Privacy Notice

Why we collect information about you

Health care professionals who provide you with care are required by law to maintain records about your health and any treatment or care you have received within any NHS organisation. These records help to provide you with the best possible healthcare and help us to protect your safety.

We collect and hold data for the purpose of providing healthcare services to our patients and running our organisation which includes monitoring the quality of care that we provide. In carrying out this role we will collect information about you which helps us respond to your queries or secure specialist services. We will keep your information in written form and/or in digital form. The records will include basic details about you, such as your name and address. They will also contain more sensitive information about your health and also information such as outcomes of needs assessments.

Details we collect about you

The health care professionals who provide you with care maintain records about your health and any treatment or care you have received previously (e.g. from Hospitals, GP Surgeries, A&E, etc.). These records help to provide you with the best possible healthcare.

Records which this GP Practice will hold about you will include the following:

• Details about you, such as your address and next of kin
• Any contact the surgery has had with you, such as appointments, clinic visits, emergency appointments, etc.
• Notes and reports about your health
• Details about your treatment and care
• Results of investigations, such as laboratory tests, x-rays, etc.
• Relevant information from other health professionals, relatives or those who care for you

How we keep your information confidential and safe

Everyone working for our organisation is subject to the Common Law Duty of Confidence. Information provided in confidence will only be used for the purposes advised with consent given by the patient, unless there are other circumstances covered by the law. The NHS Digital Code of Practice on Confidential Information applies to all NHS staff and they are required to protect your information, inform you of how your information will be used, and allow you to decide if and how your information can be shared. All our staff are expected to make sure information is kept confidential and receive regular training on how to do this.

The health records we use will be electronic, on paper or a mixture of both, and we use a combination of working practices and technology to ensure that your information is kept confidential and secure. Your records are backed up securely in line with NHS standard procedures. We ensure that the information we hold is kept in secure locations, is protected by appropriate security and access is restricted to authorised personnel.

We also make sure external data processors that support us, for example, companies who provide mailing services, text messaging services and shredding services, are legally and contractually bound to operate, and prove security arrangements are in place where data that could or does identify a person are processed.

We are committed to protecting your privacy and will only use information collected lawfully in accordance with:

• Data Protection Legislation
• General Data Protection Regulation
• Human Rights Act
• Common Law Duty of Confidentiality
• NHS Codes of Confidentiality and Information Security
• Health and Social Care Act 2015
• And all applicable legislation

We maintain our duty of confidentiality to you at all times. We will only ever use or pass on information about you if we reasonably believe that others involved in your care have a genuine need for it. We will not disclose your information to any third party without your permission unless there are exceptional circumstances (such as a risk of serious harm to yourself or others) or where the law requires information to be passed on.

How we use your information

Improvements in information technology are also making it possible for us to share data with other healthcare organisations for the purpose of providing you, your family and your community with better care. For example it is possible for healthcare professionals in other services to access your record with your permission when the practice is closed. This is explained further in the Local Information Sharing section below.

Under the powers of the Health and Social Care Act 2015, NHS Digital can request personal confidential data from GP Practices without seeking patient consent for a number of specific purposes, which are set out in law. These purposes are explained below.

You can choose to withdraw your consent to your personal data being shared for these purposes. When we are about to participate in a new data-sharing project we will display prominent notices in the Practice and on our website at least four weeks before the scheme is due to start. Instructions will be provided to explain what you have to do to ‘opt-out’ of the new scheme. Please be aware that it may not be possible to opt out of one scheme and not others, so you may have to opt out of all the schemes if you do not wish your data to be shared.

You can object to your personal information being shared with other healthcare providers but should be aware that this may, in some instances, affect your care as important information about your health might not be available to healthcare staff in other organisations. If this limits the treatment that you can receive then the practice staff will explain this to you at the time you object.

To ensure you receive the best possible care, your records are used to facilitate the care you receive. Information held about you may be used to help protect the health of the public and to help us manage the NHS.

Assessing Treatment Outcomes

Information is used by Berkshire Healthcare Foundation Trust (BHFT) to assess the effectiveness of providing psychotherapy treatment to patients with long term conditions. NHS numbers and a summary of the number of visits to the practice before and after treatment is shared with BHFT. If you do not wish your information to be shared for this purpose please let your GP know.

Clinical audits

Information will be used by Buckinghamshire, Oxfordshire and Berkshire West (BOB) Integrated Care System and the Care Quality Commission (CQC) for clinical audits to monitor the quality of the service provided to patients with long terms conditions. When required, information will be held centrally and used for statistical purposes (e.g. the National Diabetes Audit). When this happens, strict measures are taken to ensure that individual patients cannot be identified from the data.

Population Health Management and Locally Commissioned Services

Integrated Care Systems work together with GP practices by auditing anonymised data to monitor and understand the health and care needs of the care system’s population, including health inequalities, provide support to where it will have the most impact and identify early actions to keep people well, not only focusing on people in direct contact with services, but looking to join up care across different partners.

The data does not include identifiable information and is used to support patient care and ensure providers are correctly paid for the services they provide.

Legal Basis

• Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’;
• Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine’

Clinical Research

We may share anonymous patient information with research companies for the purpose of exploring new ways of providing healthcare and treatment for patients with certain conditions. This data will not be used for any other purpose.

Where personal confidential data is shared your consent will be required.

Where you have opted out of having your identifiable information shared for this Planning or Research your information will not be shared.

Legal Basis

• Articles 6(1)(a) and 9(1)(a) – explicit consent; or
• Article 6(1)(c) (where we are legally obligated to share your personal data) for your standard personal data and Article 9(2)(j) (scientific research) for your health data.

Where identifiable data is required for research, patient consent will be needed, unless there is a legitimate reason under law to do so or there is support under the Health Service (Control of Patient Information Regulations) 2002 (‘section 251 support’) applying via the Confidentiality Advisory Group in England and Wales.

Sharing of aggregated non identifiable data is permitted.

Therapy Review

The Practice is currently working with an independent company, Interface Clinical Services (an IQVIA business), to review data from the records of patients who have Type 2 Diabetes to help provide you with the best possible care and outcome.

The company fully complies with data protection legislation and their work is overseen by your GP.

Your personal data will be treated as strictly confidential but anonymised summary (which does not identify individual) data may be collated for the purposes of reporting.

If you have any concerns about your data being used in this way, please contact the practice staff.

Legal Basis - The processing of personal data in the delivery of direct care and for providers’ administrative purposes in this surgery and in support of direct care elsewhere is supported under the following:

• Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’;
• Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine’

Direct Care

Personal information is shared with NHS trusts, Pharmacies, Enhanced Care providers, Nursing Home, Community Providers, Other care Providers in order to provide you with individual direct care services. This could be hospitals or community providers for a range of services, including treatment, operations, physio, and community nursing, ambulance service.

Legal Basis - The processing of personal data in the delivery of direct care and for providers’ administrative purposes in this surgery and in support of direct care elsewhere is supported under the following:

• Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’;
• Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine’

Improving access to NHS Health Checks

We are working with the Berkshire West Primary Care Alliance as part of a Community Wellness Outreach Project to increase NHS health checks, we are using third party providers who will have access to aspects of patient data only where this would be relevant. All parties have completed a Data Protection Impact Assessments. If you have any questions please get in touch with – Solutions4Health

ACR project for patients with diabetes (and/or other conditions)

The data is being processed for the purpose of delivery of a programme, sponsored by NHS Digital, to monitor urine for indications of chronic kidney disease (CKD) which is recommended to be undertaken annually for patients at risk of chronic kidney disease e.g., patients living with diabetes. The programme enables patients to test their kidney function from home. We will share your contact details with Healthy.io to enable them to contact you and send you a test kit. This will help identify patients at risk of kidney disease and help us agree any early interventions that can be put in place for the benefit of your care. Healthy.io will only use your data for the purposes of delivering their service to you. If you do not wish to receive a home test kit from Healthy.io we will continue to manage your care within the Practice. Healthy.io are required to hold data we send them in line with retention periods outlined in the Records Management code of Practice for Health and Social Care. Further information about this is available on  their website at: Further information about this is available on  their website.

Individual Funding Request

An ‘Individual Funding Request’ is a request made on your behalf, with your consent, by a clinician, for funding of specialised healthcare which falls outside the range of services and treatments that BOB Integrate Care System has agreed to commission for the local population. An Individual Funding Request is taken under consideration when a case can be set out by a patient’s clinician that there are exceptional clinical circumstances which make the patient’s case different from other patients with the same condition who are at the same stage of their disease, or when the request is for a treatment that is regarded as new or experimental and where there are no other similar patients who would benefit from this treatment. A detailed response, including the criteria considered in arriving at the decision, will be provided to the patient’s clinician.

We may need to process your personal information where we are required to fund specific treatment for you for a particular condition that is not already covered in our standard NHS contract.

The clinical professional who first identifies that you may need the treatment will explain to you the information that is needed to be collected and processed to assess your needs and commission your care; they will gain your explicit consent to share this. You have the right to withdraw your consent at any time but this may affect the decision to provide individual funding.

Legal Basis

• Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’;
• Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine’

Invoice Validation

Invoice validation is an important process. It involves using your NHS number to identify which CCG or Integrated Care System is responsible for paying for your treatment. Section 251 of the NHS Act 2006 provides a statutory legal basis to process data for invoice validation purposes. We can also use your NHS number to check whether your care has been funded through specialist commissioning, which NHS England will pay for. The process makes sure that the organisations providing your care are paid correctly.

Eastfield House Surgery are engaging with Enhanced Primary Care Limited (EPC) for their Personally Administered Items (PPA) Reconciliation Service. A PPA is classed as a prescription item which is prescribed and administered by a member of the practice team and attracts payment under the ‘NHS General Medical Services Statement of Financial Entitlements’. Enhanced Primary Limited search through the practices clinical system to find hidden income that otherwise would go unclaimed. This income will play its part in supporting the sustainability of Primary Care.

The purpose of the processing is to identify episodes of care that have occurred where a reimbursable item has been used and not claimed. Searches are run by Enhanced Primary Care Limited and pseudonymised data extracted from our clinical system.

Local Information Sharing

Your GP electronic patient record is held securely and confidentially on an electronic system managed by your registered GP practice. If you require attention from a health professional such as an Emergency Department, Minor Injury Unit or Out Of Hours service, the professionals treating you are better able to give you safe and effective care if relevant information from your GP record is available to them.

Where available, this information can be shared electronically with other local health and care providers via a secure system designed for this purpose. Depending on the service you are using and your health and care needs, this may involve the professional accessing a secure system that enables them to view relevant parts of your GP electronic patient record (e.g. Connected Care or your Summary Care Record).

In all cases, your information is only accessed and used by authorised health and social care professionals in Berkshire based organisations who are involved in providing or supporting your direct care. Your permission will be asked before the information is accessed, other than in exceptional circumstances (e.g. emergencies) if the healthcare professional is unable to ask you and this is deemed to be in your best interests (which will then be logged).

National Fraud Initiative - Cabinet Office

The use of data by the Cabinet Office for data matching is carried out with statutory authority under Part 6 of the Local Audit and Accountability Act 2014. It does not require the consent of the individuals concerned under Data Protection legislation. Data matching by the Cabinet Office is subject to a Code of Practice. For further information visit their website

National Registries

National Registries (such as the Learning Disabilities Register, Public Health Screening Programmes, Vaccination Programmes, etc) have statutory permission under Section 251 of the NHS Act 2006, to collect and hold service user identifiable information without the need to seek informed consent from each individual service user.

Personal identifiable and anonymous data is shared.

The NHS provides national screening programmes so that certain diseases can be detected at an early stage. These currently apply to bowel cancer, breast cancer, aortic aneurysms and diabetic retinal screening service to name a few. The law allows us to share your contact information, and certain aspects of information relating to the screening with Public Health England so that you can be appropriately invited to the relevant screening programme.

Patients may not opt out of having their personal information shared for Public Health reasons.

Patients may opt out of being screened at the time of receiving an invitation.

Legal Basis

• Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’;
• Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine’

Risk Stratification

‘Risk stratification for case finding’ is a process for identifying and managing patients who have or may be at-risk of health conditions (such as diabetes) or who are most likely to need healthcare services (such as people with frailty). Risk stratification tools used in the NHS help determine a person’s risk of suffering a particular condition and enable us to focus on preventing ill health before it develops.

Information about you is collected from a number of sources including NHS Trusts, GP Federations and your GP Practice. A risk score is then arrived at through an analysis of your de-identified information. This can help us identify and offer you additional services to improve your health.

Risk-stratification data may also be used to improve local services and commission new services, where there is an identified need. In this area, risk stratification may be commissioned by BOB. Section 251 of the NHS Act 2006 provides a statutory legal basis to process data for risk stratification purposes. Further information about risk stratification

If you do not wish information about you to be included in any risk stratification programmes, please let us know. We can add a code to your records that will stop your information from being used for this purpose. Please be aware that this may limit the ability of healthcare professionals to identify if you have or are at risk of developing certain serious health conditions.

Type of Data – Identifiable/Pseudonymised/Anonymised/Aggregate Data

Legal Basis

• Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’;
• Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine’

Safeguarding of Adults and Children

To ensure that adult and children’s safeguarding matters are managed appropriately, access to identifiable information will be shared in circumstances where it is legally required for the safety of the individuals concerned.

We will share personal confidential information with the safeguarding team where there is a need to assess and evaluate any safeguarding concerns and to protect the safety of individuals and children.

Consent is not required to share information for this purpose.

Direct Care under UK GDPR:

• Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’;
• Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine’

Summary Care Record (SCR)

The NHS in England uses a national electronic record called the Summary Care Record (SCR) to support patient care. It contains key information from your GP record. Your SCR provides authorised healthcare staff with faster, secure access to essential information about you in an emergency or when you need unplanned care, where such information would otherwise be unavailable.

Summary Care Records are there to improve the safety and quality of your care. SCR core information comprises your allergies, adverse reactions and medications. An SCR with additional information can also include reason for medication, vaccinations, significant diagnoses / problems, significant procedures, anticipatory care information and end of life care information. Additional information can only be added to your SCR with your agreement.

Legal Basis

• Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’;
• Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine’

Patients have the right to opt out of having their information shared with the SCR by completion of the form which can be downloaded here and returned to the practice.

Please be aware that if you choose to opt-out of SCR, NHS healthcare staff caring for you outside of this surgery may not be aware of your current medications, allergies you suffer from and any bad reactions to medicines you have had, in order to treat you safely in an emergency. Your records will stay as they are now with information being shared by letter, email, or phone. If you wish to opt-out of having an SCR please make an appointment with your GP to discuss the implications of this.

Patient Record data base

Your medical record will be processed in order that a data base can be maintained, this is managed in a secure way and there are robust processes in place to ensure your medical record is kept accurate, and up to date. Your record will follow you as you change surgeries throughout your life.

Closed records will be archived by NHS England

Legal Basis

• Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’;
• Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine’

Data Processor - Emis, Ardens, Anima

Medical reports Subject Access Requests (SAR’s)

Your medical record may be shared in order that Solicitors/persons acting on your behalf can conduct certain actions as instructed by you. Insurance companies seeking a medical reports where you have applied for services offered by then can have a copy to your medical history for a specific purpose.

Legal Basis

• Article 6(1)(a) – consent for personal data; and
• Article 9(2)(a) – explicit consent for special-category data.

Supporting Medicines Management Team

Buckinghamshire, Oxfordshire and Berkshire West (BOB) Integrated Care System operates pharmacist and prescribing advice services to support local GP practices with prescribing queries, which may require identifiable information to be shared. These pharmacists work with your usual GP to provide advice on medicines and prescribing queries, and review prescribing of medicines to ensure that it is appropriate for your needs, safe and cost-effective. Where specialist prescribing support is required, the Buckinghamshire, Oxfordshire and Berkshire West (BOB) Integrated Care System medicines optimisation team may order medications on behalf of your GP Practice to support your care.

Legal Basis

• Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’;
• Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine’

Medication/Prescribing

Prescriptions containing personal identifiable and health data will be shared with organisations who provide medicines management including chemists/pharmacies, in order to provide patients with essential medication regime management, medicines and or treatment as their health needs dictate.

This process is achieved either by face to face contact with the patient or electronically. Pharmacists may be employed to review medication. Patients may be referred to pharmacists to assist with diagnosis and care for minor treatment, patients may have specified a nominated pharmacy they may wish their repeat or acute prescriptions to be ordered and sent directly to the pharmacy making a more efficient process. Arrangements can also be made with the pharmacy to deliver care and medication.

Legal Basis

• Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’;
• Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine’

Processor – Pharmacy of patient’s choice

Population Health Management and Locally Commissioned Services

Integrated Care Systems work together with GP practices by auditing anonymised data to monitor and understand the health and care needs of the care system’s population, including health inequalities, provide support to where it will have the most impact and identify early actions to keep people well, not only focusing on people in direct contact with services, but looking to join up care across different partners.

The data does not include identifiable information and is used to support patient care and ensure providers are correctly paid for the services they provide.

Legal Basis

• Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’;
• Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine’

Payments

Contract holding GPs in the UK receive payments from their respective governments on a tiered basis. Most of the income is derived from baseline capitation payments made according to the number of patients registered with the practice on quarterly payment days. These amounts paid per patient per quarter varies according to the age, sex and other demographic details for each patient. There are also graduated payments made according to the practice’s achievement of certain agreed national quality targets known as the Quality and Outcomes Framework (QOF), for instance the proportion of diabetic patients who have had an annual review.

Practices can also receive payments for participating in agreed national or local enhanced services, for instance opening early in the morning or late at night or at the weekends. Practices can also receive payments for certain national initiatives such as immunisation programs and practices may also receive incomes relating to a variety of non-patient related elements such as premises. Finally there are short term initiatives and projects that practices can take part in. Practices or GPs may also receive income for participating in the education of medical students, junior doctors and GPs themselves as well as research.

In order to make patient-based payments basic and relevant necessary data about you needs to be sent to the various payment services. The release of this data is required by English laws.

Legal Basis

• Article 6(1)(c) ‘processing is necessary for compliance with a legal obligation to which the controller is subject’;
• Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine’

Data Processors – NHS England, ICB, Public Health

PCN (Primary Care Network)

Your medical record will be shared with the A34 PCN in order that all surgeries in the PCN can provide direct care services to the patient population.

Legal Basis

• Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’;
• Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine’

Our PCN has 3 practices Eastfield House (us) The Downland and Strawberry Hill Medical Centre.

Smoking cessation

Personal information is shared in order for the smoking cessation service to be provided. Only those patients who wish to be party to this service will have their data shared.

Legal Basis

• Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’;
• Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine’

Police

Personal confidential information may be shared with the Police authority for certain purposes. The level of sharing and purpose for sharing may vary. Where there is a legal basis for this information to be shared consent will not always be required.

The Police will require the correct documentation in order to make a request. This could be but not limited to, DS 2, Court order, s137, the prevention and detection of a crime. Or where the information is necessary to protect a person or community.

Legal Basis – UK GDPR

• Article 6(1)(c) – to comply with a legal obligation; and
• Article 9(2)(j) – ‘for reasons of substantial public interest’

Coroner

Personal health records or information relating to a deceased patient may be shared with the coroner.

Legal Basis – UK GDPR:

• Article 6(1)(c) – to comply with a legal obligation; and
• Article 9(2)(h) – ‘necessary for the purposes of preventative or occupational medicine’

Medical Examiner

Medical records associated with deceased patients are outside scope of the UK GDPR. However, next of kin details are within the scope of the UK GDPR. We will share specified deceased patient records and next of kin details with the Medical Examiner Service.

Legal Basis:

• Article 6(1)(c) – necessary under a legal obligation to which the controller is subject”; and
• Article 9(2)(h) – “processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services”

Non-commissioned private healthcare providers

Personal information shared with private health care providers in order to deliver direct care to patients at the patient’s request. Consent from the patient will be required to share data with Private Providers.

Legal Basis

• Articles 6(1)(a) and 9(2)(a) – consent by the patient given under contract to the provider.

Messaging Service

Personal identifiable information shared with the messaging service in order that messages including; appointment reminders; results; campaign messages related to specific patients health needs; and direct messages to patients, can be transferred to the patient in a safe way.

Legal Basis

• Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’;
• Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine’

Data Processor: Accurx, Iplato

Remote consultation Including – Video Consultation and Clinical photography

Personal information including images may be processed, stored and with the patients consent shared, in order to provide the patient with urgent medical advice.

Legal Basis

• Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’;
• Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine’

Patients may be videoed or asked to provide photographs with consent. There are restrictions on what the practice can accept photographs of. No photographs of the full face, no intimate areas, no pictures of patients who cannot consent to the process. No pictures of children.

MDT Meetings

For some long term conditions, the practice participates in meetings with staff from other agencies involved in providing care, to help plan the best way to provide care to patients with these conditions. Personal data will be shared with other agencies in order that mutual care packages can be decided.

Legal Basis

• Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’;
• Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine’

Learning Disability Mortality

The Learning Disability Mortality Review (LeDeR) programme was commissioned by NHS England to investigate the death of patients with learning difficulties and Autism to assist with processes to improve the standard and quality of care for people living with a learning disability and Autism. Records of deceased patients who meet with this criteria will be shared with NHS England.

Legal Basis: It has approval from the Secretary of State under section 251 of the NHS Act 2006 to process patient identifiable information who fit within a certain criteria.

Processor: ICB, NHS England

General Practice Extraction Service (GPES)

GP practices are required to provide data extraction of their patient’s personal confidential information for various purposes to NHS England. The objective of this data collection is on an ongoing basis to identify patients registered at General Practices who fit within a certain criteria, in order to monitor and either provide direct care, or prevent serious harm to those patients. Below is a list of the purposes for the data extraction, by using the link you can find out the detail behind each data extraction and how your information will be used to inform this essential work:

• At risk patients including severely clinically vulnerable
• NHS England has directed NHS England to collect and analyse data in connection with Cardiovascular Disease Prevention Audit
• GPES Physical Health Checks for people with Severe Mental Illness (PHSMI) data collection.

Legal Basis - All GP Practices in England are legally required to share data with NHS England for this purpose under section 259(1)(a) and (5) of the The Health and Social Care Act 2012

Further detailed legal basis can be found in each link.

Any objections to this data collection should be made directly to NHS England.

Shared Care Record

In order for the practice to have access to a shared record, the Integrated Care Service has commissioned a number of systems including GP connect, which is managed by NHS England, to enable a shared care record, which will assist in patient information to be used for a number of care related services. These may include Population Health Management, Direct Care, and analytics to assist with planning services for the use of the local health population.

Where data is used for secondary uses no personal identifiable data will be used. Where personal confidential data is used for Research explicit consent will be required.

Legal Basis –

• Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’;
• Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine’

Processor: NHS England

Data Retention

We manage patient records in line with the Records Management NHS Code of Practice for Health and Social Care which sets the required standards of practice in the management of records for those who work within or under contract to NHS organisations in England, based on current legal requirements and professional best practice.

Who are our partner organisations?

We may also have to share your information, subject to strict agreements on how it will be used, with the following organisations:

• NHS Trusts
• Specialist Trusts
• GP Federations
• Independent Contractors such as dentists, opticians, pharmacists
• Private Sector Providers
• Voluntary Sector Providers
• Ambulance Trusts
• Clinical Commissioning Groups
• Social Care Services
• Local Authorities
• Education Services
• Fire and Rescue Services
• Police
• Other ‘data processors’

We will never share your information outside of health partner organisations without your explicit consent unless there are exceptional circumstances such as when the health or safety of others is at risk, where the law requires it or to carry out a statutory function.

Within the health partner organisations (NHS and Specialist Trusts) and in relation to the above mentioned themes – Risk Stratification, Invoice Validation, Supporting Medicines Management, Summary Care Record – we will assume you are happy for your information to be shared unless you choose to opt-out (see below).

This means you will need to express an explicit wish to not have your information shared with the other organisations; otherwise it will be automatically shared. We are required by law to report certain information to the appropriate authorities. This is only provided after formal permission has been given by a qualified health professional. There are occasions when we must pass on information, such as notification of new births, where we encounter infectious diseases which may endanger the safety of others, such as meningitis or measles (but not HIV/AIDS), and where a formal court order has been issued. Our guiding principle is that we are holding your records in strictest confidence.

Your right to withdraw consent for us to share your personal information (Opt-Out)

If you are happy for your data to be extracted and used for the purposes described in this privacy notice then you do not need to do anything. If you do not want your information to be used for any purpose beyond providing your care you can choose to opt-out. If you wish to do so, please let us know so we can code your record appropriately. We will respect your decision if you do not wish your information to be used for any purpose other than your care but in some circumstances we may still be legally required to disclose your data.

We are required by law to share some data from patients’ clinical records with NHS Digital under the General Practice Data for Planning and Research Directions 2021. More information, including how to opt-out of sharing of your records

More information, including how to opt-out of sharing of your records

There are two main types of opt-out:

Type 1 Opt-Out

If you do not want information that identifies you to be shared outside the practice, for purposes beyond your direct care, you can register a ‘Type 1 Opt-Out’. This prevents your confidential personal information from being used other than in particular circumstances required by law, such as a public health emergency like an outbreak of a pandemic disease.

National Opt-Out (Also known as Type 2 Opt-Out)

NHS Digital collects information from a range of places where people receive care, such as hospitals and community services. If you do not want your personal confidential information to be shared outside of NHS Digital, for purposes other than for your direct care, you can register a ‘Type 2 Opt-Out’.

Further information about Type 2 Opt-Outs

If you wish to discuss or change your opt-out preferences at any time please contact the surgery

Access to your information

Under Data Protection Legislation everybody has the right to see, or have a copy, of data we hold that can identify you, with some exceptions. You do not need to give a reason to see your data. If you want to access your data you must make the request in writing. Under special circumstances, some information may be withheld. We may charge a reasonable fee for the administration of the request. If you wish to have a copy of the information we hold about you, please contact the surgery

Record Storage and Management

BOB ICB are commissioning an off-site storage solution with a scan-on-demand (SCOD) function. The Legal Basis ‘is necessary for the performance of a task carried out in the public interest or in the exercise of official authority; and Processing is necessary for the purposes of the preventive or occupational medicine, for the assessment of the working capacity of the new employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of union or member state law or pursuant to contract with a health professional and subject to conditions and safeguards.

Good records management supports good data governance and data protection. When transferring data off site, an appropriate use of secure transport/courier with an audit to track transportation. The off-site storage team, Oasis – have in place ISO27001, Cyber Essentials plus certification. Review by the GP DPO, as BOB ICB DPO assured risks have been identified and mitigated.

Where appropriate, paper patient records are being scanned directly onto the patient records and paper copies destroyed. This means that we will no longer keep these paper records. The provider of the service ensures that the records are safe and confidential and security standards have been reviewed by BOB ICB CPO.

Telephone Calls

The practice uses an internet-based telephony system that records telephone calls, for their own purpose and to assist with patient consultations. The telephone system has been commissioned to assist with the high volume and management of calls into the surgery, which in turn will enable a better service to patients. We record all calls to and from the practice for monitoring and training purposes.

Our phone system is set to automatically retain calls for 3 months. After this point, the recordings are automatically deleted. The 3 month retention period enables us to download and retain exact and unaltered copies of calls where required for medico-legal purposes.

If you do not wish for your telephone consultation to be recorded, please inform the staff member at the start of the consultation.

While there is a robust contract in place with the processor, the surgery has undertaken this service to assist with the direct care of patients in a more efficient way.

• Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’;
• Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine’

Change of Details

It is important that you tell the person treating you if any of your details such as your name or address have changed or if any of your details are incorrect in order for this to be amended. Please inform us of any changes so our records for you are accurate and up to date.

Mobile telephone number and text messaging

If you provide us with your mobile phone number, we may use this to send you reminders about your appointments, confirmation of referrals, chronic conditions recalls or other health screening information. Please let us know if you do not wish to receive reminders on your mobile. We use an encrypted system to ensure sensitive and personal information sent via text messaging is kept secure.

Email Address

Where you have provided us with your email address, we will use this to send you information relating to your health and the services we provide. If you do not wish to receive communication by email, please let us know.

NHS App

We use the NHS Account Messaging Service provided by NHS England to send you messages relating to your health and care. You need to be an NHS App user to receive these messages. Further information about the service can be found at the privacy notice for the NHS App managed by NHS England.

CCTV

Please see separate Privacy Notice for CCTV

Notification

Data Protection Legislation requires organisations to register a notification with the Information Commissioner to describe the purposes for which they process personal and sensitive information. We are registered as a Data Controller and our registration can be viewed online in the public register.

Data Protection Officer (DPO)

Should you have any data protection questions or concerns please contact our Data Protection Officer

Complaints

If you have concerns or are unhappy about any of our services, please contact the Practice Manager.

For independent advice about data protection, privacy and data-sharing issues, you can contact:

The Information Commissioner
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Phone: 0303 123 1113
Contact them online

Further Information

Further information about the way in which the NHS uses personal information and your rights in that respect

The NHS Care Record Guarantee

The NHS Care Record Guarantee for England sets out the rules that govern how patient information is used in the NHS, what control the patient can have over this, the rights individuals have to request copies of their data and how data is protected under Data Protection Legislation.

The NHS Constitution

The NHS Constitution establishes the principles and values of the NHS in England. It sets out the rights patients, the public and staff are entitled to.

These rights cover how patients access health services, the quality of care you’ll receive, the treatments and programs available to you, confidentiality, information and your right to complain if things go wrong.

NHS Constitution for England

NHS Digital

NHS Digital collects health information from the records health and social care providers keep about the care and treatment they give, to promote health or support improvements in the delivery of care services in England.

Understanding the health and care information we collect

Reviews of and Changes to our Privacy Notice

We will keep our Privacy Notice under regular review. This notice was last reviewed in May 2025.

Any changes to this notice will be published on our website and in a prominent area at the Practice.