Practice Privacy Information

What is a privacy notice?

A privacy notice helps your doctor’s surgery tell you how it uses information it has about you, like your name, address, date of birth and all of the notes the doctor or nurse makes about you in your healthcare record.

Why do we need one?

Your doctor’s surgery needs a privacy notice to make sure it meets the legal requirements which are written in a new document called the General Data Protection Regulation (or GDPR for short)

What is the GDPR?

What a great question! The GDPR is a new document that helps your doctor’s surgery keep the information about you secure. It’s new and will be introduced on the 25th May 2018, making sure that your doctor, nurse and any other staff at the practice follow the rules and keep your information safe.

How do you know about our privacy notice?

At your surgery, we have posters in our waiting room and leaflets to give to children and adults and we also have lots of information about privacy on our website, telling you how we use the information we have about you.

What information do we collect about you?

Don’t worry; we only collect the information we need to help us keep you healthy – such as your name, address, information about your parents, guardians or carers, records of appointments, visits, telephone calls, your health record, treatment and medicines, test results, X-rays and any other information to enable us to care for you.

How do we use your information?

Another great question! Your information is taken to help us provide your care. But we might need to share this information with other medical teams, such as hospitals, if you need to been seen by a special doctor or sent for an X-ray. Your doctor’s surgery may be asked to help with exciting medical research; but don’t worry, we will always ask you, or your parents or an adult with parental responsibility, if it’s okay to share your information.

How do we keep your information private?

Well, your doctor’s surgery knows that it is very important to protect the information we have about you. We make sure we follow the rules that are written in the GDPR and other important rule books.

What if I’ve got a long-term medical problem?

If you have a long -term medical problem then we know it is important to make sure your information is shared with other healthcare workers to help them help you, making sure you get the care you need when you need it!

Don’t want to share?

All of our patients, no matter what their age, can say that they don’t want to share their information. If you’re under 16 this is something which your parents or carers will have to decide. They can get more information from a member of staff at the surgery, who can also explain what this means to you.

How do I access my records?

Remember we told you about the GDPR? Well, if you want to see what is written about you, you have a right to access the information we hold about you, but you will need to complete a Subject Access Request (SAR). Your parents or adults with parental responsibility will do this on your behalf if you’re under 16. But if you are over 12, you may be classed as being competent and you may be able to do this yourself.

What do I do if I have a question?

If you have any questions, ask a member of the surgery team or your parents or adults or carer. You can:

• Contact the practice’s data controller via email using our secure online form GP practices are data controllers for the data they hold about their patients
• Write to the data controller at Maywood Surgery
• Ask to speak to the Practice Manager

The Data Controller for Maywood Surgery is Dr Nick Sheppard.

The Data Protection Officer (DPO) for Maywood Surgery is Name: Laura Taw, telephone number: 01243 830872 or contact her via our secure online form

What to do if you’re not happy about how we manage your information

We really want to make sure you’re happy, but we understand that sometimes things can go wrong. If you or your parents or adults with parental responsibility are unhappy with any part of our data-processing methods, you can complain. For more information, visit the Information Commissioner's Office website and select ‘Raising a concern’.

We always make sure the information we give you is up to date. Any updates will be published on our website, in our newsletter and leaflets, and on our posters. This policy will be reviewed in March 2019

Your information, what you need to know

This privacy notice explains why we collect information about you, how that information will be used, how we keep it safe and confidential and what your rights are in relation to this.

Why we collect information about you

Health care professionals who provide you with care are required by law to maintain records about your health and any treatment or care you have received.  These records help to provide you with the best possible healthcare and help us to protect your safety.

We collect and hold data for the purpose of providing healthcare services to our patients and running our organisation which includes monitoring the quality of care that we provide. In carrying out this role we will collect information about you which helps us respond to your queries or secure specialist services. We will keep your information in written form and/or in digital form.

Our Commitment to Data Privacy and Confidentiality Issues

As a GP practice, all of our GPs, staff and associated practitioners are committed to protecting your privacy and will only process data in accordance with the Data Protection Legislation.  This includes the General Data Protection Regulation (EU) 2016/679  (GDPR) now known as the UK GDPR, the Data Protection Act (DPA) 2018, the Law Enforcement Directive (Directive (EU) 2016/680) (LED) and any applicable national Laws implementing them as amended from time to time.  The legislation requires us to process personal data only if there is a legitimate basis for doing so and that any processing must be fair and lawful.

In addition, consideration will also be given to all applicable Law concerning privacy, confidentiality, the processing and sharing of personal data including the Human Rights Act 1998, the Health and Social Care Act 2012 as amended by the Health and Social Care (Safety and Quality) Act 2015, the common law duty of confidentiality and the Privacy and Electronic Communications (EC Directive) Regulations.

Data we collect about you

Records which this GP Practice will hold or share about you will include the following:

• Personal Data – means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. 
• Special Categories of Personal Data – this term describes personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.  
• Confidential Patient Information – this term describes information or data relating to their health and other matters disclosed to another (e.g. patient to clinician) in circumstances where it is reasonable to expect that the information will be held in confidence.  Including both information ‘given in confidence’ and ‘that which is owed a duty of confidence’. As described in the Confidentiality: NHS code of Practice: Department of Health guidance on confidentiality 2003.
• Pseudonymised – The process of distinguishing individuals in a dataset by using a unique identifier which does not reveal their ‘real world’ identity.
• Anonymised – Data in a form that does not identify individuals and where identification through its combination with other data is not likely to take place.
• Aggregated – Statistical data about several individuals that has been combined to show general trends or values without identifying individuals within the data.

How we use your information

Improvements in information technology are also making it possible for us to share data with other healthcare organisations for the purpose of providing you, your family and your community with better care.  For example it is possible for healthcare professionals in other services to access your record with or without your permission when the practice is closed.  Where your record is accessed without your permission it is necessary for them to have a legitimate basis in law. This is explained further in the Local Information Sharing at Appendix A.

Whenever you use a health or care service, such as attending Accident & Emergency or using Community Care services, important information about you is collected in a patient record for that service.  Collecting this information helps to ensure you get the best possible care and treatment.

The information collected about you when you use these services can also be used and provided to other organisations for purposes beyond your individual care, for instance to help with:

• improving the quality and standards of care provided by the service
• research into the development of new treatments and care pathways
• preventing illness and diseases
• monitoring safety
• planning services
• risk stratification
• Population Health Management

This may only take place when there is a clear legal basis to use this information.  All these uses help to provide better health and care for you, your family and future generations.  Confidential patient information about your health and care is only used like this where allowed by law or with consent.

Pseudonymised or anonymised data is generally used for research and planning so that you cannot be identified.

A full list of details including the legal basis, any Data Processor involvement and the purposes for processing information can be found in Appendix A.

How long do we hold information for?

All records held by the Practice will be kept for the duration specified by national guidance from NHS Digital, Health and Social Care Records Code of Practice.  Once information that we hold has been identified for destruction it will be disposed of in the most appropriate way for the type of information it is.  Personal confidential and commercially confidential information will be disposed of by approved and secure confidential waste procedures. We keep a record of retention schedules within our information asset registers, in line with the Records Management Code of Practice for Health and Social Care 2021.

iGPR Technologies Limited 

We use a processor, iGPR Technologies Limited (“iGPR”), to assist us with responding to report requests relating to your patient data, such as subject access requests that you submit to us (or that someone acting on your behalf submits to us) and report requests that insurers submit to us under the Access to Medical Records Act 1988 in relation to a life insurance policy that you hold or that you are applying for. iGPR manages the reporting process for us by reviewing and responding to requests in accordance with our instructions and all applicable laws, including UK data protection laws. The instructions we issue to iGPR include general instructions on responding to requests and specific instructions on issues that will require further consultation with the GP responsible for your care.

Individuals Rights under UK GDPR

Under UK GDPR 2016  / Data Protection Act 2018 the Law provides the following rights for individuals.  The NHS upholds these rights in a number of ways.

1. The right to be informed
2. The right of access
3. The right to rectification
4. The right to erasure (not an absolute right) only applies in certain circumstances
5. The right to restrict processing
6. The right to data portability
7. The right to object
8. Rights in relation to automated decision making and profiling.

Your right to opt out of data sharing and processing

The NHS Constitution states ‘You have a right to request that your personal and confidential information is not used beyond your own care and treatment and to have your objections considered’.

Type 1 Opt Out

This is an objection that prevents an individual's personal confidential information from being shared outside of their general practice except when it is being used for the purposes of their individual direct care, or in particular circumstances required by law, such as a public health emergency like an outbreak of a pandemic disease. If patients wish to apply a Type 1 Opt Out to their record they should make their wishes know to the practice manager.

National data opt-out

The national data opt-out was introduced on 25 May 2018, enabling patients to opt-out from the use of their data for research or planning purposes, in line with the recommendations of the National Data Guardian in her Review of Data Security, Consent and Opt-Outs.

The national data opt-out replaces the previous ‘type 2’ opt-out, which required NHS Digital not to use a patient’s confidential patient information for purposes beyond their individual care. Any patient that had a type 2 opt-out recorded on or before 11 October 2018 has had it automatically converted to a national data opt-out. Those aged 13 or over were sent a letter giving them more information and a leaflet explaining the national data opt-out.  For more information go to National data opt out programme.

To find out more or to register your choice to opt out, please visit Your NHS Data Matters.

On this web page you will:

• See what is meant by confidential patient information
• Find examples of when confidential patient information is used for individual care and examples of when it is used for purposes beyond individual care
• Find out more about the benefits of sharing data
• Understand more about who uses the data
• Find out how your data is protected
• Be able to access the system to view, set or change your opt-out setting
• Find the contact telephone number if you want to know any more or to set/change your opt-out by phone 
• See the situations where the opt-out will not apply

Right of Access to your information (Subject Access Request)

Under Data Protection Legislation everybody has the right have of access to, or request a copy of, information we hold that can identify them, this includes medical records. There are some safeguards regarding what patients will have access to and they may find information has been redacted or removed for the following reasons:

• It may be deemed to risk causing harm to the patient or others
• The information within the record may relate to third parties who are entitled to their confidentiality, or who have not given their permission for the information to be shared.

Patients do not need to give a reason to see their data. And requests can be made verbally or in writing.  Although we may ask them to complete a form in order that we can ensure that they have the correct information required.

Where multiple copies of the same information is requested the surgery may charge a reasonable fee for the additional copies.

Patients will need to provide proof of identity to receive this information.

Patients may also request to have online access to their data, they may do this via the NHS APP, or via the practices system. If you would like to, you can access your GP record online.

COVID Passport access

Patients may access their Covid passport via the link, the practice cannot provide this document as it is not held in the practice record. If you have any issues gaining access to your Covid Passport or letter you should call: 119

Change of Detail

It is important that you tell the surgery if any of your contact details such as your name or address have changed, or if any of your other contacts details are incorrect including third party emergency contact details.  It is important that we are made aware of any changes immediately in order that no information is shared in error.

Mobile telephone number

If you provide us with your mobile phone number, we will use this to send you text reminders about your appointments or other health screening information.  Please let us know if you do not wish to receive text reminders on your mobile.

Email address

Where you have provided us with your email address, with your consent we will use this to send you information relating to your health and the services we provide.  If you do not wish to receive communications by email please let us know.

Notification

Data Protection Legislation requires organisations to register a notification with the Information Commissioner to describe the purposes for which they process personal and sensitive information.

We are registered as a Data Controller and our registration can be viewed online in the public register.

Any changes to this notice will be published on our website and in a prominent area at the Practice.

Data Protection Officer

The Data Protection Officer (DPO) for Maywood Surgery is Name: Laura Taw, telephone number: 01243 830872 or contact her via our secure online form

What is the right to know?

The Freedom of Information Act 2000 (FOIA) gives people a general right of access to information held by or on behalf of public authorities, promoting a culture of openness and accountability across the public sector.  You can request any non-personal information that the GP Practice holds, that does not fall under an exemption.  You may not ask for information that is covered by the Data Protection Legislation under FOIA.  However, you can request this under a right of access request – see section above ‘Access to your information’.

Right to Complain

If you have concerns or are unhappy about any of our services, please contact the Practice Manager.

For independent advice about data protection, privacy and data-sharing issues, you can contact: 

The Information Commissioner 
Wycliffe House 
Water Lane 
Wilmslow 
Cheshire 
SK9 5AF 

Phone: 0303 123 1113    
Visit the ICO Website

The NHS Care Record Guarantee

The NHS Care Record Guarantee for England sets out the rules that govern how patient information is used in the NHS, what control the patient can have over this, the rights individuals have to request copies of their data and how data is protected under Data Protection Legislation.

The NHS Constitution

The NHS Constitution establishes the principles and values of the NHS in England. It sets out the rights patients, the public and staff are entitled to.  These rights cover how patients access health services, the quality of care you’ll receive, the treatments and programs available to you, confidentiality, information and your right to complain if things go wrong.

NHS Constitution for England

COVID-19 and your information

Updated on 9th April 2020

Supplementary privacy notice on Covid-19 for Patients

This notice describes how we may use your information to protect you and others during the Covid-19 outbreak.  It supplements our main Privacy Notice.

The health and social care system is facing significant pressures due to the COvid-19 outbreak.  Health and care information is essential to deliver care to individuals, to support health and social care services and to protect public health.  Information will also be vital in researching, monitoring, tracking and managing the outbreak.  In the current emergency it has become even more important to share health and care information across relevant organisations.

Existing law which allows confidential patient information to be used and shared appropriately and lawfully in a public health emergency is being used during this outbreak. Using this law, the Secretary of State has required NHS Digital; NHS England and bodies (such as Public Health England); local authorities; health organisations and GPs to share confidential patient information to respond to the Covid-19 outbreak.  Any information used or shared during the Covid-19 outbreak will be limited to the period of the outbreak unless there is another legal basis to use the data. Further information is available on the government website and some FAQs on this law are available here.

During this period of emergency, opt-outs will not generally apply to the data used to support the Covid-19 outbreak, due to the public interest in sharing information.  This includes National Data Opt-Outs. However in relation to the Summary Care Record, existing choices will be respected.  Where data is used and shared under these laws your right to have personal data erased will also not apply.  It may also take us longer to respond to Subject Access Requests (SARs), Freedom of Information requests (FOIs) and new opt out requests whilst we focus our efforts on responding to the outbreak.

In order to look after your health and care needs we may share your confidential patient information included health and care records with clinical and non-clinical staff in other health and care providers, for example neighbouring GP practices, hospitals and NHS 111. We may also use the details we have to send public health messages to you, either by phone, text message or email.

During this period of emergency we may offer you a consultation via telephone or video conferencing. By accepting the invitation and entering the consultation you are consenting to this.  Your personal/confidential patient information will be safeguarded in the same way it would with any other consultation.

We will also be required to share personal confidential patient information with health and care organisations and other bodies engaged in disease surveillance for the purposes of protecting public health, providing healthcare services to the public and monitoring and managing the outbreak. Further information about how health and care data is being used and shared by other NHS and social care organisations in a variety of ways to support the Covid-19 response is here.

NHS England and Improvement and the NHSX have developed a single, secure store to gather data from across the health and care system to information the Covid-19 response.  This includes data already collected by NHS England, NHS Improvement, Public Health England and NHS Digital.  New data will include 999 call data, data about hospital occupancy and A&E capacity data as well as data provided by patient themselves. All the data held in the platform is subject to strict controls that meet the requirements of data protection legislation.

In such circumstances where you tell us you’re experiencing Covid-19 symptoms we may need to collect specific health data about you.  Where we need to do so, we will not collect more information than we require and we will ensure that any information collected is treated with the appropriate safeguards.

We may amend this Privacy Policy at any time so please review it frequently. The date at the top of this page will be amended each time this notice is updated.