This privacy notice explains why The Family Practice collects information about you, how we keep it safe and confidential, and how that information may be used. Information on how and why NHS Digital collects, analyses, publishes and shares data collected from GP practices for planning and research can be found at General Practice Data for Planning and Research: NHS Digital Transparency Notice – NHS Digital
Updated: 09/06/2021
Why we collect information about you?
Health care professionals who provide you with care are required by law to maintain records about your health and any treatment or care you have received within any NHS organisation. These records help to provide you with the best possible healthcare.
We collect and hold data for the sole purpose of providing healthcare services to our patients. In carrying out this role we may collect information about you which helps us respond to your queries or secure specialist services. We may keep your information in written form and/or in digital form. The records may include basic details about you, such as your name and address. They may also contain more sensitive information about your health and information such as outcomes of needs assessments.
Details we collect about you
The health care professionals who provide you with care maintain records about your health and any treatment or care you have received previously or elsewhere (e.g. NHS Hospital Trust, other GP Surgery, Out of Hours GP Centre, A&E, Walk-in clinic, etc.). These records help to provide you with the best possible healthcare.
Records which we may hold about you may include the following:
- Details about you, such as your address and next of kin, emergency contacts
- Any contact the surgery has had with you, such as appointments, clinic visits, immunisations, emergency appointments, etc.
- Notes and reports about your health
- Details about your treatment and care
- Results of investigations, such as laboratory tests, x-rays, etc.
- Relevant information from other health professionals, relatives or those who care for you
How we keep your information confidential and safe
We are committed to protecting your privacy and will only use information collected lawfully in accordance with:
- Data Protection Act 1998 and General Data Protection Regulation 2016
• Human Rights Act 1998
• Common Law Duty of Confidentiality
• Health and Social Care Act 2012
• NHS Codes of Confidentiality, Information Security and Records Management
• Information: To Share or Not to Share Review
Every member of staff who works for an NHS organisation has a legal obligation to keep information about you confidential.
We also make sure that data processors that support us are legally and contractually bound to operate and prove security arrangements are in place where data that could or does identify a person are processed.
We will only ever use or pass on information about you if others involved in your care have a genuine need for it. We will not disclose your information to any third party without your permission unless there are exceptional circumstances (i.e. life or death situations), where the law requires information to be passed on and / or in accordance with the new information sharing principle following Dame Fiona Caldicott’s information sharing review (Information to share or not to share) where “The duty to share information can be as important as the duty to protect patient confidentiality.” This means that health and social care professionals should have the confidence to share information in the best interests of their patients within the framework set out by the Caldicott principles. They should be supported by the policies of their employers, regulators and professional bodies.
We only email you or call you, regarding matters of medical care, such as appointment reminders and (if appropriate) test results. Unless you have separately given us your explicit consent, we will not email you for non-medical matters (such as surgery newsletters and other information).
How we use information about you
NHS health care records may be electronic, on paper or a mixture of both, and we use a combination of working practices and technology to ensure that your information is kept confidential and secure. Confidential patient data will be shared within the healthcare team at the practice, including nursing staff, admin staff, secretaries and receptionists, and with other healthcare professionals to whom a patient is referred. Those individuals have a professional and contractual duty of confidentiality.
- Details about you, such as your name, address, carers, legal representatives and emergency contact details
• Any contact the surgery has had with you, such as appointments, clinic visits, emergency appointments, etc.
• Notes and reports about your health
• Details about your treatment and care
• Results of investigations such as laboratory tests, x-rays, etc.
• Relevant information from other health professionals, relatives or those who care for you
To ensure you receive the best possible care, your records are used to facilitate the care you receive. Information held about you may be used to help protect the health of the public and to help us manage the NHS. Information may be used within the GP practice for clinical audit to monitor the quality of the service provided.
Referrals for specific health care purposes
We sometimes provide your information to other organisations for them to provide you with medical services. We will always inform you of such a referral and you always have the right not to be referred in this way. These include:
- Referrals for home oxygen services
- Referrals for Diabetes dietary advice (“DESMOND”)
- Referrals for Diabetes Eye Screening
Who are our partner organisations?
We may also have to share your information, subject to strict agreements on how it will be used, with the following organisations;
- NHS Trusts / Foundation Trusts
• GP’s
• NHS Commissioning Support Units
• Independent Contractors such as dentists, opticians, pharmacists
• Private Sector Providers
• Voluntary Sector Providers
• Ambulance Trusts
• Clinical Commissioning Groups
• Social Care Services
• Health and Social Care Information Centre (HSCIC)
• Local Authorities
• Education Services
• Fire and Rescue Services
• Police & Judicial Services
• Other ‘data processors’ which you will be informed of
You will be informed who your data will be shared with and in some cases asked for explicit consent for this happen when this is required.
We may also use external companies to process personal information, such as for archiving purposes. These companies are bound by contractual agreements to ensure information is kept confidential and secure.
Risk Stratification
Risk stratification data tools are increasingly being used in the NHS to help determine a person’s risk of suffering a particular condition, preventing an unplanned or (re)admission and identifying a need for preventive intervention. Information about you is collected from a number of sources including NHS Trusts and from this GP Practice. A risk score is then arrived at through an analysis of your de-identified information using software and is only provided back to your GP as data controller in an identifiable form. Risk stratification enables your GP to focus on preventing ill health and not just the treatment of sickness. If necessary your GP may be able to offer you additional services.
Please note that you have the right to opt out of your data being used in this way.
Med Management
The Practice may conduct Medicines Management Reviews of medications prescribed to its patients. This service performs a review of prescribed medications to ensure patients receive the most appropriate, up to date and cost effective treatments. This service is provided to practices within North Yorkshire through Harrogate and Rural District Clinical Commissioning Group.
Data Sharing Schemes
A number of data sharing schemes are active locally, enabling healthcare professionals outside of the surgery to view information from your GP record, with your explicit consent, should that need arise. These schemes are as follows:
- The National Summary Care Record (SCR)
- EMIS Web data streaming (A&E and GP out of hours)
- Remote Consultations (LPC Spokes)
- Ambulance service
Mandatory disclosures of information
We are sometimes legally obliged to disclose information about patients to relevant authorities. In these circumstances, the minimum identifiable information that is essential to serve that legal purpose will be disclosed.
That organisation will also have a professional and contractual duty of confidentiality. Data will be anonymised if at all possible before disclosure if this would serve the purpose for which the data is required.
Organisations that we are sometimes obliged to release information to include:
- NHS Digital (e.g. the National Diabetes Audit)
- CQC
- DVLA
- GMC
- HMRC
- NHS Counter Fraud
- Police
- The Courts
- Public Health England
- Local Authorities (Social Services)
- The Health Service Ombudsman
In the event of actual or possible legal proceedings, we may need to disclose information from an individual’s GP record to a medical defence organisation.
Permissive disclosures of information
Only with your explicit consent, The Family Practice can release information about you, from your GP record, to relevant organisations. These may include:
- Your employer
- Insurance companies
- Solicitors
- Local Authorities
- Police
Accessing your information on other databases
The Family Practice can access certain medical information about you, when relevant or necessary, that is held on other databases (i.e. under the control of another data controller). These include Royal Blackburn Hospital, Burnley General Hospital and NHS Digital’s Open Exeter database. Accessing such information would only be for your direct medical care.
Research
The Family Practice sometimes undertakes accredited research projects. Where this involves accessing identifiable patient information, we will only do so with the explicit consent of the individual and Research Ethics Committee approval.
Your right to opt-out of sharing your information
You have the right to opt-out (or object) to ways in which your information is shared, both for direct medical care purposes (such as the national NHS data sharing schemes), i.e. primary uses of your information, or for purposes other than your direct medical care – so called secondary uses.
Accessing your own medical information
You have a right under the Data Protection Act 1998 to request access to view or to obtain copies of what information the surgery holds about you and to have it amended should it be inaccurate. In order to request this, you need to do the following:
- Your request must be made in writing to the GP – for information from the hospital you should write direct to them
• There may be a charge to have a printed copy of the information held about you
• We are required to respond to you within 40 days
• You will need to give adequate information (for example full name, address, date of birth, NHS number and details of your request) so that your identity can be verified and your records located
Notification
The Data Protection Act 1998 requires organisations to register a notification with the Information Commissioner to describe the purposes for which they process personal and sensitive information.
We are registered as a data controller and our registration can be viewed online in the public register at:
https://ico.org.uk/ESDWebPages/Entry/ZA308303
Who is the Data Controller?
The Data Controller, responsible for keeping your information secure and confidential is: The Family Practice
Data Protection Officer (DPO)
The Data Protection Officer for the surgery is to be confirmed
Complaints
Should you have any concerns about how your information is managed at the GP, please contact the GP Practice Manager at the following address.
The Family Practice
Barbrara Castle Way Health Centre
Simmons Street
Blackburn
BB2 1ax
If you are still unhappy following a review by the GP practice, you can then complain to the Information Commissioners Office (ICO) via their website (www.ico.gov.uk).
For independent advice about data protection, privacy, and data sharing issues, you can contact:
The Information Commissioner
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Phone: 08456 30 60 60
Website:www.ico.gov.uk
Further Information
If you would like any further information about primary or secondary uses of your GP record, opting out, the NHS Databases, access to your medical record, confidentiality, or about any other aspect of NHS data sharing or your medical records, then please do contact the Practice Manager.