP confirms the email address; ask for proportionate ID where you have doubts
3. Document everything — The DPC may ask how you handled requests
4. Train all staff — Receptionists need to recognise DSARs and route them correctly
5. Centralise the process — Inconsistency across locations creates risk

Example scenario: not based on a real customer. Figures are illustrative, not measured results. Healthcare providers should ensure any DSAR solution meets their specific regulatory requirements.