Privacy notice

This privacy notice lets you know what happens to any personal data that you give to us, or any that we may collect from or about you.

This privacy notice applies to your personal information processed by or on behalf of the practice.

This notice explains:

• The information that we collect and use
• The reason why we collect this information
• Keeping your information safe and secure
• Where we store your information
• How we use your information
• Who we share your information with
• Deciding not to share your information
• How long we store your information for
• Accessing your Information
• Changes to your Personal Information
• Complaints or Objections

Introduction

The General Data Protection Regulation (GDPR) came into force on 25^th May 2018. This is a new regulation about the protection of any confidential and sensitive information.

This Notice explains how we collect and process your personal data and how we meet our obligations to you.

As your registered GP practice, we are the data controller for any personal data that we hold about you.

We are committed to protecting your privacy and will only use information collected lawfully in accordance with:

• Data Protection Act 2018
• The General Data Protection Regulations 2016 & UKGDPR 2021
• Human Rights Act 1998
• Common Law Duty of Confidentiality
• Health and Social Care Act 2012
• NHS Codes of Confidentiality, Information Security and Records Management
• Caldicott Principles
• Information sharing principle – To Share or Not to Share Review

The information that we collect and use

When you register with Northgate Surgery we must collect basic ‘personal data’ about you. This includes your name, address, contact details such as email and mobile. We may also ask you for health information, ethnicity, sex, and religious beliefs.  This type of information is called ‘Special data’.  We are required to do this to ensure your healthcare information is linked between other healthcare providers.

We will collect the following types of information from you or about you from a third party for example a hospital that help in the delivery of your care:

• Details about you, such as your address, legal representative, emergency contact details
• Any contact the surgery has had with you, such as appointments, clinic visits, emergency appointments or home visits
• Notes and reports about your physical or mental health
• Details about your treatment, care or support you need and receive
• Results of investigations such as laboratory tests, diagnosis, and medical imaging results
• Relevant information from other health professionals, relatives or those who care for you

• Information on medicines, side effects and allergies
• Your records will be retained in accordance with the NHS Code of Practice for Records Management

The reason why we collect this data

The NHS Act 2006 and the Health and Social Care Act 2012 tell us that Practices need to promote and provide the health services in England, improve quality of services, reduce inequalities, conduct research, review performance of services and deliver education and training.

To provide your care, we need to collect and keep information about you and your health on our clinical records. Your records are used to:

• Provide information to make health decisions made by care professionals with and for you
• Make sure your care is safe and effective Work with others providing you with care.

We also may use or share your information for the following purposes:

• Looking after the health of the public
• Making sure that our services can meet patient needs in the future
• Preparing statistics on NHS performance and activity (where steps will be taken to ensure you cannot be identified)
• Investigating concerns, complaints, or legal claims
• Helping staff to review the care they provide to make sure it is of the highest standards
• Training and educating clinical staff
• Research approved by the Local Research Ethics Committee. You will always be asked to provide consent to take part in research
• The Practice may conduct reviews of medications prescribed to its patients. This is a review of prescribed medications to ensure patients receive the most appropriate, up to date and cost-effective treatments.

The health care professionals who provide you with care must maintain records about your health and any treatment or care you have received previously.  This maybe at another GP Surgery or at a hospital. These records help to provide you with the best possible healthcare.

NHS health records may be electronic, on paper or a mixture of both. We use several ways of working and with computerised systems this helps to ensure that your information is kept confidential and secure. 

Legal Basis for processing your personal information

We need to know your personal, sensitive, and confidential data so that we can provide you with healthcare services as a General Practice.  Under the new rules called General Data Protection Regulation (GDPR) there are different reason why we may process your data, we mostly rely upon

Personal data:

• Article 6.1(e) Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

For personal data including special category (health) data:

• Article 9.2(h) Processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3.

We will also be using your data within the following regulations:

• To protect your vital interests as a provider of medical care, particularly where the individual is a child or a vulnerable adult
• To perform tasks in the public’s interest to deliver preventative medicine, medical diagnosis, medical research
• For legal obligations
• For contractual obligations
• To manage the health and social care system and services
• For the legitimate interest of improving our services

Keeping your information safe and secure

Every member of staff who works for an NHS organisation has a legal obligation to keep information about you confidential.  We maintain our duty of confidentiality by conducting annual training and awareness, ensuring access to personal data is limited to the appropriate staff and information is only shared with organisations and individuals that have a legitimate and legal basis for access.

We will only ever use or pass on information about you if others involved in your care have a genuine need for it.

We will not disclose your information to any third party without your permission unless there are exceptional circumstances, or where the law requires information to be passed on, for example:

• We believe you are putting yourself at risk of serious harm
• We believe you are putting a third party (adult or child) at risk of serious harm
• We have been instructed to do so via court order made against the practice
• Your information is essential for the investigation of a serious crime
• You are subject to the Mental Health Act (1983)
• Public Health England needs to be notified of certain infectious diseases
• Regulators use their legal powers to request your information as part of an investigation

Our practice policy is to respect the privacy of our patients, their families, and our staff and to maintain compliance with the General Data Protection Regulations (GDPR) and all UK specific Data Protection Requirements. Our policy is to ensure all personal data related to our patients will be protected.

All employees and sub-contractors who work with our practice are asked to sign a confidentiality agreement. The practice will, if required, sign a separate confidentiality agreement if necessary.

All the personal data we hold about you is processed in the UK.

Where we store your information

Your information will be collected either electronically using secure NHS Mail or a secure electronic record transferred over an NHS encrypted network connection.  In addition, physical information will be sent to your practice.  This information will be retained within your GP’s electronic patient record or within your physical medical records.

How we use your information

We may use your name, contact details, and email address to inform you of services that may benefit you, with your consent only.  There may be occasions where you will be asked if would like you to take part in innovations, research, improving services or identifying trends.  We will always ask for your consent before we do this, and you can choose to opt out at any stage.

Who we share your information with?

We may also share your information, subject to strict agreements on how it will be used, with the following organisations.

• NHS Trusts/Foundation Trusts
• GPs
• Community services such as district nurses, rehabilitation services, telehealth and out of hospital services.
• Child health services that undertake routine treatment or health screening
• Urgent care organisations, minor injury units or out of hours services
• Community hospitals
• Palliative care hospitals
• Care Homes
• Mental Health Trusts
• Hospitals
• Social Care organisations
• NHS Commissioning Support Units
• Independent Contractors such as dentists, opticians, pharmacists
• Private Sector Providers
• Voluntary Sector Providers
• Ambulance Trusts
• Clinical Commissioning Groups
• NHS England (NHSE) and NHS Digital (NHSD)
• Local Authorities
• Education Services
• Fire and Rescue Services
• Police & Judicial Services
• Voluntary Sector Providers
• Other ‘data processors’ of which you will be informed

Your information will only be shared if it is for the provision of your care or required for our statutory function and legal obligations.

Third party processors

When we use a third-party service provider to process data on our behalf, we will always have an appropriate agreement in place to ensure that they keep the data secure, that they do not use or share information other than in accordance with our instructions and that they are operating appropriately. An example of functions that may be carried out by third parties includes:

• Companies that provide IT services & support, including our core clinical systems; systems which manage patient facing services (such as our website and service accessible through the same); data hosting service providers; systems which facilitate appointment bookings or electronic prescription services; document management services etc.
• The systems that are contracted to maintain and store on our behalf are:
  • EMIS
  • Docman Clinical Systems o AccuRx

The safety and availability of your data is our utmost concern, and we are confident that this approach will improve data security, integrity, and performance.

Health risk screening/risk stratification

Health Risk Screening or Risk Stratification is a process that helps your GP to determine whether you are at risk of an unplanned admission or deterioration in health.  By using selected information such as age, gender, NHS number, diagnosis, existing long-term condition(s), medication history, patterns of hospital attendances, admissions, and periods of access to community care your GP will be able to judge if you are likely to need more support and care from time to time, or if the right services are in place to support the local population’s needs.

To summarise Risk Stratification is used in the NHS to:

• Help decide if a patient is at a greater risk of suffering from a particular condition
• Prevent an emergency admission
• Identify if a patient needs medical help to prevent a health condition from getting worse
• Review and amend provision of current health and social care services.

Your GP may use computer-based calculations to identify if you are at risk, with support from the local Commissioning Support Unit.

Your GP will conduct this process outside of your GP appointment.  This process is conducted electronically and without human intervention.  The resulting report is reviewed by a healthcare team of staff within the Practice.  This may result in contact being made with you if alterations to the provision of your care are identified.

The Secretary of State for Health and Social Care has granted permission for personal data to be used for the purposes of risk stratification; this is because it would take too long to carry out a manual review of all patients. You have the right to object to your information being used in this way.

Medicines management

The Practice may conduct Medicines Management Reviews of medications prescribed to its patients. This service performs a review of prescribed medications to ensure patients receive the most appropriate, up to date and cost-effective treatments.

If you decide to object to this, you should be aware that this may have a negative impact on the timely provision of your direct care.  Should you wish to object please contact the Practice Manager.

Research

This practice may undertake accredited research projects. Where this involves accessing or disclosing identifiable patient information, we will only do so with your explicit consent and with approval from the Research Ethics Committee or where we have been provided with special authority to do so without consent.

National screening programmes

• The NHS provides national screening programmes so that certain diseases can be detected at an early stage.
• These screening programmes include bowel cancer, breast cancer, cervical cancer, aortic aneurysms, and a diabetic eye screening service.
• The law allows us to share your contact information with Public Health England so that you can be invited to the relevant screening programme.

More information can be found at:

• www.gov.uk/topic/population-screeningprogrammes

Clinical audit

This practice contributes to national and internal clinical audits so that healthcare can be checked and reviewed.

• Information from medical records can help doctors and other healthcare workers measure and check the quality of care which is provided to you.
• The results of the checks or audits can show where hospitals are doing well and where they need to improve.
• The results of the checks or audits are used to recommend improvements to patient care.

Summary Care Record

NHS England have also created a Summary Care Record which contains information about medication you are taking, allergies you suffer from and any bad reactions to medication that you have had in the past.

The shared record means patients do not have to repeat their medical history at every care setting.

Your record will be automatically setup to be shared with the organisations listed above, however you have the right to ask your GP to stop your record from being shared or only allow access to parts of your record.

Your electronic health record contains lots of information about you.  In most cases, particularly for patients with complex conditions and care arrangements, this means that you get the best care and means that the person involved in your care has all the information about you. The shared record means patients do not have to repeat their medical history at every care setting.

If you decide not to share your information (opting –out)

You have the right to withdraw your consent at any time for any instance of processing, provided consent is the legal basis for the processing.  Please contact your GP Practice for further information and to raise your objection.

You have a choice about whether you want your confidential patient information to be used in this way. If you are happy with this use of information you do not need to do anything. If you do choose to opt out your confidential patient information will still be used to support your individual care.

National data opt out

Health and care organisations now have until July 2022 to put systems and processes in place so they can be compliant with the national data opt-out and apply your choice to any confidential patient information they use or share for purposes beyond your individual care. Our organisation is compliant with the national data opt-out policy.

To find out more or to register your choice to opt out, please visit www.nhs.uk/your–nhsdata–matters or telephone 0300 3035678.  On the webpage you will:

• See what is meant by confidential patient information
• Find examples of when confidential patient information is used for individual care and examples of when it is used for purposes beyond individual care
• Find out more about the benefits of sharing data
• Understand more about who uses the data
• Find out how your data is protected
• Be able to set or change your opt-out setting
• Find the contact telephone number if you want to know any more or to set/change your opt-out by phone
• See the situations where the opt-out will not apply, i.e. where here is a legal requirement or where it is in the public interest to share (go to more exemptions for further information)

You can also find out more about how patient information is used at:

• www.hra.nhs.uk/information–about–patients/ (which covers health and care research)
• www.understandingpatientdata.org.uk/what–you–need–know (which covers how and why patient information is used, the safeguards and how decisions are made)

You can change your mind about your choice at any time.

Data being used or shared for purposes beyond individual care does not include your data being shared with insurance companies or used for marketing purposes and data would only be used in this way with your specific agreement.

• Right to object: If we are using your data because it is necessary for our legal requirements to do so, and you do not agree, you have the right to object. We will respond to your request within 30 days (although we may be allowed to extend this period in certain cases). Generally, we will only disagree with you if certain limited conditions apply.
• Right to withdraw consent: Where we have obtained your consent to process your personal data for certain activities (for example for a research project), you may withdraw your consent at any time.
• Right of data portability: If you wish to transfer your data from us to another GP Practice, we will help with this with a data transfer called GP2GP which will transfer your medical records held on our clinical system. A copy of your electronic record will stay within our clinical system, but this is closed off and cannot be accessed by us without a legitimate reason.

How long will we store your information?

The NHS Records Management Code of Practice 2021 identifies will replace the 2016 version. specific retention periods which are listed in Appendix II: Retention Schedule.

Please see www.nhsx.nhs.uk/information–governance/guidance/recordsmanagement–code/records–management–code–of–practice–2021/ for a copy of the 2021 NHS retention period policy.

Access to your personal information

The General Data Protection Regulations allows you to find out what information is held about you including information held within your medical records, either in electronic or physical format.  This is known as a ‘Subject Access Request ‘

You also have the right to have it amended should it be inaccurate this is called:

• Right to rectification: In certain situations, you have the right to request us to rectify your personal data. We will respond to your request within 30 days (although we may be allowed to extend this period in certain cases) and will only disagree with you if certain limited conditions apply.

To request access to your information, you need to do the following:

• Your request should be made to the GP Practice
• For information from the hospital, you should write directly to them
• We are required to respond to you within 30 days
• You will need to give adequate information (for example full name, address, date of birth, NHS number) and details of your request
• We will also ask you to provide additional information before we release information to you

You should be aware that some details in your health records may not be able to be given to you. This will be in the interests of your wellbeing or to protect the identity of a third party. This decision will be made by your GP who is legally obligated to withhold parts of your medical records if they deem it in yours or a third party’s interest to do so.

Prospective access to patient records online

In Summer 2022, patients with online access to their medical records will be able to have access to their future full medical records, including free texts, letters, and documents once they have been reviewed and filed by the GP.  This will not affect proxy access.

There will be limited legitimate reasons why access to prospective medical records will not be given or will be reduced and they are based on safeguarding.  If the release of information is likely to cause serious harm to the physical or mental health of the patient or another individual, the GP is allowed to refuse or reduce access to prospective records; third party information may also not be disclosed if deemed necessary.  On occasion, it may be necessary for a patient to be reviewed before access is granted, if access can be given without a risk of serious harm.

What should you do if your personal information changes?

It is important that you tell the person treating you if any of your details such as your name or address have changed or if any of your details such as date of birth is incorrect for this to be amended. You have a responsibility to inform us as soon as possible of any changes so our records are accurate and up to date for you.

Objections/complaints

Should you have any concerns about how your information is managed at the GP practice please contact the Practice Manager, Mark Goldstraw-Davis. If you are still unhappy following a review by the GP practice, you have a right to lodge a complaint with the Information Commissioner.

Information Commissioner:
Wycliffe house
Water Lane
Wilmslow
Cheshire
SK9 5AF

Phone
01625 545745
Website
www.ico.org.uk

If you are happy for your data to be extracted and used for the purposes described in this privacy notice, then you do not need to do anything.  If you have any concerns about how your data is shared, then please contact the Practice Data Protection Officer.

If you would like to know more about your rights in respect of the personal data we hold about you, please contact the Data Protection Officer as below.

Data protection officer

The Practice Data Protection Officer is Sharon Forrester-Wild, contact

Any queries about Data Protection issues should be addressed to:

• dpo.healthcare@nhs.net or 01270 275217

Changes

It is important to point out that we may amend this privacy notice from time to time.  If you are dissatisfied with any aspect of our privacy notice, please contact the practice manager or data protection officer.