This fair processing notice explains why the GP practice collects information about you and how that information may be used.
The health care professionals who provide you with care maintain records about your health and any treatment or care you have received previously (e.g. NHS Trust, GP Surgery, Walk-in clinic, etc.). These records help to provide you with the best possible healthcare.
NHS health records may be electronic, on paper or a mixture of both, and we use a combination of working practices and technology to ensure that your information is kept confidential and secure. Records which this GP Practice hold about you may include the following information;
- Details about you, such as your address, carer, legal representative, emergency contact details
- Any contact the surgery has had with you, such as appointments, clinic visits, emergency appointments, etc.
- Notes and reports about your health
- Details about your treatment and care, results of investigations such as laboratory tests, x-rays etc
- Relevant information from other health professionals, relatives or those who care for you
- Any letters your GP may send to you
Electronic patient records are held at Eastfield Medical Centre until death.
To ensure you receive the best possible care, your records are used to facilitate the care you receive. Information held about you may be used to help protect the health of the public and to help us manage the NHS. Information may be used within the GP practice for clinical audit to monitor the quality of the service provided.
Some of this information will be held centrally and used for statistical purposes. Where we do this, we take strict measures to ensure that individual patients cannot be identified. Sometimes your information may be requested to be used for research purposes – the surgery will always gain your consent before releasing the information for this purpose.
The lawful bases for collecting and processing patient data are for the purposes of direct patient care:
Public Task – article 6.1 (e) The processing is necessary to perform a task in the public interest or for you official functions, and the task or function has a clear basis in law.
Special Category Condition: article 9.2 (h) Processing is necessary for the purposes of preventative or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health and social care or treatment or the management of health or social care systems and services on the basis of union or member states law or pursuant to contract with a health professional and subject to the condition and safeguards.
Coronavirus (COVID-19) pandemic and your information
The ICO recognises the unprecedented challenges the NHS and other health professionals are facing during the COVID-19 pandemic.
The ICO also recognise that 'Public bodies may require additional collection and sharing of personal data to protect against serious threats to public health.'The Government have also taken action in respect of this and on 20th March 2020 the Secretary of State for Health and Social Care issued a notice under Regulation 3(4) of the Health Service (Control of Patient Information) Regulations 2002 requiring organisations such as GP Practices to use your information to help GP Practices and other healthcare organisations to respond to and deal with the COVID-19 pandemic.
Please note that this notice has now been revised and extended by a further notice from 10 September 2021 until 31st March 2022.
In order to look after your healthcare needs during this difficult time, we may urgently need to share your personal information, including medical records, with clinical and non clinical staff who belong to organisations that are permitted to use your information and need to use it to help deal with the COVID-19 pandemic. This could (amongst other measures) consist of either treating you or a member of your family and enable us and other healthcare organisations to monitor the disease, assess risk and manage the spread of the disease. Additionally, the use of your information is now required to support NHS Test and Trace.
Please be assured that we will only share information and health data that is necessary to meet yours and public healthcare needs. The Secretary of State for Health and Social Care has also stated that these measures are temporary and will expire on 31st March 2022 unless a further extension is required. Any further extension will be provided in writing and we will communicate the same to you.
Please also note that the data protection and electronic communication laws do not stop us from sending public health messages to you, either by phone, text or email as these messages are not direct marketing.
It may also be necessary, where the latest technology allows us to do so, to use your information and health data to facilitate digital consultations and diagnoses and we will always do this with your security in mind If you are concerned about how your information is being used, please contact our DPO using the contact details provided in this Privacy Notice.
Risk Stratification
Risk stratification data tools are increasingly being used in the NHS to help determine a person’s risk of suffering a particular condition, preventing an unplanned or (re)admission and identifying a need for preventive intervention. Information about you is collected from a number of sources including NHS Trusts and from this GP Practice. A risk score is then arrived at through an analysis of your de-identified information using software managed by eMBED, and is only provided back to your GP as data controller in an identifiable form. Risk stratification enables your GP to focus on preventing ill health and not just the treatment of sickness. If necessary your GP may be able to offer you additional services. Please note that you have the right to opt out of your data being used in this way.
Medicines Management
Your GP Practice supports a medicines management review service of medications prescribed to its patients. This service involves a review of prescribed medications to ensure patients receive the most appropriate, up to date and cost-effective treatments. This service is provided by qualified and registered healthcare professionals from within the GP practice, our NHS Primary Care Network, NHS North Yorkshire Clinical Commissioning Group or by external partners approved by the GP practice. Patient identifiable information does not leave the practice system but is accessed to ensure only appropriate clinical recommendations or decisions are made for each patient. Each patient can opt out of (or back into) the practice using their data for anything other than specified purposes or where there is a lawful requirement to do so.
How do we maintain the confidentiality of your records?
We are committed to protecting your privacy and will only use information collected lawfully in accordance with:
- GDPR
- Data Protection Act 1998
- Human Rights Act 1998
- Common Law Duty of Confidentiality
- Health and Social Care Act 2012
- NHS Codes of Confidentiality, Information Security and Records Management
- Information: To Share or Not to Share Review
Every member of staff who works for an NHS organisation has a legal obligation to keep information about you confidential.
We will only ever use or pass on information about you if others involved in your care have a genuine need for it. We will not disclose your information to any third party without your permission unless there are exceptional circumstances (i.e. life or death situations), where the law requires information to be passed on and / or in accordance with the new information sharing principle following Dame Fiona Caldicott’s information sharing review (Information to share or not to share) where “The duty to share information can be as important as the duty to protect patient confidentiality.” This means that health and social care professionals should have the confidence to share information in the best interests of their patients within the framework set out by the Caldicott principles. They should be supported by the policies of their employers, regulators and professional bodies.
Who are our partner organisations?
We may also have to share your information, subject to strict agreements on how it will be used, with the following organisations;
- NHS Trusts / Foundation Trusts
- GPs
- NHS Commissioning Support Units
- Independent Contractors such as dentists, opticians, pharmacists
- Private Sector Providers
- Voluntary Sector Providers
- Ambulance Trusts
- Clinical Commissioning Groups
- Social Care Services
- Health and Social Care Information Centre (HSCIC)
- Local Authorities
- Education Services
- Fire and Rescue Services
- Police & Judicial Services
- Voluntary Sector Providers
- Private Sector Providers
- Other ‘data processors’ of which you will be informed
Our practice is collaborating with NHSBSA which is providing NHS numbers for those patients that may be suitable for electronic repeat dispensing prescriptions. The information is obtained from NHS prescriptions submitted to the NHSBSA. A member of our clinical team will contact these patients soon to explain the benefits of this service.
We may also use external companies to process personal information, such as for archiving purposes. These companies are bound by contractual agreements to ensure information is kept confidential and secure.
Access to personal information
You have a right under GDPR to request access to view or to obtain copies of what information the surgery holds about you and to have it amended should it be inaccurate. In order to request this, you need to do the following:
- Your request must be made in writing to the surgery (please ask at reception for a form)
- There will be no charge unless your request is deemed to be unfounded, excessive or repetitive
- We are required to respond to you within one month. If we need longer to process your request due to it being complex, the surgery will write to you to inform you that it may take up to 2 months
- You will need to give adequate information (for example full name, address, date of birth, NHS number and details of your request) so that your identity can be verified and your records located
Objections / Complaints
Should you have any concerns about how your information is managed at the GP surgery, please contact the GP Practice Manager, Michelle Frankish (14 High Street, Eastfield Medical Centre, Eastfield, YO11 3LJ)
If you are still unhappy following a review by the Practice you can then complain to the Information Commissioners Office (ICO). www.ico.org.uk. Telephone: 0303 123 1113 (local rate) or 01625 545 745.
If you are happy for your data to be extracted and used for the purposes described in this privacy notice then you do not need to do anything. If you have any concerns about how your data is shared then please contact the practice.
Change of Details
It is important that you tell the person treating you if any of your details such as your name, address or phone number have changed. This prevents Eastfield Medical Centre from sending letters or SMS messages to the wrong person. If you notice that any details that we hold are incorrect, please contact the surgery to ask for these to be amended. You have a responsibility to inform us of any changes so our records are accurate and up to date for you.
Who is the Data Controller and Data Protection Officer?
The Data Controller, responsible for keeping your information secure and confidential, is Eastfield Medical Centre, 14 High Street, Eastfield, YO11 3LJ , Tel: 01723 582297.
The Data Protection Officer is Michelle Frankish with support from the Eastfield Management Team.