Andaman Surgery, Lowestoft
Primary Care Fair Processing Notice
Your Information, Your Rights
Being transparent and providing accessible information to patients about how we will use your personal information is a key element of the Data Protection Act 1998 and the EU General Data Protection Regulations (GDPR). The following notice reminds you of your rights in respect of the above legislation and how your GP Practice will use your information for lawful purposes in order to deliver your care and the effective management of the local NHS system.
This notice reflects how we use information for:
- The management of patient records;
- Communication concerning your clinical, social and supported care;
- Ensuring the quality of your care and the best clinical outcomes are achieved through clinical audit and retrospective review;
- Participation in health and social care research; and
- The management and clinical planning of services to ensure that appropriate care is in place for the people of Great Yarmouth and Waveney today and in the future.
As your registered GP practice, we are the data controller for any personal data that we hold about you. (Information Commissioner’s Office registration reference Z4717117)
Consent and other lawful bases for processing
We will seek explicit consent from you for procedures such as minor surgery when we ask you to fill in and sign a consent form, or when giving you a vaccination or immunisation when we will ask for your verbal consent (or verbal parental/guardian consent in the case of child patients). For explicit consent to be valid that consent must be:
- Freely given
- < >< >An unambiguous indication of the data subject’s agreement
However other processing of information will be done by implied consent such as when you agree to a referral from a doctor to another healthcare professional e.g. a hospital consultant. The lawful basis for processing what is called “special category” (sensitive data) healthcare data for direct care is that processing is “necessary . . . in the exercise of official authority vested in the controller” Article 6(10) (e) of the NHS Act 2006 and “processing is necessary for compliance with a legal obligation to which the controller is subject” Article 6(1)(c) of the NHS Act 2006. The “special category condition” for processing direct care is that processing is “necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services …” Article 9(2)(h) of the NHS Act 2006.
What information do we collect and use?
All personal data must be processed fairly and lawfully, whether is it received directly from you or from a third party in relation to your care.
We will collect the following types of information from you or about you from a third party (provider organisation) engaged in the delivery of your care:
- ‘Personal data’ meaning any information relating to an identifiable person who can be directly or indirectly identified from the data. This includes, but is not limited to name, date of birth, full postcode, address, next of kin and NHS Number; and
- ‘Special category / sensitive data’ such as medical history including details of appointments and contact with you, medication, emergency appointments and admissions, clinical notes, treatments, results of investigations, supportive care arrangements, social care status, race, ethnic origin, genetics and sexual orientation.
Your healthcare records contain information about your health and any treatment or care you have received previously (e.g. from an acute hospital, GP surgery, community care provider, mental health care provider, walk-in centre, social services). These records may be electronic, a paper record or a mixture of both. We use a combination of technologies and working practices to ensure that we keep your information secure and confidential.
Why do we collect this information?
The NHS Act 2006 and the Health and Social Care Act 2012 invests statutory functions on GP Practices to promote and provide the health service in England, improve quality of services, reduce inequalities, conduct research, review performance of services and deliver education and training. To do this we will need to process your information in accordance with current data protection legislation to:
- Protect your vital interests;
- Pursue our legitimate interests as a provider of medical care, particularly where the individual is a child or a vulnerable adult;
- Perform tasks in the public’s interest;
- Deliver preventative medicine, medical diagnosis, medical research; and
- Manage the health and social care system and services.
How do we use this information?
To ensure that you receive the best possible care, your records will be used to facilitate the care you receive. Information held about you may be used to protect the health of the public and to help us manage the NHS. Information may also be used for clinical audit to monitor the quality of the service provided. In addition, your information will be used to identify whether you are at risk of a future unplanned hospital admission and/or require support to effectively manage a long term condition.
How is the information collected?
Your information will be collected either electronically using secure NHS Mail or a secure electronic transferred over an NHS encrypted network connection. In addition physical information will be sent to your practice by specialist courier organised by NHS England. This information will be retained within your GP’s electronic patient record or within your physical medical records.
Who will we share your information with?
In order to deliver and coordinate your health and social care, we may share information with the following organisations:
- GP Practices in Lowestoft in order to delivery extended primary care services
- East Coast Community Healthcare CIC (ECCH) who provide various community services including district nursing
- James Paget University Hospital (JPUH)
- Norfolk and Norwich University NHS Foundation Trust (NNUH)
- Queen Elizabeth Hospital Kings Lynn (QEH KL)
- Norfolk and Suffolk Foundation Trust (NSFT)
- IC24 – 111 and Out of Hours Service
- East of England Ambulance Trust (EEAST)
- Suffolk County Council (Adult Social Services and Community Care)
- Voluntary Support Organisations commissioned to provide services by NHS Great Yarmouth & Waveney CCG (Clinical Commissioning Group)
Disclosures which are required by law or clinical audit requirements
In order to comply with its legal obligations this practice may send data to NHS Digital when directed by the Secretary of State for Health under the Health and Social Care Act 2012. This practice contributes to national clinical audits and will send the data which are required by NHS Digital when the law allows. This may include demographic data, such as date of birth, and information about your health which is recorded in coded form, for example, the clinical code for diabetes or high blood pressure. If you do not wish your data to be sent to NHS Digital and/or from NHS Digital to other parties please ask Reception for an NHS Digital Opt Out form as we can code your electronic medical records accordingly.
Disclosures for medical research or health management purposes
This practice contributes to medical research and may send relevant information to medical research databases such as the Clinical Research Databank and QResearch or others- when the law allows.
All NHS organisations are expected to participate and support health and care research. Conducting high-quality clinical research helps us to keep improving NHS care by finding out which treatments work best. If you are asked about taking part in research, usually someone in the care team looking after you will contact you. People in your care team may look at your health records to check whether you are suitable to take part in a research study, before asking you whether you are interested or sending you a letter on behalf of the researcher. For more information about how your information may be used in research and your rights please visit:
Who do we receive information from?
Whilst we might share your information with the above organisations, we may also receive information from them to ensure that your medical records are kept up to date and so that your GP can provide the appropriate care.
In addition we receive data from NHS Digital (as directed by the Department of Health) such as the uptake of flu vaccinations and disease prevalence in order to assist us to improve “out of hospital care”.
How do we maintain the confidentiality of your records?
We are committed to protecting your privacy and will only use information collected lawfully in accordance with:
• Data Protection Act 1998(and the provisions of the new Data Protection Act 2018, effective from 25 May 2018)
• Human Rights Act 1998
• Common Law Duty of Confidentiality
• Health and Social Care Act 2012
• NHS Codes of Confidentiality, Information Security and Records Management
• Information: To Share or Not to Share Review
Every member of staff who works for an NHS organisation has a legal obligation to keep information about you confidential.
We will only ever use or pass on information about you if others involved in your care have a genuine need for it. We will not disclose your information to any third party without your permission unless there are exceptional circumstances (i.e. life or death situations), where the law requires information to be passed on and / or in accordance with the new information sharing principle following Dame Fiona Caldicott’s information sharing review (Information to share or not to share) where “The duty to share information can be as important as the duty to protect patient confidentiality.” This means that health and social care professionals should have the confidence to share information in the best interests of their patients within the framework set out by the Caldicott principles. They should be supported by the policies of their employers, regulators and professional bodies.
Consent and Objections
Do I need to give my consent?
The GDPR sets a high standard for consent. Consent means offering people genuine choice and control over how their data is used. When consent is used properly, it helps you build trust and enhance your reputation. However consent is only one potential lawful basis for processing information. Therefore your GP practice may not need to seek your explicit consent for every instance of processing and sharing your information, on the condition that the processing is carried out in accordance with this notice. Your GP Practice will contact you if they are required to share your information for any other purpose which is not mentioned within this notice. Your consent will be documented within your electronic patient record.
What will happen if I withhold my consent or raise an objection?
You have the right to write to withdraw your consent at any time for any particular instance of processing, provided consent is the legal basis for the processing. Please contact the surgery for further information and to raise your objection.
Medicines Management Reviews
The Practice may conduct Medicines Management Reviews of medications prescribed to its patients. This service performs a review of prescribed medications to ensure patients receive the most appropriate, up to date and cost effective treatments.
Health Risk Screening / Risk Stratification
Health Risk Screening or Risk Stratification is a process that helps your GP to determine whether you are at risk of an unplanned admission or deterioration in health. By using selected information such as age, gender, NHS number, diagnosis, existing long term condition(s), medication history, patterns of hospital attendances, admissions and periods of access to community care your GP will be able to judge if you are likely to need more support and care from time to time, or if the right services are in place to support the local population’s needs. A form of this risk screening by an NHS tool called “Eclipse” is used as a safety check looking at a patient’s conditions, current medications and test results. Eclipse draws data from the practice’s clinical database which is encrypted, analysed and an anonymised list sent back to the practice which only the practice can unencrypt to find the patients who are linked to alerts on Eclipse and then take The practice accesses the NHS Eclipse portal by password and a time lapsed code sent by NHS email to view anonymised patient alerts, the practice can tell the identity of the patients by unencrypting the patient code list sent earlier by Eclipse. Another form of risk screening is an NHS England accredited closed secure information transfer from the practice’s clinical system of Diabetic patients over the age of 12 (who do not have an opt-out current in their medical notes) to Health Intelligence Ltd who are commissioned by NHS England to deliver the Diabetic Eye Screening Programme (NHS East Anglia Diabetic Eye Screening Programme www.eadesp.co.uk
To summarise Risk Stratification is used in the NHS to:
- Help decide if a patient is at a greater risk of suffering from a particular condition;
- Prevent an emergency admission to hospital;
- Identify if a patient needs medical help to prevent a health condition from getting worse; and/or
- Review and amend provision of current health and social care services.
Your GP will use computer based algorithms or calculations to identify their registered patients who are at most risk, with support from the local Commissioning Support Unit (CSU) and/or a third party accredited Risk Stratification provider. The risk stratification contracts are arranged by NHS Great Yarmouth & Waveney Clinical Commissioning Group (the CCG) in accordance with the current section 251 of the National Health Service Act 2006. Neither the CSU nor the CCG will at any time have access to your personal or confidential data. They will only act on behalf of your GP to organise the risk stratification service with appropriate contractual technical and security measures in place.
Your GP will routinely conduct the risk stratification process outside of your GP appointment. This process is conducted electronically and without human intervention. The resulting report is then reviewed by a multidisciplinary team of staff within the Practice. This may result in contact being made with you if alterations to the provision of your care are identified.
A Section 251 Agreement is where the Secretary of State for Health and Social Care has granted permission for personal data to be used for the purposes of risk stratification, in acknowledgement that it would overburden the NHS to conduct manual reviews of all patient registers held by individual providers.
As mentioned above, you have the right to object to your information being used in this way. However you should be aware that your objection may have a negative impact on the timely and proactive provision of your direct care. Please contact the Practice Manager to discuss how disclosure of your personal data can be limited.
Sharing of Electronic Patient Records within the NHS
Electronic patient records are kept in most places where you receive healthcare. Our local electronic system (SystmOne from TPP) enables your record to be shared with organisations involved in your direct care, such as:
- GP practices
- Community services such as district nurses, rehabilitation services and out of hospital services.
- Child health services that undertake routine treatment or health screening
- Urgent care organisations, minor injury units or out of hours services
- Community hospitals
- Palliative care hospitals
- Care Homes
- Mental Health Trusts
- Social Care organisations
Your information will only be shared if it is appropriate for the provision of your care or required to satisfy our statutory function and legal obligations. Your information will not be transferred outside of the European Union.
In addition, NHS England have implemented the Summary Care Record which contains information about medication you are taking, allergies you suffer from and any bad reactions to medication that you have had in the past. You may consent to have an Enhanced Summary Care Record which contains more details about your health record such as any current medical problems. Your electronic health record contains lots of information about you. In most cases, particularly for patients with complex conditions and care arrangements, the shared record plays a vital role in delivering the best care and a coordinated response, taking into account all aspects of a person’s physical and mental health. Many patients are understandably not able to provide a full account of their care, or may not be in a position to do so. The shared record means patients do not have to repeat their medical history at every care setting.
Your record will be automatically setup to be shared with the organisations listed above, however you have the right to ask your GP to disable this function or restrict access to specific elements of your record. This will mean that the information recorded by your GP will not be visible at any other care setting.
You can also reinstate your consent at any time by giving your permission to override your previous dissent. If you would like to check or change your Summary Care Record status, please write to the Practice Manager at: Andaman Surgery, 303 Long Road, Lowestoft, Suffolk, NR33 9DF
Child Health Immunisation History
The practice allows Apollo Medical Software Solutions Ltd* through agreement, to extract the following data from the practice clinical system for each registered patient under the age of six years of age and send this information (the data is encrypted whilst in transmission) to Provide Child Health Information Services who produce immunisation reminders for the parents/guardians of children:
NHS number, full name, date of birth, address, vaccination date, vaccination name, dose, batch number and site of vaccination; new-born infant physical examination results including examination date and outcome.
Sharing data in this way improves the quality and timeliness of data and reduces administration errors within Child Health Information Services when deciphering vaccination history returned to them in hard copy by the practice, and saves the practice time and prevents errors by not having to fill out hard copy data sheets to send to Child Health. (The Apollo software solution is needed because the practice’s clinical system and the Child Health information system do not talk to each other).
The legal basis for this data sharing is:
General Data Protection Regulation 2016 article 6 (d) processing is necessary in order to protect the vital interests of the data subject or of another natural person and Article 9 2 (i) (i) processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy.
Children’s Act 2004, Section 10 & 11 – Cooperation to improve well-being
National Health Service Act 1977, Section 22
Children’s Act 1989, part III: section 17 (1) (provision of service) and Section 27
Section 47 Children’s Act 1989
Health & Social Care Act 2012
If you have received treatment within the NHS, the local Commissioning Support Unit (CSU) may require access to your personal information to determine which Clinical Commissioning Group is responsible for payment for the treatment or procedures you have received. Information such as your name, address, date of treatment and associated treatment code may be passed onto the CSU to enable them to process the bill. These details are held in a secure environment and kept confidential. This information is only used to validate invoices in accordance with the current Section 251 Agreement, and will not be shared for any further commissioning purposes.
Andaman Surgery website is supported by “cookies” which are intended to improve the user experience of visiting and re-visiting the site. The surgery website is produced and hosted by Wiggly-Amps who provide a comprehensive summary of the cookies utilised at this location: http://www.andamansurgery.nhs.uk/index.php?disclaimer=1
Your Right of Access to Your Records
The Data Protection Act 1998 and General Data Protection Regulations allows you to find out what information is held about you including information held within your medical records, either in electronic or physical format. This is known as the “right of subject access”. If you would like to have access to all or part of your records, you can make a request in writing to the organisation that you believe holds your information. This can be your GP, or a provider that is or has delivered your treatment and care. You should however be aware that some details within your health records may be exempt from disclosure, however this will in the interests of your wellbeing or to protect the identity of a third party.
If you would like access to your GP record electronically (some parts of your medical record is available for on line viewing) please ask Reception for the relevant form, you will also be asked to show Reception a form of photographic ID before your request may be considered. If you would like to come into the practice to view your medical record (paper notes, electronic or both) or have a printed copy of your medical record, please submit your request in writing to: The Medical Secretary, Andaman Surgery, 303 Long Road, Lowestoft, Suffolk, NR33 9DF.
Change of Details
It is important that you tell the practice if any of your details such a s your name or address have changed or if any of your details such as date of birth is incorrect in order for this to be amended. You have a responsibility to inform us of any changes so our records are accurate and up to date for you.
In the event that your feel your GP Practice has not complied with the current data protection legislation, either in responding to your request or in our general processing of your personal information, you should raise your concerns in the first instance in writing to the Practice Manager at:
303 Long Road, Lowestoft, Suffolk, NR33 9DF
If you remain dissatisfied with our response you can contact the Information Commissioner’s Office at Wycliffe House, Water Lane, Wimslow, Cheshire SK9 5AF – Enquiry Line: 01625 545700 or online at www.ico.gov.uk