Table 1.

Key dimension, recommendations and legal guidelines on the use of a medical data recorder in the operating theatre

Key dimension	Practice recommendations	Legal implications
What is the purpose?	Quality improvement, such as structured team debriefing or enhanced morbidity and mortality meetings. The purpose of data collection is for theatre staff to learn from what went well and what can be done better	It is important that the goal is clearly specified. When a MDR is used in the authors' centre, the patient is not the main focus of the initiative. The purpose is quality improvement of operating teams and workflow, or support of hospital quality safeguarding systems. Hence, the data are not required to be added to the patient's medical file. Only the laparoscopic camera footage is added and accessible to patient, in accordance with standard protocol
Who and what do the data cover?	The theatre staff is being recorded using audio and video during the surgical procedure; patient parameters on the anaesthesia monitor and the laparoscopic camera views are recorded. Other data sources considered to be of relevance may be added to the data set collected (door movements, room temperature, etc.)	Given that the purpose is quality improvement, patient consent may be assumed. The patient needs to be informed about planning of the operation by the surgeon and has the possibility to opt out without negative consequences (no delay in planning). The MDR is used as a quality improvement tool and so, if adequate safeguards are put in place, the hospital may state that the theatre staff is expected to participate
What about privacy and the privacy‐by‐design principle?	Recordings may initially collect, but not process, the patient's personal identifiers. The patient's personal identifiers need to be stripped from the file as soon as possible (deidentification). Faces of theatre staff need to be scrambled and voices altered. To protect the patient's privacy maximally, it is advised that their face and genitals are not recorded by cameras when this serves no purpose	General privacy principles must be respected Data are kept safe and secure, and stored for no longer than is absolutely necessary. The privacy of staff and patients needs to be taken into account from the very beginning by making use of privacy‐enhancing technical solutions
Who is responsible for the data?	The hospital needs to assign a responsible person for the MDR. In trial settings, project coordinators and principal investigators are responsible for collecting the data and secure storage of the outcome report. In this case, the original data set (including video recordings) is sent immediately to the data analysis centre and, after it has been analysed, the pseudoanonymous outcome report is sent back. The original data are deleted, as the purpose of the original data has been fulfilled and the original data are no longer needed	An official agreement on confidentiality signed by the hospital directorate assures that the original and outcome data cannot be requested and used for any purpose other than that stated in the agreement Clear legislation is needed to make sure the inspectorate and other external parties cannot request the data
Which format should the data be in?	The original recordings are used for systematic analysis of the theatre team's performance. A performance report is created. Only the performance report, enhanced with video clips, is presented to the team. As soon as the performance report has been created (in this case within 48 h), the original data are deleted	The general privacy‐by‐design principles Data are used fairly, and for limited and specifically stated purposes in an adequate and relevant manner. The performance report is stripped of any identifiable information. To enhance privacy, the faces of theatre staff are blurred and voices altered

MDR, medical data recorder.