Data Protection Impact Assessment (DPIA) Summary - Shared Care Record

A data protection impact assessment (DPIA) helps identify and reduce data protection risks in a project or service. This is a summary of the DPIA and will be updated when new information becomes available.

This DPIA summary was first published by the HSE for release 1 (beta) of the National Shared Care Record (NSCR), which went live in November 2025. The HSE Data Protection Office (DPO) and the Data Protection Commission (DPC) were consulted throughout.

This summary has now been reviewed and updated and will continue to be updated for subsequent releases.

The National Shared Care Record (NSCR) has been renamed as the Shared Care Record (SCR).

The Shared Care Record (SCR) is a digital solution that brings together patient health information from different healthcare providers. It shows this information to healthcare staff in a clear and consistent way.

The SCR gives staff a fuller view of a patient’s health. It may include information such as:

• diagnoses
• test results
• appointments
• procedures
• care plans

Healthcare staff in many settings can use the SCR, including hospitals, GP practices and community services. It supports better communication and coordinated care. The SCR is an additional source of information; healthcare staff should still use their own clinical judgment when making decisions.

The SCR supports Irish and EU commitments under the European Health Data Space and the EU Digital Decade.

The SCR also supports Digital for Care – A Digital Health Framework for Ireland 2024-2030 and enables safe and secure data sharing within the health service.

There are two purposes for processing personal data in the SCR:

• to allow healthcare practitioners to access patient information for care and service delivery
• to support the promotion and protection of public health

Release 1 (beta) is the first step in the national rollout. It uses a limited number of data categories and sources. These have been expanded over the subsequent releases.

The SCR has an established roadmap of releases until the end of 2027, with three releases in 2026 and three in 2027.

Several types of personal data are processed in the SCR.

1. Patient demographic data

This data helps confirm a patient’s identity. It uses the Individual Health Identifier (IHI) and follows:

• the IHI minimum dataset required by the Health Identifiers Act 2014
• S.I. No. 155/2022
• IHI programme business rules for safe matching

2. Health data

Seven sets of health data are included in release 1 (beta). These have been expanded over subsequent releases.

Data sets include:

• GP requested radiology results
• reimbursed medications
• procedures
• GP requested laboratory results
• hospital appointments
• hospital discharge summaries
• Chronic Disease Management (CDM) programme data
• User input information from the HSE Health App

These data are sourced from systems such as Healthlink, Hospital In-patient Enquiry (HIPE) and the HSE data lake.

The datasets and source systems will continue to expand as the SCR rolls out.

This is a product in development. The SCR is not a complete patient record. Users are advised to supplement the SCR with other sources of information and clinical judgement to aid clinical decision making.

3. Healthcare practitioner data

Professional and work information is processed to verify identity and manage access to the system.

Separately, the SCR is a source of data to the HSE Health App and healthcare practitioner data may be included e.g. where practitioners’ names appear in hospital discharge summaries.

The SCR uses clear legal bases for data processing:

• Article 6(1)(e) of the GDPR — processing necessary for tasks carried out in the public interest
• Article 9(2)(h) of the GDPR — processing necessary to provide healthcare and manage health systems and services

Irish legislation also supports the processing of this data, including:

• the Health Act 2004
• the Health Identifiers Act 2014
• the Social Welfare Consolidation Act 2005
• the Health Information Act 2026

The DPIA also assessed the SCR against the ePrivacy Directive.

These assessments ensure that only the minimum personal data needed for the SCR is collected, and that data is used in a fair and balanced way.

Necessity

Processing patient data is necessary to:

• bring together records from different providers to support continuity of care
• verify patient identity safely using the IHI
• allow healthcare practitioners to access information needed to deliver care and manage services

Processing data about healthcare practitioners is necessary to:

• verify their identity
• control access
• support oversight and compliance

Proportionality

Proportionality ensures that processing is not excessive.

This means:

• using only the minimum demographic information needed to verify identity
• transferring only the health data needed for care from connected systems
• ensuring all users are trained to understand when and how they should use the SCR
• providing only agreed data to the HSE Health App

EY provides the technical solution for the SCR. The HSE selected this solution after a detailed procurement process that included assessments of security, privacy and data protection.

For release 1 (beta), the technical solution focuses on:

• creating and maintaining a single SCR repository, called the Clinical Data Repository (CDR)
• making records available through a secure clinical portal for authorised users

The roadmap of releases is now focused on adding new datasets and data categories to the SCR.

The SCR uses an integration architecture that supports the full flow of clinical and operational data from HSE source systems. It uses international healthcare data standards such as Fast Healthcare Interoperability Resources (FHIR) and openEHR.

Data comes from different source systems including:

• IHI
• Healthlink
• HIPE
• HSE data lake managed by the Integrated Information System (IIS)
• HSE Health App

Data goes through several steps before being stored:

1. Cleaning, filtering and adding demographic details to help verify records
2. Formatting information to meet standards
3. Storing validated data using openEHR and FHIR models

Access to the CDR is controlled through secure Application Programme Interfaces (APIs), ensuring traceability and compliance.

Healthcare practitioners access the SCR through a web-based clinical portal. The portal:

• provides read-only access to patient information
• works on all devices using modern web browsers
• shows data from several health systems in one place
• helps deliver coordinated care across GP, hospital and community settings

There is a strict onboarding process before healthcare practitioners can access the portal including:

• mandatory training
• mandatory acceptance of the terms of use
• access only via approved login credentials

To protect patient data:

• audit logs are kept to ensure access is appropriate and in line with policies and procedures
• users must inform patients when appropriate that their record is being accessed
• automatic session timeouts reduce the risk of unauthorised access

Data from source systems is assessed before it is shown in the SCR. This includes ongoing data analysis to check if the information is suitable for display.

Data is included only when it meets standards agreed with clinical experts and in line with international best practice.

The SCR Digital Clinical Safety team:

• maintains a clinical data and interoperability framework
• completes clinical safety assessments
• manages hazard logs and decision logs

The SCR does not change source data. Instead, issues are logged and sent back to the relevant systems to improve quality over time.

The SCR was built with “security by design” and “privacy by design” principles. It aligns with HSE policies and the Chief Information Security Officer (CISO) requirements. For each release, risk assessments are completed, and appropriate security controls put in place.

The SCR has been assessed against HIQA's National Standards for Information Management in Health and Social Care. It meets all standards. An action plan is in place to ensure ongoing compliance.

Data processing follows all GDPR principles, including:

• lawfulness
• fairness and transparency
• purpose limitation
• data minimisation
• accuracy
• storage limitation
• security
• accountability

The HSE is the data controller for the SCR. Any data processors must follow written agreements.

The SCR team has regularly engaged with the Data Protection Commission. This includes meetings and reviews during the DPIA process.

The HSE Data Protection Office has been involved throughout the DPIA process. It has reviewed the DPIA and all updates, provided its opinion, and will continue to review updates as the SCR develops.