take all reasonable steps to confirm the accuracy of patient records provided to or accessed by it;

provide to the contractor, guidance, templates, and privacy notices, relating to the contractor’s processing of personal data and the contractor’s maintenance of a record in accordance with sub-paragraph 66(d);

notify the contractor timeously of its current policies regarding data security, personal data security and IT security processes;

maintain a record of its processing activities carried out in relation to a contractor’s patient records;

ensure that any of its employees who have access to the contractor’s patient records and practice data has undergone adequate data protection training; and

make available appropriate data protection training to the contractor and its employees.