The Information we hold and where we hold it

Confidentiality is at the heart of good medical practice and is based upon mutual trust and confidence.

Patients’ health records are kept by the practice with which they are registered and the hospital or NHS trust which treats them. Each health professional is responsible for the accuracy and safekeeping of health records.

The records include general information like name, address and date of birth. They also contain details of care such as consultations, illnesses, investigations undertaken, prescriptions received and treatment carried out.

When Patients change their GP, health records are returned to the Primary Care Services England (PCSE) to be forwarded onto the new practice, and if necessary, hospital records can be passed onto the local hospital.

The law strictly controls the management of all personal information:

• Anyone who received information about you has a legal duty to keep it confidential.
• You have a right of access to your health records, with some exceptions.
• Your right of privacy allows you to keep your health records confidential between you and your health professional, with some exceptions.

The National Data Opt Out programme

Sharing your records: your personal information

Information about you is used in a number of ways by the NHS and social care services to support your personal care and to improve health and social care services for everyone.

The NHS Digital (NHSD) is the national NHS organisation with a legal responsibility to collect data as people make use of NHS and social care services. The data is used both at a local level and nationally to help with planning, managing your care, supporting research into new treatments, identifying trends and issues and so forth, and is used to try to make services better for all.

You can, however, choose not to have information about you shared or used for any purpose beyond providing your own treatment or care.

Your right to opt out

You can choose not to have anything that could identify you shared beyond your GP practice (Type 1 objection). You can also choose for the NHSD not to share information it collects from all health providers any further (previously known as Type 2 objection, now National Data Opt-out).

If you have previously told your GP practice that you don’t want the NHSD to share your personal confidential information for purposes other than your own care and treatment, your opt-out will have been implemented by the NHSD from July 31 2022. It will remain in place unless you change it.

You can find more information about how the HSCIC handles your information and choices and how it manages your opt-out on the HSCIC website www.hscic.gov.uk/yourinfo

Research

This practice is part of the local Primary Care Research West Midlands North (PCR WMN). The network is funded by the Department of Health to undertake research to improve health. We support various types of research in the practice. Research is an important part of healthcare, used to learn more about illness: how to prevent it and how to treat it.

Research involves patients taking part in interviews, postal questionnaires or being invited to take part in a clinical trial. The quality of research is carefully checked by the people who fund the research and Research Ethics Committee.

Your right to medical care will not be affected in any way if you do not wish to take part, as involvement is entirely voluntary, you may change your mind even if you have agreed to take part. We may be asked to share information we hold in medical records as part of the research. Confidentiality

You can choose whether your confidential patient information is used for research and planning. To find out more visit nhs.uk/your-nhs-data-matters.  Or read leaflet available on reception ‘Your Data Matters to the NHS’, and below:

More information can be found at: nhs.uk/your-nhs-data-matters

Sharing your records: your personal information

Information about you is used in a number of ways by the NHS and social care services to support your personal care and to improve health and social care services for everyone.

The NHS Digital (NHSD) is the national NHS organisation with a legal responsibility to collect data as people make use of NHS and social care services. The data is used both at a local level and nationally to help with planning, managing your care, supporting research into new treatments, identifying trends and issues and so forth, and is used to try to make services better for all.

You can, however, choose not to have information about you shared or used for any purpose beyond providing your own treatment or care.

Your right to opt out

You can choose not to have anything that could identify you shared beyond your GP practice (Type 1 objection). You can also choose for the NHSD not to share information it collects from all health providers any further (previously known as Type 2 objection, now National Data Opt-out).

If you have previously told your GP practice that you don’t want the NHSD to share your personal confidential information for purposes other than your own care and treatment, your opt-out will have been implemented by the NHSD from July 31 2022. It will remain in place unless you change it.

You can find more information about how the HSCIC handles your information and choices and how it manages your opt-out on the HSCIC website www.hscic.gov.uk/yourinfo

Privacy Notice

Please access our Privacy Notice via the Main Menu.

Office of the Information Commissioner

Find out about your data protection and information rights including how to make a SAR, how to make an FOI request, domestic CCTV and data protection, protecting yourself against nuisance marketing and more.

https://ico.org.uk/for-the-public/

Our Practice adheres to the ‘Statutory Code of Practice for ‘services, public functions and associations’ under the EQA.

https://www.equalityhumanrights.com/sites/default/files/servicescode_0.pdf

Find out about your data protection and information rights including how to make a SAR, how to make an FOI request, domestic CCTV and data protection, protecting yourself against nuisance marketing and more.

https://ico.org.uk/for-the-public/

WHAT IS A PRIVACY NOTICE AND WHY DOES IT APPLY TO ME?

A Privacy Notice tells people how organisations use information that they hold about them. A new law called the UK General Data Protection Regulation 2016, also known as UKGDPR, says that we need to provide you with this Privacy Notice and let you know:

• What information we hold about you
• How we keep this especially important information safe and secure and where we keep it
• How we use your information
• Who we share your information with
• What your rights are
• When the law gives us permission to use your information

WHY DOES THE LAW GIVE YOU PERMISSION TO USE MY INFORMATION?

The law gives us permission to use your information in situations where we need it to take care of you. Because information about your health is very personal, sensitive and private to you, the law is very strict about how we use it.

So, before we can use your information in the ways we have set out in this Privacy Notice, we have to have a good reason in law, which is called a ‘lawful basis’.  Not only do we have to do that, but we also have to show that your information falls into a special group or category, because it is very sensitive. By doing this the law makes sure we only use your information to look after you and that we do not use it for any other reason.

If you would like more information about this please ask to speak to our Data Protection Officer (DPO) mentioned in this Privacy Notice who will explain this in more detail.

ABOUT US

We, at the [Practice Name] at [address], are responsible for collecting, storing and handling your information when you registered with us as a patient. Because we do this, the law says we are Data Controllers. Sometimes we may use your information for a particular purpose and when we do so, the law says we are Data Processors.

WHAT INFORMATION DO YOU HOLD ABOUT ME?

We hold information about you such as:

• Your name
• Address
• Mobile number
• Information about your parent(s) or person with parental responsibility
• All your health records
• Appointment records
• Visits to see your GP
• Treatments you have had
• Medicines prescribed for you and any other information to help us look after you

HOW DO YOU KEEP IT SAFE?

• The law says that we must do all we can to keep your information private, safe and secure.
• We use secure computer systems and we make sure that any written information held about you is under lock and key and kept in a safe place. This includes taking great care with any passwords we use which we change on a regular basis. We also train our staff to respect your privacy and deal with your information in a manner that makes sure it is always kept and dealt with in a safe way.

WHAT DO YOU DO WITH MY INFORMATION?

• We only usually use your information to help us care for you. That means we might need to share your information with other people who are concerned and involved with looking after your health.
• We might need to share your information with the police, courts, social services, solicitors and other people who have a right to your information, but we always make sure that they have a legal right to see it (or have a copy of it) before we provide it to them.

WHO ELSE WILL SEE MY INFORMATION?

• Usually only doctors, nurses and other people who work with us are allowed to see your information.
• Sometimes though, if you need to go to the hospital or be seen by a special doctor, we will share your information with them but this only so that we can take care of you.
• Sometimes we might be asked to take part in medical research that might help you in the future. We will always ask you or your parent(s) or adult with parental responsibility if we can share your information if this happens.
• Possibly the police, social services, the courts and other organisations and people who may have a legal right to see your information.

WHAT ARE MY RIGHTS?

• If you want to see what information we hold about you then you have a right to see it and you can ask for it.
• To ask for your information you will usually need to put your request in writing and tell us what information you want us to give you.
• We usually need to answer you within one month. Your parent(s) or adult with parental responsibility can help you with is if you need help.
• Usually we will give this to you free of charge.
• If you think there are any errors in the information we hold about you then you can ask us to correct it but the law says we can’t remove any of the information we hold about you even if you ask us to. This is because we need this information to take care of you.
• You have a right to ask us not to share your information.
• If you would like to talk to us about not sharing your information, even if this means you don’t want us to share your information with your parent(s) or adult with parental responsibility, please let us know. We will be happy to help.

WHAT IF I HAVE A QUESTION?

• A member of our staff/receptionist will be happy to talk to you about any questions you may have and we will do our best to help you.
• The Surgery has a person called a Data Protection Officer (DPO) who deals with all queries about patient information. Our receptionist may put you in touch with this person who will listen to your concerns and give you the advice you need.
• Our DPO is called Paul Couldrey and he can be contacted at Couldrey@me.com.

WHAT IF I HAVE A SERIOUS COMPLAINT ABOUT HOW YOU LOOK AFTER MY INFORMATION?

• We will always do our best to look after your information and to answer your questions.
• If you are still not happy with something we have done with your information you can speak to our DPO.
• If our DPO has not been able to help you or if you prefer not to speak to our DPO then you have a right to pass your complaint to an organisation called the Information Commissioner’s Office (ICO) who will look into what has gone wrong. For more information visit ico.org.uk

UPDATES TO THIS PRIVACY NOTICE

• The law says we must keep all information we provide in this Privacy Notice up to date.
• This Privacy Notice was last updated on 18/12/2023 and will be reviewed on 18/12/2025

COVID-19 Privacy Notice

Version 6

Date: 22 August 2023

 (This Privacy Notice is to run alongside our standard Practice Privacy Notice)

As we move away from the initial response to COVID-19 the health and social care system will need to continue to take action to manage and mitigate the spread and impact of the outbreak. This includes ensuring that approved researchers can continue to securely access pseudonymised data held by GP IT systems to assist the health and care service’s response to COVID-19 by, for example:

• recognising trends in COVID-19 diseases and identifying risks it poses
• controlling and preventing the spread of COVID-19
• monitoring and managing outbreaks

The OpenSAFELY COVID-19 research service provides a secure analytics service that supports COVID-19 research, COVID-19 clinical audit, COVID-19 service evaluation and COVID-19 health surveillance purposes.

Under the COVID-19 Public Health Directions 2020 NHS England has been directed by the Secretary of State for Health and Social Care to establish and operate the OpenSAFELY service.  While each GP practice remains the data controller of its own patient data, they are required under the provisions of s259 of the Health and Social Care Act 2012 to provide access to de-identified (pseudonymised) patient data through the OpenSAFELY service.

The service enables individuals (academics, analysts and data scientists) approved by NHS England to run queries on pseudonymised GP and NHS England patient data which is held within the GP system suppliers’ data environments.  Controls are in place to ensure that individuals only have access to aggregated outputs from the service (i.e. they cannot access information that either directly or indirectly identifies individuals).

Purpose of this Notice

OpenSAFELY service is used to analyse de-identified (pseudonymised) data within the EMIS and TPP boundaries, to support COVID-19 related research.

This is a continuation of a service which is supported by the BMA which has been operating since 2020. The permanent legal basis (the COVID-19 Direction) above allows the practice to provide this data to NHSE as an ongoing service.

The OpenSAFELY service is a Trusted Research Environment (TRE) established within the secure environment of EMIS and TPP. Researchers write their analysis code away from the patient data; the code is run automatically on de-identified (pseudonymised) patient data; and only the aggregated outputs (now anonymous) are shared with researchers to be used, for example, in journal publications, reports or presentations.

These controls keep patient data secure inside EMIS and TPP and confidential from researchers. The use of TREs and the data processing principles which OpenSAFELY represents is supported by the RCGP.

To date, this service has supported a range of important COVID-19 related research, including one of the world’s first and largest studies to identify the clinical factors associated with COVID-19 related death, which informed the national COVID-19 vaccination strategy and Green Book guidance. Other studies have also informed COVID-19 related NICE guidance and decisions made by SAGE.

All NHS England approved research studies are published online, including sharing the exact analysis code each study used to analyse the patient data, by whom and when such code was run. In future, NHSE will also publish approvals on our data release register.

During the pandemic, and in the recovery phase, de-identified data has been crucial in helping to save lives. It has supported research into COVID-19 and the ways that it has affected our lives, our health, and to identify effective medicines and treatments.

Research has helped to identify new treatments for COVID-19 and to understand how we can keep our communities safe. Data has helped us to prioritise the right care to the most vulnerable in our society and to develop vaccines to protect against COVID-19.

If you have any questions, please contact us at gpdata@nhs.net

Recording of processing

A record will be kept by Sandy Lane Surgery of all data processed under this Notice.

Sending Public Health Messages

Data protection and electronic communication laws will not stop Sandy Lane Surgery from sending public health messages to you, either by phone, text or email as these messages are not direct marketing.

Digital Consultations

It may also be necessary, where the latest technology allows Sandy Lane Surgery to do so, to use your information and health data to facilitate digital consultations and diagnoses and we will always do this with your security in mind.

Creating a new NHS England: NHS England and NHS Digital merged on 1 February 2023. All references to NHS Digital now, or in the future, relate to NHS England.

Sandy Lane Surgery

Data Protection Privacy Notice for Patients (04/12/2023 – Version 3.2)

Introduction:

This privacy notice lets you know what happens to any personal data that you give to us, or any information that we may collect from you or about you from other organisations.

This privacy notice applies to personal information processed by or on behalf of the practice.

This Notice explains

• Who we are and how we use your information
• Information about our Data Protection Officer
• What kinds of personal information about you we hold and use (process)
• The legal grounds for our processing of your personal information (including when we share it with others)
• What should you do if your personal information changes?
• For how long your personal information is retained / stored by us?
• What are your rights under Data Protection laws

The UK General Data Protection Regulation (UKGDPR) and the Data Protection Act 2018 (DPA 2018) became law on 25th May 2018, and 1^st January 2021 when the UK exited the EU.

For the purpose of applicable data protection legislation (including but not limited to the General Data Protection Regulation (Regulation (UK) 2016/679) (the “UKGDPR”), and the Data Protection Act 2018 the practice responsible for your personal data is Sandy Lane Surgery.

This Notice describes how we collect, use and process your personal data, and how in doing so, we comply with our legal obligations to you. Your privacy is important to us, and we are committed to protecting and safeguarding your data privacy rights.

How we use your information and the law.

Sandy Lane Surgery will be what’s known as the ‘Controller’ of your personal data.

We collect basic personal data about you and location-based information.  This does include name, address and contact details such as email and mobile number etc.

We will also collect sensitive confidential data known as “special category personal data”, in the form of health information, religious belief (if required in a healthcare setting) ethnicity and sex life information that are linked to your healthcare, we may also receive this information about you from other health providers or third parties.

Why do we need your information?

The health care professionals who provide you with care maintain records about your health and any treatment or care you have received previously.  These records help to provide you with the best possible healthcare and treatment.

NHS health records may be electronic, paper-based or a mixture of both.  We use a combination of working practices and technology to ensure that your information is kept confidential and secure.

Records about you may include the following information;

• Details about you, such as your address, your carer or legal representative and emergency contact details.
• Any contact the surgery has had with you, such as appointments, clinic visits, emergency appointments.
• Notes and reports about your health.
• Details about your treatment and care.
• Results of investigations such as laboratory tests, x-rays etc.
• Relevant information from other health professionals, relatives or those who care for you.
• Contact details (including email address, mobile telephone number and home telephone number)

To ensure you receive the best possible care, your records are used to facilitate the care you receive, including contacting you. Information held about you may be used to help protect the health of the public and to help us manage the NHS and the services we provide. Limited information may be used within the GP practice for clinical audit to monitor the quality of the service we provided.

How do we lawfully use your data?

We need your personal, sensitive and confidential data in order to provide you with healthcare services as a General Practice, under the General Data Protection Regulation we will be lawfully using your information in accordance with: –

Article 6, e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;”

Article 9, (h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems

This Privacy Notice applies to the personal data of our patients and the data you have given us about your carers/family members.

We use your personal and healthcare information in the following ways:

• when we need to speak to or contact other doctors, consultants, nurses or any other medical/healthcare professional or organisation during your diagnosis or treatment or ongoing healthcare; this includes the use of telephone or video consultation.

• when we are required by law to hand over your information to any other organisation, such as the police, by court order, solicitors, or immigration enforcement.

• In a de-identified form to support planning of health services and to improve health outcomes for our population

We will never pass on your personal information to anyone else who does not need it, or has no right to it, unless you give us consent to do so.

Legal justification for collecting and using your information

The law says we need a legal basis to handle your personal and healthcare information.

Contract: We have a contract with NHS England to deliver healthcare services to you. This contract provides that we are under a legal obligation to ensure that we deliver medical and healthcare services to the public.

Consent: Sometimes we also rely on the fact that you give us consent to use your personal and healthcare information so that we can take care of your healthcare needs.

Please note that you have the right to withdraw consent at any time if you no longer wish to receive services from us.

Necessary care: Providing you with the appropriate healthcare, where necessary. The Law refers to this as ‘protecting your vital interests’ where you may be in a position not to be able to consent.

Law: Sometimes the law obliges us to provide your information to an organisation (see above).

Special categories

The law states that personal information about your health falls into a special category of information because it is very sensitive. Reasons that may entitle us to use and process your information may be as follows:

Public Interest: Where we may need to handle your personal information when it is considered to be in the public interest. For example, when there is an outbreak of a specific disease and we need to contact you for treatment, or we need to pass your information to relevant organisations to ensure you receive advice and/or treatment

Consent: When you have given us consent

Vital Interest: If you are incapable of giving consent, and we have to use your information to protect your vital interests (eg if you have had an accident and you need emergency treatment)

Defending a claim: If we need your information to defend a legal claim against us by you, or by another party

Providing you with medical care: Where we need your information to provide you with medical and healthcare services

GP Connect System and Data Sharing

Sandy Lane Surgery has reviewed the National Data Sharing Arrangement (NDSA) for GP connect. GP Connect helps clinicians gain access to GP patient records during interactions away from a patient’s registered practice and makes their medical information available to appropriate health and social care professionals when and where they need it, to support the patient’s direct care.

From a privacy, confidentiality and data protection perspective, GP Connect provides a method of secure information transfer and reduces the need to use less secure or less efficient methods of transferring information, such as email or telephone.

GP Connect – key points.

• GP Connect can only be used for direct care purposes.
• Individuals can opt out of their GP patient record being shared via GP Connect by contacting their GP practice.
• Access to GP Connect is governed by role-based access control (RBAC) and organisational controls; only people who need to see the GP patient record for a patient’s direct care should be able to see it
• All systems that allow the use of GP Connect must undergo a robust compliance process and the organisations involved must sign a connection agreement holding them to high standards of information security.

GP Connect products can help health and social care professionals share, view or act on information that could be required for a patient’s direct care, but they would otherwise have difficulty accessing easily (for example if they are using different IT systems).

Organisations can have access to relevant information in GP patient records to provide direct care to patients only.

Type of organisations that use GP Connect

Examples of organisations that may wish to use GP connect to view GP patient records include:

• GP surgeries that patients are not registered at – for example, if they need to see a doctor when they are away from home
• secondary care (hospitals) if they need to attend A&E or are having an operation
• GP hubs/primary care networks (PCNs)/integrated care systems (ICSs), partnerships between healthcare providers and local authorities
• local ‘shared care‘ record systems
• ambulance trusts, so paramedics can view GP patient records in an emergency
• healthcare professionals such as community services
• acute and emergency care service providers
• NHS 111
• pharmacies
• optometrists
• dentistry
• mental health trusts
• hospices
• adult and children’s social care
• care and nursing homes

All access to your GP patient record is stored within an audit trail at your GP practice and within the organisation that information has been shared with.

Confidentiality

Confidentiality and trust are essential to the relationship between GPs and their patients.

The information a patient provides to their GP is confidential, and they can expect that any information that is shared for their direct care will remain confidential.

GP Connect relies on ‘implied consent’.

Explicit consent is not required when information is shared for a direct care purpose. If a patient does not want their information to be shared using GP Connect, they can opt out.

The NDSA and its terms and conditions stipulate that any information received or accessed about a patient for direct care purposes must remain confidential.

In addition to the NDSA, health and social care professionals are also subject to their own professional codes of confidentiality and are aware that any information received via GP Connect is provided in confidence, which must be respected.

Organisations using GP Connect are notified of their duty as ‘controllers’ to be fair and transparent about their processing of their patients’ information and to ensure that their transparency notices are fully updated with how they may be using GP Connect functionality.

NHS England helps support the mitigation of information sharing risks by ensuring that:

• NHS England audit data access is subject to two-factor authentication and role-based access controls – only certain assured users can have access to the full audit logs
• a completed Supplier Conformance Assessment List (SCAL) which covers service and capability specific compliance requirements and controls of the consumer system is in place

It is the responsibility of organisations using GP Connect to ensure that they comply with the NDSA, and their statutory and legal obligations regarding data protection and confidentiality.

Opting out of GP Connect

If patients do not wish their information to be shared using GP Connect, they can opt out by contacting their GP practice.

National Data Opt-Out

The National Data Opt-out is a service that allows patients to opt out of their confidential patient information being used for research and planning.

The National Data Opt-out only applies to any disclosure of data for purposes beyond direct care, so having National Data Opt-out will not prevent your GP patient record being shared via GP Connect.

Risk Stratification 

Risk stratification data tools are increasingly being used in the NHS to help determine a person’s risk of suffering a condition, preventing an unplanned or (re)admission and identifying a need for preventive intervention. Information about you is collected from several sources including NHS Trusts and from this GP Practice. The identifying parts of your data are removed, analysis of your data is undertaken, and a risk score is then determined. This is then provided back to your GP as data controller in an identifiable form. Risk stratification enables your GP to focus on preventing ill health and not just the treatment of sickness. If necessary, your GP may be able to offer you additional services. Please note that you have the right to opt out of your data being used in this way in most circumstances, please contact the practice for further information about opt out.

Individual Risk Management at a GP practice level however is deemed to be part of your individual healthcare and is covered by our legal powers above.

Medicines Management

The Practice may conduct Medicines Management Reviews of medications prescribed to its patients. This service performs a review of prescribed medications to ensure patients receive the most appropriate, up to date and cost-effective treatments. The reviews are carried out by the ICBs Medicines Management Team under a Data Processing contract with the Practice.

Transferring the current paper medical records into patients’ electronic medical records.

The following provisions of the General Data Protection Regulation permit us to digitise existing paper medical records:

Article 6(1)(e) – ‘processing is necessary…in the exercise of official authority vested in the controller…’’

Article 9(2)(h) – ‘processing is necessary for the purpose of preventative…medicine…the provision of health or social care or treatment or the management of health or social care systems and services…’

The paper patient records will be shared with [Scanning provider], who will scan and digitise the current paper medical records before destroying them.  The paper patient records will be shared with the scanning provider above, who will scan and digitise the current paper medical records before destroying them.

Anonymised information

Sometimes we may provide information about you in an anonymised form. Such information is used analyse population- level heath issues and helps the NHS to plan better services. If we share information for these purposes, then none of the information will identify you as an individual and cannot be traced back to you.

Research – National Institute for Health & Social Care Research (NIHR) – Clinical Research Network 
Clinical Research Network West Midlands (CRN WM) provides a research delivery service to GP practices across the West Midlands. All CRN WM Delivery Support staff are employed by The Royal Wolverhampton NHS Trust. All NHS Staff members who have been allocated to work within the Practice will be issued with a Letter of access or assurance to confirm individual study placements and pre-employment checks.

The legal bases for processing this information
CRN WM processes data under the instruction of the individual research protocol, as delegated by the practice (data controller). You can opt out of being invited to participate in research at any time, please inform a member of the practice team and we will add the appropriate opt out code to your record.

Prior to informed consent:
The legal basis which allows us to process your personal data for research is GDPR article 6 (1)(f) …legitimate interests…except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject…’

Once informed consent has been given:
The legal basis which allows us to process your personal data is informed consent – Article 6 1(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; and Article 9 (2) (a) the data subject has given explicit consent to the processing those personal data for one or more specified purposes.

Individual study consent forms will detail how to withdraw consent and who to contact, this will usually be via the study sponsor.

Categories of personal data
The data processed by CRN WM delivery staff, in addition to demographic and contact details, is likely to be special category information (such as health information) to determine eligibility for individual research studies.

Recipients of data
The data processed by CRN WM delivery staff will be used to invite potentially eligible patients into research studies. Once patients have consented to participate, data processed by the CRN WM delivery staff will be used to answer the research questions as outlined in individual research protocols.

For further information, please refer to the Clinical Research Network West Midlands Privacy Notice: https://local.nihr.ac.uk/documents/crn-wm-privacy-notice-march-2021/27187

Summary Care Records

All patients registered with a GP have a Summary Care Record, unless they have chosen not to have one. The information held in your Summary Care Record gives registered and regulated healthcare professionals, away from your usual GP practice, access to information to provide you with safer care, reduce the risk of prescribing errors and improve your patient experience.

Your Summary Care Record contains basic (Core) information about allergies and medications and any reactions that you have had to medication in the past.

Some patients, including many with long term health conditions, previously have agreed to have Additional Information shared as part of their Summary Care Record. This Additional Information includes information about significant medical history (past and present), reasons for medications, care plan information and immunisations.

Change to information held in your Summary Care Record

In light of the current emergency, the Department of Health and Social Care has removed the requirement for a patient’s prior explicit consent to share Additional Information as part of the Summary Care Record.

This is because the Secretary of State for Health and Social Care has issued a legal notice to healthcare bodies requiring them to share confidential patient information with other healthcare bodies where this is required to diagnose, control and prevent the spread of the virus and manage the pandemic. This includes sharing Additional Information through Summary Care Records, unless a patient objects to this.

If you have already expressed a preference to only have Core information shared in your Summary Care Record, or to opt-out completely of having a Summary Care Record, these preferences will continue to be respected and this change will not apply to you. For everyone else, the Summary Care Record will be updated to include the Additional Information. This change of requirement will be reviewed after the current coronavirus (COVID-19) pandemic.

Why we have made this change

In order to look after your health and care needs, health and social care bodies may share your confidential patient information contained in your Summary Care Record with clinical and non-clinical staff in other health and care organisations, for example hospitals, NHS 111 and out of hours organisations. These changes will improve the healthcare that you receive away from your usual GP practice.

Your rights in relation to your Summary Care Record

Regardless of your past decisions about your Summary Care Record preferences, you will still have the same options that you currently have in place to opt out of having a Summary Care Record, including the opportunity to opt-back in to having a Summary Care Record or opt back in to allow sharing of Additional Information.

You can exercise these rights by doing the following:

1. Choose to have a Summary Care Record with all information shared. This means that any authorised, registered and regulated health and care professionals will be able to see a detailed Summary Care Record, including Core and Additional Information, if they need to provide you with direct care.
2. Choose to have a Summary Care Record with Core information only. This means that any authorised, registered and regulated health and care professionals will be able to see limited information about allergies and medications in your Summary Care Record if they need to provide you with direct care.
3. Choose to opt-out of having a Summary Care Record altogether. This means that you do not want any information shared with other authorised, registered and regulated health and care professionals involved in your direct care. You will not be able to change this preference at the time if you require direct care away from your GP practice. This means that no authorised, registered and regulated health and care professionals will be able to see information held in your GP records if they need to provide you with direct care, including in an emergency.

To make these changes, you should inform your GP practice or complete this form and return it to your GP practice.

Patient Communication

Because we are obliged to protect any confidential information, we hold about you and we take this very seriously, it is imperative that you let us know immediately if you change any of your contact details.

We may contact you using SMS texting to your mobile phone if we need to notify you about appointments and other services that we provide to you involving your direct care, therefore you must ensure that we have your up-to-date details. This is to ensure we are sure we are contacting you and not another person. As this is operated on an ‘opt out’ basis we will assume that you give us permission to contact you via SMS if you have provided us with your mobile telephone number. Please let us know if you wish to opt out of this SMS service. We may also contact you using the email address you have provided to us. Please ensure that we have your up-to-date details.

There may be occasions where authorised research facilities would like you to take part in research. Your contact details may be used to invite you to receive further information about such research opportunities.

The NHS App

We use the NHS Account Messaging Service provided by NHS England to send you messages relating to your health and care. You need to be an NHS App user to receive these messages. Further information about the service can be found at the privacy notice for the NHS App managed by NHS England.

Safeguarding

The Practice is dedicated to ensuring that the principles and duties of safeguarding adults and children are holistically, consistently, and conscientiously applied with the wellbeing of all, at the heart of what we do.

Our legal basis for processing For the General Data Protection Regulation (GDPR) purposes is: –

Article 6(1)(e) ‘…exercise of official authority…’.

For the processing of special categories data, the basis is: –

Article 9(2)(b) – ‘processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law…’

Research

Clinical Practice Research Datalink (CPRD) collects de-identified patient data from a network of GP practices across the UK. Primary care data are linked to a range of other health related data to provide a longitudinal, representative UK population health dataset.  You can opt out of your information being used for research purposes at any time (see below), full details can be found here: –

The legal bases for processing this information

CPRD do not hold or process personal data on patients; however, NHS Digital (formally the Health and Social Care Centre) may process ‘personal data’ for us as an accredited ‘safe haven’ or ‘trusted third-party’ within the NHS when linking GP data with data from other sources. The legal bases for processing this data are:

• Medicines and medical device monitoring: Article 6(e) and Article 9(2)(i) – public interest in the area of public health
• Medical research and statistics: Article 6(e) and Article 9(2)(j) – public interest and scientific research purposes

Any data CPRD hold or pass on to bona fide researchers, except for clinical research studies, will have been anonymised in accordance with the Information Commissioner’s Office Anonymisation Code of Practice. We will hold data indefinitely for the benefit of future research, but studies will normally only hold the data we release to them for twelve months.

Categories of personal data

The data collected by Practice staff in the event of a safeguarding situation will be as much personal information as is possible that is necessary to obtain in order to handle the situation. In addition to some basic demographic and contact details, we will also process details of what the safeguarding concern is. This is likely to be special category information (such as health information).

Sources of the data

The Practice will either receive or collect information when someone contacts the organisation with safeguarding concerns, or we believe there may be safeguarding concerns and make enquiries to relevant providers.

Recipients of personal data

The information is used by the Practice when handling a safeguarding incident or concern. We may share information accordingly to ensure duty of care and investigation as required with other partners such as local authorities, the police or healthcare professionals (i.e. their GP or mental health team).

National Obesity Audit (NOA)

Background: 

More than one in four adults are currently living with obesity. We know obesity puts people at greater risk of many serious diseases and increases their chances of associated comorbidities e.g., cancers, cardiovascular disease, type 2 diabetes.

What is the National Obesity Audit? 

NHS England has established a National Obesity Audit (NOA) to bring together comparable data from the different types of weight management services across England. For the NOA to be successful, linking to primary care patient-level data is a critical part of the project to enable analysis of longitudinal weight change, to inform improvement aims.

How will the NOA benefit patients? 

By linking to GP patient-level data with weight management service data, the NOA will provide information across the weight management pathway to support quality improvements to patient care. For example, equity of access, improving outcomes of weight management services, reducing obesity-related comorbidities, and improving population health.

What information is collected? 

The NOA data collection includes both personal data and special categories of personal data relating to patients living with overweight or obesity, including:

• Demographic information – such as NHS number, date of birth, postcode, sex and ethnicity
• Health information – such as Body Mass Index (BMI), obesity-related co-morbidities, healthcare interventions such as weight loss advice and bariatric surgery.

More information on the data used for the purposes of the NOA is available in the NOA dataset specification

How the NOA will use your data

NOA data will be used for the purposes of informing policy and guidelines for managing obesity across the NHS and local authorities.  It will also be used for benchmarking and to enable NHS providers to maximise the use of their resources and to improve patient outcomes.

NHS England will analyse the data held in the NOA to carry out data quality checks, to pseudonymise the data (de-identify) and to derive values, for example turn date of birth into age.

Data in the NOA may also be linked to other data that NHS England holds, including the Hospital Episode Statistics (HES), Cardiovascular Disease Prevention Audit (CVD Prevent) and the Community Services Data Set (CSDS).

NOA data is used to create regular statistical publications on the NHS England website including dashboards and an annual report.  All data published is anonymous and aggregate so that patients cannot be identified from the data.

The data collected for the NOA from the CVD Prevent Audit will not be used for performance management of GPs.

NOA legal basis

Data protection law requires NHS England to have a legal basis before we can use your personal data.

Our legal basis is:

Legal obligation

Article 6(1)(c) of UK GDPR.  This is because the Secretary of State for Health and Social Care has issued NHS England with a Direction to analyse this data for NOA purposes. This Direction is called the National Obesity Audit Directions 2023

We also need an additional legal basis in the UK GDPR and the Data Protection Act 2018 (DPA 2018) to use data which is extra sensitive. This is known as ‘special categories of personal data’. Our legal basis to use data relating to your health and ethnicity is:

Substantial public interest 

Article 9(2)(g) of UK GDPR, plus Schedule 1, Part 2, Paragraph 6 “statutory etc and government purposes” of DPA 2018

Health or social care

Article 9(2)(h) of UK GDPR, plus Schedule 1, Part 1, Paragraph 2 “Health or social care purposes” of DPA 2018.

The NOA and NHSE will share this data with

We treat the data we hold with great care. All data which is shared by NHS England is subject to robust rules relating to privacy, security and confidentiality and only the minimum amount of data necessary to achieve the relevant health and social care purpose will ever be shared.

Data is shared or is expected to be shared with organisations such as healthcare providers, clinicians, and commissioners of NHS services, for example:

• the organisation that provided your care: to assess the effectiveness of your care and to improve the services they offer
• The Department of Health and Social Care: to inform policy and guidelines
• organisations responsible for the commissioning of NHS services in England, such as Integrated Care Boards: to plan and improve weight management services and for benchmarking
• local authorities: to help plan and improve weight management services
• research organisations, including universities and charities: to carry out research

These organisations must apply for access to NOA data through NHS England’s Data Access Request Service.  Each application is assessed very carefully to make sure that the organisation:

• has a legal basis to access the data for that purpose
• will use the data for the benefit of health and care and for the agreed purposes only
• will handle and store the data securely

We only share data which can identify you (identifiable data) if this is absolutely necessary and the organisation who has made an application for data cannot achieve their purpose without it.  Where possible we remove information from the data which identifies you, or we replace it with a unique reference number (this is known as pseudonymisation).

Each organisation we share data with must sign a Data Sharing Framework Contract and a Data Sharing Agreement and we carry out audits to check they are using the data as agreed.

Details about the NOA data we have shared with other organisations, except for anonymous data, will be published in the NHS England Data Uses Register.

Practice Third party processors

To deliver the best possible service, the practice will share data (where required) with other NHS bodies such as other GP practices and hospitals. In addition, the practice will use carefully selected third party service providers. When we use a third-party service provider to process data on our behalf then we will always have an appropriate agreement in place to ensure that they keep the data secure, that they do not use or share information other than in accordance with our instructions and that they are operating appropriately. Examples of functions that may be carried out by third parties include:

• Companies that provide IT services & support, including our core clinical systems; systems which manage patient facing services (such as our website and service accessible through the same); data hosting service providers; systems which facilitate appointment bookings or electronic prescription services; document management services etc.
• Delivery services (for example if we were to arrange for delivery of any medicines to you).
• Payment providers (if for example you were paying for a prescription or a service such as travel vaccinations).

Further details regarding specific third-party processors can be supplied on request to the Data Protection Officer as below.

How do we maintain the confidentiality of your records? 

We are committed to protecting your privacy and will only use information collected lawfully in accordance with:

• Data Protection Act 2018
• The General Data Protection Regulations 2016
• Human Rights Act 1998
• Common Law Duty of Confidentiality
• Health and Social Care Act 2012
• NHS Codes of Confidentiality, Information Security and Records Management
• Information: To Share or Not to Share Review

Every member of staff who works for an NHS organisation has a legal obligation to keep information about you confidential.

We will only ever use or pass on information about you if others involved in your care have a genuine need for it. We will not disclose your information to any third party without your permission unless there are exceptional circumstances (i.e. life or death situations), where the law requires information to be passed on and / or in accordance with the information sharing principle following Dame Fiona Caldicott’s information sharing review (Information to share or not to share) where “The duty to share information can be as important as the duty to protect patient confidentiality.” This means that health and social care professionals should have the confidence to share information in the best interests of their patients within the framework set out by the Caldicott principles.

Our practice policy is to respect the privacy of our patients, their families and our staff and to maintain compliance with the General Data Protection Regulation (GDPR) and all UK specific Data Protection Requirements. Our policy is to ensure all personal data related to our patients will be protected.

All employees and sub-contractors engaged by our practice are asked to sign a confidentiality agreement. The practice will, if required, sign a separate confidentiality agreement if the client deems it necessary.  If a sub-contractor acts as a data processor for Sandy Lane Surgery an appropriate contract (art 24-28) will be established for the processing of your information.

In certain circumstances you may have the right to withdraw your consent to the processing of data. Please contact the Data Protection Officer in writing if you wish to withdraw your consent.  If some circumstances, we may need to store your data after your consent has been withdrawn to comply with a legislative requirement.

Some of this information will be held centrally and used for statistical purposes. Where we do this, we take strict measures to ensure that individual patients cannot be identified. Sometimes your information may be requested to be used for research purposes – the surgery will always gain your consent before releasing the information for this purpose in an identifiable format.   In some circumstances you can Opt-out of the surgery sharing any of your information for research purposes.

With your consent we would also like to use your information

There are times that we may want to use your information to contact you or offer you services, not directly about your healthcare, in these instances we will always gain your consent to contact you.  We would however like to use your name, contact details, and email address to inform you of other services that may benefit you.  We will only do this with your consent.  There may be occasions where authorised research facilities would like you to take part on innovations, research, improving services or identifying trends, you will be asked to opt into such programmes if you are happy to do so.

At any stage where we would like to use your data for anything other than the specified purposes and where there is no lawful requirement for us to share or process your data, we will ensure that you have the ability to consent and opt out prior to any data processing taking place.
This information is not shared with third parties or used for any marketing and you can unsubscribe at any time via phone, email or by informing the practice DPO as below.

How to get the most from your GP

1. It is important to register with a GP, rather than wait until you need treatment. Visit the NHS website at www.nhs.uk to find details of GP practices in your local area.
2. If you’ve recently left the forces, it is important to give your GP the paperwork that your military medical centre gave you, including any medical records. This will help to make sure your military health record transfers to your NHS health record. This will also give your GP information on your health and ensure that any ongoing care and treatment is continued.
3. With your agreement, it can sometimes be helpful for your doctor to refer you to Armed Forces charities, such as SSAFA, the Royal British Legion, Combat Stress or Help for Heroes. They can often offer significant help and support, even if they do not all deliver healthcare.
4. You may be worried about sharing information about your time in the Armed Forces. Please note that the NHS is bound by a confidentiality code of practice to ensure GPs, nurses and other people working within the NHS deliver a
   confidential service bound by law
5. Regardless of when you left the military, tell your GP that you’ve served in the UK Armed Forces. This will help your GP to better understand any military related health conditions that you may have and ensure that you are referred, where appropriate, to dedicated services for veterans. This includes the specialist mental and physical health services, Op COURAGE: The Veterans Mental Health and Wellbeing Service and the Veterans Trauma Network. When using these services, you will be able to speak to people who:

• understand the Armed Forces and military life
• are either from the Armed Forces community or highly experienced in working with serving personnel, reservists, veterans and their families
• will work with you to make sure you get the right type of specialist care, support, and treatment
• work closely with a range of organisations and charities, including military charities, to support your wider health and wellbeing needs

Non-urgent advice:To Find out more…

To find out more, please speak to our practice manager or one of our GPs or nurses.

If you would like to provide feedback on how we are performing as a veteran friendly GP practice, please let a member of our staff know or you can send your comments to the Royal College of General Practitioners at Veterans@rcgp.org.uk

For information on health services for the Armed Forces community, please visit the NHS website at www.nhs.uk/armedforceshealth Twitter @NHSArmedForce

Patient charter: our commitment to you as a veteran of the UK Armed Forces

The NHS is here to help improve your health and wellbeing and keep you mentally and physically well. It is also here to help you get better when you are ill and, when you cannot fully recover, to stay as well as you can until the end of your life.

This means that you can expect the following from our practice:

We will ask all patients if they have served in the UK Armed Forces (as a regular or reservist). If you have, we will note this in your medical record, with your permission.

• We will ask you to share details of your time in service to help us to assess the best support and treatment for you.
• The information you share will be kept confidential and we will always speak to you before sharing this with other services you may be referred to.
• You can make an appointment to see our clinical lead for veteran’s health. This person has a comprehensive understanding of the Armed Forces, health conditions linked to service, and the dedicated support you can access.
• The NHS has a duty to support the health commitments of the Armed Forces Covenant. This means that you will get priority treatment for any medical condition which has been caused by your service, subject to the clinical needs of other patients.
• We will let you know what choices are available for your care and treatment and help you to make informed decisions on what to do.
• Where appropriate and with your consent, we can refer you to dedicated veterans health services.
• If you need to be seen by another service, we will let them know you’re a veteran and make sure they have an understanding of your health and wellbeing needs, so you don’t have to keep repeating your ‘personal story’.
• We can give advice and support to your loved ones who may be affected by your health conditions.
• We will investigate any issues and complaints that you may have about your care. If you have any concerns about the services we offer, please speak to one of the practice team.

TOP TIPS FOR VETERANS

https://assets.practice365.co.uk/wp-content/uploads/sites/1410/2023/10/5-Top-Tips-for-Veterans.pdf

PATIENT CHARTER

https://assets.practice365.co.uk/wp-content/uploads/sites/1410/2023/10/6-Patient-Charter.pdf