Psychology Private Practice and Health Data Consents: Do you need Explicit Consent?

When running a psychology practice, client confidentiality is paramount. Not only are you legally obliged to protect client data, but it’s also essential to establishing an environment of trust and open communication. To achieve this, transparency is key and obtaining health data consent can be an opportunity to articulate why personal information is needed, how it will be used and how it will be protected. But is consent always required? In some cases, consent may be difficult to acquire, and this may prevent clients from seeking or committing to treatment. For this reason, consent is not always required.

Are health data consents always required?

If you are starting or running a private psychology practice, client confidentiality will already be at the forefront. But data protection starts before the first session. From the moment you collect enquiry details, intake forms, health history, risk information, or session notes, you are processing personal data and, in many cases, special category data under UK GDPR.

Many practitioners assume that because they collect health information, they must automatically obtain explicit consent, but this is a misconception. In reality, the correct position depends on why you are processing the data, what type of data is involved, and whether your profession falls within the relevant legal framework.

Private psychology practices do not need explicit consent to process client health data for core therapy services, provided they have both an Article 6 lawful basis and a valid Article 9 condition. 

When you process client information, UK GDPR requires you to identify a lawful basis under Article 6. If you're also processing special category data, such as health information, you must identify an additional condition under Article 9 as well. In other words, for health data, you need both:

(1) an Article 6 lawful basis for processing personal data; and

(2) an Article 9 condition for processing special category data.

For many psychology private practices, the Article 6 lawful basis will often be contract, because the processing is necessary to provide the agreed services to the client. But that only deals with personal data generally. If you are processing health data, you must also identify an Article 9 condition.

The two Article 9 conditions most relevant here are usually:

• Explicit consent under Article 9(2)(a); or

• Health or social care under Article 9(2)(h), where the processing is necessary for healthcare, treatment, assessment or related services, and the profession is covered by the relevant legal framework.

Whether you can rely on Article 9(2)(h) depends on the nature of your services and whether your profession is covered by section 204 of the Data Protection Act 2018. Healthcare practitioners with HCPC registration and a protected title may be able to rely on the health and social care condition instead of explicit consent when processing special category data for core therapeutic services.

That means the answer is no longer a blanket “yes, you need consent”. In many cases, the better analysis is that a regulated practitioner may rely on a contract under Article 6 and health or social care under Article 9 for the routine collection and use of client health data in practice.

However, this doesn't mean consent disappears altogether. Explicit consent may still be required where the processing is not necessary for the provision of therapy services, for example, if you want to use client health data in an AI tool, or record certain sessions where consent is needed because the activity goes beyond what is essential to provide treatment.

Special category data in psychology practice

Psychology and therapy practices will often process special category data, particularly health data. Depending on the nature of the work, you may also handle other sensitive information, such as data about ethnicity, religion, sexual orientation or other matters disclosed in the course of treatment.

Where you are processing special category data other than health data, such as information about a client's sexual orientation, religion or ethnicity, Article 9(2)(h) will not be available. In those cases, you will need to identify a different Article 9 condition, and explicit consent under Article 9(2)(a) is often the most appropriate route.

Whether Article 9(2)(h) is available to you at all turns on the question addressed in the next section: whether your practice falls within the relevant regulated framework.

What if you are not HCPC registered?

If you do not fall within one of the recognised categories or protected titles, it may be harder to rely on the health and social care condition. In that situation, explicit consent is often the more straightforward route for processing health data lawfully.

A common concern is that if you rely on explicit consent, a client can later withdraw that consent and force you to delete everything. That is not the full picture. The right to erasure is not absolute, and there are often valid reasons to retain records, including professional obligations, continuity of care, insurance requirements, and the need to defend future legal claims.

What about Article 6?

As set out above, Article 6 requires you to identify a lawful basis for processing personal data. For most private practices, the contract is the primary basis. It is worth noting, however, that other bases may also be relevant in specific contexts: legal obligation may apply where you are required to retain records by a regulatory body, and legitimate interests may be relevant in certain limited circumstances, provided the balancing test is satisfied.

If you do rely on explicit consent, it should be clear, specific and genuinely optional. It should clearly cover the relevant type of special category data and the purpose of the processing. But if you are relying on Article 9(2)(h) for core therapeutic services, your documents should say that accurately rather than suggesting consent is the basis when it is not.

This is why your client-facing paperwork matters. Your privacy notice, onboarding documents, policies and any consent forms should all match the legal basis you are actually relying on. If your position has changed, your paperwork should change too.

For more guidance, please check my carousel here, which walks you through the steps to consider when working out whether you need to obtain explicit consent or not.

Privacy notices and record retention

Don’t forget to ensure your privacy policy is up to date and covers your use of special category data.

You need to have a separate section in your privacy policy setting out the types of special category data you collect about clients (so maybe something like “information about your health, including information about your existing and previous medical conditions, medication/prescription details, psychiatric history and any other relevant health information to enable us to carry out our services to you”).

You also need to explain what categories of personal data and special category data you collect, why you collect it, your lawful basis condition, who you share the data with, and how long you keep it.

UK GDPR does not prescribe a single fixed retention period for therapy records. Records should be kept only for as long as necessary, but what is “necessary” must be assessed in light of professional guidance, limitation periods, ethical obligations, continuity of care, and insurance requirements.

See my blog on data retention periods for psychology practices here.

Pseudonymised or anonymised records may sometimes be retained for longer, depending on the purpose and whether the information remains identifiable.

Practical takeaway for psychology practices

If you're a regulated practitioner providing core therapeutic services, the correct position may be that you do not need explicit consent to process client health data for those core services. Instead, you may be able to rely on contract under Article 6 and the health or social care condition under Article 9.

But do not over-apply that position. If you're carrying out processing that is not necessary to provide therapy services, or if you are not within the relevant regulated category, explicit consent may still be needed. And if your legal basis changes, you should review and update your privacy notice, consent forms, onboarding paperwork, policies and record-keeping procedures so they remain accurate.

You must always be able to justify why processing of specific data is ‘necessary’, what you process must be reasonable and proportionate in meeting that need, and you must not collect more data than is necessary.

All businesses handling special category data should carry out a data protection impact assessment (DPIA). Completing a DPIA will help you map what data you collect, assess whether each element is genuinely necessary for the purpose, identify risks, and document the measures you have in place.

Need help updating your documents?

If your privacy notice or client onboarding documents still assume that explicit consent is always required, it may be time for a review. The legal position is more nuanced, and your documents should reflect the basis you actually rely on in practice.

A well-drafted set of practice documents should work together: your privacy notice, consent wording where needed, internal policies, and record retention approach should all be aligned with the current legal position.

Get in touch if you require any bespoke help with your practice documentation.

Clinical Will Guidance & Template

Buy Now