Practice Policies & Patient Information

Chaperone Policy

We will always respect your privacy, dignity and your religious and cultural beliefs particularly when intimate examinations are advisable – these will only be carried out with your express agreement and you will be offered a chaperone to attend the examination if you so wish.

You may also request a chaperone when making the appointment or on arrival at the surgery (please let Reception know) or at any time during the consultation.

Children privacy policy

We help people with their health and social care.

We decide how your personal data is used to help you.

We are registered with the Information Commissioner’s Office (ICO).

This means we can use information about the people we work with under the UK Data Protection Act 2018.

Our registration number is Z5969203

What is personal data?

Personal Information is information about you or other people

Your name

Your address

Your telephone number

Your date of birth

Your ethnicity

Contact details for your family and carers

If you are married

Your job

Your religion

Your email address

Where you were born

If you are using the NHS as an overseas visitor

What name you want to be called

Information about your health

If you have a protection order that affects your health, wellbeing and human rights (safeguarding status)

Why do we collect personal information about you?
	We need to keep information about your health, treatment and care.
	This is so we can give you good treatment and care.

What do we use your personal information for?
	We won’t tell people your name unless we really have to.
	We give your information to other people who are treating you.
	To remind you about your appointments
	To review our service to make it better

	To share your information with the people who are paying for your care. These people are called commissioners.
	To send reports to organisations such as the Department of Health
	To train healthcare staff
	If there is a complaint
	If the law says we need to report something that has happened.

Who do we share information with and why?
	We use it to make sure all the people involved in your care know what treatment you are getting.
	We need to tell you how personal information will be used. We need to have a legal reason for using your information without asking you first.
	We might need to give your information to other organisations.
	We might share personal information with other NHS Organisations to help them give you healthcare. This would be NHS England, Public Health England and other NHS Trusts, General Practitioners (GPs), Ambulance Services, Primary Care Agencies. This may also include those other organisations that help the NHS to look after your health.
	We might share personal information with organisations like Social Services or private care homes to help them give you support.
	Sometimes special permission will be given to use information that uses your name without your consent. This may be for medical research or checking quality of care. This permission is given by the Secretary of State for Health on advice from the National Information Governance Board for Health and Social Care under strict conditions.
	Sometimes, we might need to share your information because it is the law. We will tell you when we do this.
	To find out if fraud is happening.
	If there is a court order.
	If the Care Quality Commission need it for an inspection.
	If the Police need to investigate a crime.

Where do we get information about you?
	From you
	From your previous doctor (if you have one)
	From hospital

How do we keep information about you?
	We keep your information on paper and in a file. We also keep your information in an electronic patient record system, on the computer. The NHS Records Management Code of Practice for Health and Social Care 2016 and National Archives Requirements tells us to do this
	The law tells us how to keep your information. These laws include the Data Protection Act 2018, the GDPR 2016, and the Common Law Duty of Confidentiality.
	We keep information about you for as long as we need to do make your health better
	You can read more about this online using this link (NHS Record Management code of practice): https://www.nhsx.nhs.uk/information-governance/guidance/records-management-code/records-management-code-of-practice-2021/

We have to:
	Keep your records up to date, complete, and accurate, about the care we give you.
	Keep records about you confidential and secure. We will make sure we keep your information safe, using computer passwords for electronic information, and locks for paper information.
	Give you information in a way you can understand.

What are your rights?
	You can ask to see the information we have about you
	You can ask us to change any information that is wrong
	You can tell us not to share your personal information (unless we need to because of the law)
	You can ask us to give the records we have about you to another organisation.
	For more information you can contact the Practice Partner or Data Protection officer: Umar Sabat, dpo.swl@nhs.net
	If you are not happy with how we use your personal information you can contact the Information Commissioner’s Office. https://ico.org.uk . Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Tel: 0303 123 1113 (local rate) or 01625 545 745 if you prefer to use a national rate number Fax: 01625 524 510 Email: casework@ico.org.uk

Confidentiality

You can be assured that anything you discuss with any member of the Central Team, will remain confidential. Even if you are under 16, nothing will be said to anyone, including parents, other family members, care workers or teachers, without your permission. The only reason why we might want to consider passing on confidential information without your permission would be to protect either you or someone else from serious harm. In this situation, we would always try to discuss this with you first.

If you have any worries or queries about confidentiality, please ask a member of our team.

If you would like to discuss matters of a confidential nature, with one of our team and dont want to discuss it at the Reception desk, we have a side room available in Reception.

Emergency Care Summary

There is a Central NHS Computer System called the Emergency Care Summary (ECS). The Emergency Care Summary is meant to help emergency doctors and nurses help you when you contact them when the surgery is closed. It will contain information on your medications and allergies.

Your information will be extracted from practices such as ours and held securely on central NHS databases.

As with all systems there are pros and cons to think about. When you speak to an emergency doctor you might overlook something that is important and if they have access to your medical record it might avoid mistakes or problems, although even then, you should be asked to give your consent each time a member of NHS Staff wishes to access your record, unless you are medically unable to do so.

On the other hand, you may have strong views about sharing your personal information and wish to keep your information at the level of this practice. If you don’t want an Emergency Care Summary to be made for you, tell your GP surgery. Don’t forget that if you do have an Emergency Care Summary, you will be asked if staff can look at it every time they need to. You don’t have to agree to this.

IT Policy

This practice is committed to preserving, as far as is practical, the security of data used by our information systems. This means that we will take all reasonable actions to;

Maintain the Confidentiality of all data within the practice by:

Ensuring that only authorised persons can gain access to our systems
Not disclosing information to anyone who has no right to see it

Maintain the integrity of all data within the practice by:

Taking care over input
Ensuring that all changes are reported and monitored
Checking that the correct record is on the screen before updating
Reporting all apparent errors and ensuring that they are resolved

Maintain the availability of all data by:

Ensuring that all equipment is protected from intruders
Ensuring that backups are taken at regular, predetermined intervals
Ensuring that contingency is provided for possible failure or equipment theft and that any such contingency plans are tested and kept up to date

Named GP

We have allocated a named and accountable GP to all our Central Surgery patients.

What are the Named GP’s responsibilities to 75s and over?

For patients aged 75 and over the named accountable GP is responsible for:

working with relevant associated health and social care professionals to deliver a multi-disciplinary care package that meets the needs of the patient

Does the requirement mean 24-hour responsibility for patients?

No. The named GP will not:

take on responsibility for the work of other doctors or health professionals
take on 24-hour responsibility for the patient, or have to change their working hours. The requirement does not imply personal availability for GPs throughout the working week
be the only GP or clinician who will provide care to that patient

Can patients choose their own Named GP?

In the first instance, patients are simply allocated a named GP. However, if a patient requests a particular GP, reasonable efforts will be made to accommodate their preference, recognising that there are occasions when the Practice may not feel the patient’s preference is suitable.

Do patients have to see the Named GP when they book an appointment with the practice?

No. Patients can and should feel free to choose to see any GP or nurse in the practice in line with current arrangements.

Personal Data

The following IT systems are in use at the practice:

E Referral
Accurx e triage
Iplato texting service
NHS App
EMIS clinical system
Electronic Prescribing Service (EPS)
Summary Care Record (uploading details of your current medication and allergies to the national “spine” so that these are available for doctors involved in your care elsewhere)
GP to GP transfers (the electronic transfer of records from practice to practice when you register at a practice)
Patient Access to records (the facility to view your medical records online).

If you would like access to your medical records enabled or would like to opt out of the local or national summary care record, please email us your request.

Privacy Notice – Safeguarding

Some members of society are recognised as needing protection, for example children and vulnerable adults. If a person is identified as being at risk from harm we are expected as professionals to do what we can to protect them. In addition we are bound by certain specific laws that exist to protect individuals. This is called “Safeguarding”. Where there is a suspected or actual safeguarding issue we will share information that we hold with other relevant agencies whether or not the individual or their representative agrees. There are three laws that allow us to do this without relying on the individual or their representatives agreement (unconsented processing), these are: Section 47 of The Children Act 1989 : (https://www.legislation.gov.uk/ukpga/1989/41/section/47), Section 29 of Data Protection Act (prevention of crime) https://www.legislation.gov.uk/ukpga/1998/29/section/29 and section 45 of the Care Act 2014 http://www.legislation.gov.uk/ukpga/2014/23/section/45/enacted. In addition there are circumstances when we will seek the agreement (consented processing) of the individual or their representative to share information with local child protection services, the relevant law being; section 17 Children’s Act 1989 https://www.legislation.gov.uk/ukpga/1989/41/section/17
1) Data Controller contact details	Central Surgery Surbiton Health Centre Ewell Rd Surbiton KT6 6EZ
2) Data Protection Officer contact details	Umar Sabat, Data Protection Officer Dpo.swl@nhs.net
3) Purpose of the processing	The purpose of the processing is to protect the child or vulnerable adult.
4) Lawful basis for processing	The sharing is a legal requirement to protect vulnerable children or adults, therefore for the purposes of safeguarding children and vulnerable adults, the following Article 6 and 9 conditions apply: For consented processing; 6(1)(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes For unconsented processing; 6(1)(c) processing is necessary for compliance with a legal obligation to which the controller is subject and: 9(2)(b) ‘…is necessary for the purposes of carrying out the obligations and exercising the specific rights of the controller or of the data subject in the field of …social protection law in so far as it is authorised by Union or Member State law..’ We will consider your rights established under UK case law collectively known as the “Common Law Duty of Confidentiality”^*
5) Recipient or categories of recipients of the shared data	The data will be shared with your local safeguarding services.
6) Rights to object	This sharing is a legal and professional requirement and therefore there is no right to object. There is also GMC guidance: https://www.gmc-uk.org/guidance/ethical_guidance/children_guidance_56_63_child_protection.asp
7) Right to access and correct	You have the right to access the data that is being shared and have any inaccuracies corrected. There is no right to have accurate medical records deleted except when ordered by a court of Law.
8) Retention period	The data will be retained for active use during any investigation and thereafter retained in an inactive stored form according to the law and national guidance.
9) Right to Complain.	You have the right to complain to the Information Commissioner’s Office, you can use this link https://ico.org.uk/global/contact-us/ or calling their helpline Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate) There are National Offices for Scotland, Northern Ireland and Wales, (see ICO website)

* “Common Law Duty of Confidentiality”, common law is not written out in one document like an Act of Parliament. It is a form of law based on previous court cases decided by judges; hence, it is also referred to as ‘judge-made’ or case law. The law is applied by reference to those previous cases, so common law is also said to be based on precedent.

The general position is that if information is given in circumstances where it is expected that a duty of confidence applies, that information cannot normally be disclosed without the information provider’s consent.

In practice, this means that all patient information, whether held on paper, computer, visually or audio recorded, or held in the memory of the professional, must not normally be disclosed without the consent of the patient. It is irrelevant how old the patient is or what the state of their mental health is; the duty still applies.

Three circumstances making disclosure of confidential information lawful are:

where the individual to whom the information relates has consented;
where disclosure is in the public interest; and
where there is a legal duty to do so, for example a court order.

Please note the National Data Opt Out does not apply to this sharing of information. For further information please see: https://www.nhs.uk/your-nhs-data-matters/

Date created: 24.09.2024

Privacy Notice – Call Recording

Central Surgery can record telephone calls to protect patients and staff and other health workers. Patients are protected by our having a record of our conversations with you, staff and other health workers are protected from potential abuse. We also occasionally use recordings for staff training and quality control. When you register with us we will make this clear to you and we will also make this clear to you each time you contact us and via our web site and other sources of information Calls that contain only administrative information, such as enquiries about appointments, are only retained for 4 weeks and are then will be routinely deleted. Calls, or transcripts of calls, audio or audio-visual recordings or elements of the discussion you have with the clinicians that contain clinical information may be added to your medical records, but this will be clarified with you at the time. The recordings are stored on the surgery telephone system
1) Data Controller contact details	Central Surgery Surbiton Health Centre Ewell Rd Surbiton KT6 6EZ
2) Data Protection Officer contact details	Umar Sabat dpo.swl@nhs.net
3) Purpose of the processing	To facilitate your access to care and in the case of telephone or other audio-visual consultations for your direct care.
4) Lawful basis for processing	The processing of personal data in the delivery of direct care and for providers’ administrative purposes in this surgery and in support of direct care elsewhere is supported under the following Article 6 and 9 conditions of the GDPR: Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’. Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services…” We will also recognise your rights established under UK case law collectively known as the “Common Law Duty of Confidentiality” *
5) Recipient or categories of recipients of the shared data	Necessary data will be shared with Health and care professionals and support staff in this surgery. Clinical data or records of consultations may be transcribed or appended to the records we hold on you and may thence be shared at hospitals, diagnostic and treatment centres who contribute to your personal care. Actual recordings will not be shared with anyone outside the practice. Please see our Privacy Notice for Direct Care. The actual recordings are stored on the telephone system and after a designated period of time will be either deleted or saved, onto the surgery Shared Drive if it is deemed necessary. You will be informed if the recording is to be stored for longer than is set out in this Privacy Notice and you will inform the reasons.
6) Rights to object	You have the right to object to some or all your information being processed (shared) under current data protection legislation (Article 21 the General Data Protection Regulations 2016, and the Data Protection Act 2018).
7) Right to access and correct	Access You have the right to see the data that is being shared about you. This is known as ‘the right of subject access’. You can make a request for this information from a provider. If your health or care provider holds information about you, and you make a subject access request they will: · Give you a description of it · Tell you why it is being held · Tell you who it could be shared with · Let you have a copy of the information in an intelligible form. To make a Subject Access Request , you will need to contact your health or care provider’s Data Protection Officer in writing. The contact details for the DPO for each organisation can be found in section 2 of this Privacy Notice as displayed by each individual organisation, or on their website. Rectification You have the right to have inaccurate personal data rectified, and in some circumstances removed. Requests to amend or delete data should be made to the individual Data Controller via the DPO, as per the contact information in section 2 of this Privacy Notice. Under current data protection legislation, all data controllers have a responsibility to ensure the information held about you is correct and up to date and must take all reasonable steps to correct or erase incorrect information as soon as possible. All requests to amend or remove information will be addressed on an individual basis by each Data Controller, however, it should be noted that, for example, information recorded by a health or care professional that is believed to be correct at the time of documentation, even when subsequently updated, is unlikely to be removed. There is no right to have accurate medical records deleted except when ordered by a Court of Law
8) Retention period	We will keep recordings up to 4 weeks. Clinical data transcribed from your telephone or other electronic consultations may become part of your clinical record and is retained according to relevant rules and regulations, see Privacy Notice on Direct Care.
9) Right to Complain.	You have the right to complain to the Information Commissioner’s Office, you can use this link https://ico.org.uk/global/contact-us/ or calling their helpline Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate) There are National Offices for Scotland, Northern Ireland and Wales, (see ICO website)

Please note the National Data Opt Out does not apply to this sharing of information. For further information please see: https://www.nhs.uk/your-nhs-data-matters/

Date created: 24.09.2024

Privacy Notice – Care Quality Commission

Plain English explanation The Care Quality Commission (CQC) is an organisation established in English law by the Health and Social Care Act. The CQC is the regulator for English health and social care services to ensure that safe care is provided. They inspect and produce reports on all English general practice activities in a rolling 5 year program. The law allows CQC to access identifiable patient data as well as requiring Central Surgery to share certain types of data with them in certain circumstances, for instance following a significant safety incident. For more information about the CQC see: http://www.cqc.org.uk/
1) Data Controller contact details	Central Surgery Surbiton Health Centre Ewell Rd Surbiton KT6 6EZ
2) Data Protection Officer contact details	Mr Umar Sabat dpo.swl@nhs.net
3) Purpose of the processing	To provide the Secretary of State and others with information and reports on the status, activity, and performance of the NHS.
4) Lawful basis for processing	The legal basis is: Article 6(1)(c) “processing is necessary for compliance with a legal obligation to which the controller is subject.” And for Special Category Data Article 9(2)(h) “processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;”
5) Recipient or categories of recipients of the shared data	The data will be shared with the Care Quality Commission, its officers and staff and members of the inspection teams that visit us from time to time.
6) Rights to object	You have the right to object to some or all of the information being shared. Please contact our Data Protection Officer.
7) Right to access and correct	You have the right to access the data that is being shared and have any inaccuracies corrected. There is no right to have accurate medical records deleted except when ordered by a court of Law.
8) Retention period	The data will be retained for active use during the processing and thereafter according to NHS Policies and the law.
9) Right to Complain.	You have the right to complain to the Information Commissioner’s Office, you can use this link https://ico.org.uk/global/contact-us/ or calling their helpline Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate) There are National Offices for Scotland, Northern Ireland and Wales, (see ICO website)

Please note the National Data Opt Out does not apply to this sharing of information. For further information please see: https://www.nhs.uk/your-nhs-data-matters/

Date created: 24.09.2024

Privacy Notice – Commissioning, Planning, risk stratification, patient identification

Plain English explanation The records we keep enable us to plan for your care. Central Surgery name keeps data on you that we apply searches and algorithms to identify from preventive interventions. This means using only the data we hold or in certain circumstances linking that data to data held elsewhere by other organisations, and usually processed by organisations within or bound by contracts with the NHS. If any processing of this data occurs outside Central Surgery your identity will not be visible to the processors. Only Central Surgery will be able to identify you and the results of any calculated factors, such as your risk of having a heart attack in the next 10 years or your risk of being admitted to hospital with a complication of chest disease. You have the right to object to our processing your data in these circumstances and before any decision based upon that processing is made about you. Processing of this type is only lawfully allowed where it results in individuals being identified with their associated calculated risk. It is not lawful for this processing to be used for other ill-defined purposes, such as “health analytics”. Despite this we have an overriding responsibility to do what is in your best interests. If we identify you as being at significant risk of having, for example a heart attack or stroke, we are justified in performing that processing. We are required by Articles in the General Data Protection Regulations to provide you with the information in the following 9 subsections.
1) Data Controller contact details	Central Surgery Surbiton Health Centre Ewell Rd Surbiton KT6 6EZ
2) Data Protection Officer contact details	Umar Sabat Dpo.swl@nhs.net
3) Purpose of the processing	Central Surgery performs computerised searches of some or all of our records to identify individuals who may be at increased risk of certain conditions or diagnoses i.e. Diabetes, heart disease, risk of falling). Your records may be amongst those searched. This is often called “risk stratification” or “case finding”. These searches are sometimes carried out by Data Processors who link our records to other records that they access, such as hospital attendance records. The results of these searches and assessment may then be shared with other healthcare workers, such as specialist, therapists, technicians etc. The information that is shared is to enable the other healthcare workers to provide the most appropriate advice, investigations, treatments, therapies and or care.
4) Lawful basis for processing	The legal basis for this processing is Article 6(1)(e); “necessary… in the exercise of official authority vested in the controller’ And Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services…” We will recognise your rights under UK Law collectively known as the “Common Law Duty of Confidentiality”^*
5) Recipient or categories of recipients of the shared data	The data will be shared for processing with the CCG for subsequent healthcare
6) Rights to object	You have the right to object to this processing where it might result in a decision being made about you. That right may be based either on implied consent under the Common Law of Confidentiality, Article 22 of GDPR or as a condition of a Section 251 approval under the HSCA. It can apply to some or all of the information being shared with the recipients. Your right to object is in relation to your personal circumstances.
7) Right to access and correct	You have the right to access the data that is being shared and have any inaccuracies corrected. There is no right to have accurate medical records deleted except when ordered by a court of Law.
8) Retention period	The data will be retained in line with the law and national guidance. Please see the NHS Records Management Code of Practice 2021.
9) Right to Complain.	You have the right to complain to the Information Commissioner’s Office, you can use this link https://ico.org.uk/global/contact-us/ or calling their helpline Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate) There are National Offices for Scotland, Northern Ireland and Wales, (see ICO website)

Three circumstances making disclosure of confidential information lawful are:

where the individual to whom the information relates has consented.
where disclosure is in the public interest; and
where there is a legal duty to do so, for example a court order.

Please note the National Data Opt Out does not apply to this sharing of information. For further information please see: https://www.nhs.uk/your-nhs-data-matters/

Date created: 24.09.2024

Privacy Notice – Direct Care, (routine care and referrals)

Plain English explanation

Central Surgery keeps data on you relating to who you are, where you live, what you do, your family, possibly your friends, your employers, your habits, your problems and diagnoses, the reasons you seek help, your appointments, where you are seen and when you are seen, who by, referrals to specialists and other healthcare providers, tests carried out here and in other places, investigations and scans, treatments and outcomes of treatments, your treatment history, the observations and opinions of other healthcare workers, within and without the NHS as well as comments and aide memoires reasonably made by Central Surgery healthcare professionals who are appropriately involved in your health care.

If your health needs require care from others elsewhere outside Central Surgery, we will exchange with them whatever information about you that is necessary for them to provide that care. When you contact healthcare providers outside Central Surgery, but within the NHS, it is usual for them to send us information relating to that encounter. We will retain part or all those reports. Normally we will receive equivalent reports of contacts you have with non-NHS services, but this is not always the case.

People who have access to your information will only normally have access to that which they need to fulfil their roles, for instance admin staff will normally only see your name, address, contact details, appointment history and registration details in order to book appointments, the practice nurses will normally have access to your immunisation, treatment, significant active and important past histories, your allergies and relevant recent contacts whilst the GP you see or speak to will normally have access to everything in your record.

You have the right to object to our sharing your data in these circumstances, but we have an overriding responsibility to do what is in your best interests. Please see below.

We are required by Articles in the General Data Protection Regulations to provide you with the information in the following 9 subsections.

1) Data Controller contact details

Central Surgery

Surbiton Health Centre

Ewell Rd

Surbiton

KT6 6EZ

2) Data Protection Officer contact details

Umar Sabat
Dpo.swl@nhs.net

3) Purpose of the processing

Direct Care is care delivered to the individual alone, most of which is provided in the surgery. After a patient agrees to a referral for direct care elsewhere, such as a referral to a specialist in a hospital, necessary and relevant information about the patient, their circumstances and their problem will need to be shared with the other healthcare workers, such as specialist, therapists, technicians etc. The information that is shared is to enable the other healthcare workers to provide the most appropriate advice, investigations, treatments, therapies and or care.

4) Lawful basis for processing

The processing of personal data in the delivery of direct care and for providers’ administrative purposes in this surgery and in support of direct care elsewhere is supported under the following Article 6 and 9 conditions of the GDPR:

Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’.

Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services…”

We will also recognise your rights established under UK case law collectively known as the “Common Law Duty of Confidentiality”^*

5) Recipient or categories of recipients of the processed data

The data will be shared with Health and care professionals and support staff in this surgery and at hospitals, diagnostic and treatment centres who contribute to your personal care.

6) Rights to object

You have the right to object to some or all the information being processed under Article 21. Please contact the Data Controller. You should be aware that this is a right to raise an objection, that is not the same as having an absolute right to have your wishes granted in every circumstance.

7) Right to access and correct

You have the right to access the data that is being shared and have any inaccuracies corrected. There is no right to have accurate medical records deleted except when ordered by a court of Law.

8) Retention period

The data will be retained in line with the law and national guidance. Please see the NHSx Records Management Code of Practice.

9) Right to Complain.

You have the right to complain to the Information Commissioner’s Office, you can use this link https://ico.org.uk/global/contact-us/

or calling their helpline Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate)

There are National Offices for Scotland, Northern Ireland and Wales, (see ICO website)

Three circumstances making disclosure of confidential information lawful are:

where the individual to whom the information relates has consented;
where disclosure is in the public interest; and
where there is a legal duty to do so, for example a court order

Please note the National Data Opt Out does not apply to this sharing of information. For further information please see: https://www.nhs.uk/your-nhs-data-matters/

Date created: 24.09.2024
Last updated:

Privacy Notice – Emergencies

There are occasions when intervention is necessary in order to save or protect a patients life or to prevent them from serious immediate harm, for instance during a collapse or diabetic coma or serious injury or accident. In many of these circumstances the patient may be unconscious or too ill to communicate. In these circumstances we have an overriding duty to try to protect and treat the patient. If necessary we will share your information and possibly sensitive confidential information with other emergency healthcare services, the police or fire brigade, so that you can receive the best treatment.

The law acknowledges this and provides supporting legal justifications.

Individuals have the right to make pre-determined decisions about the type and extend of care they will receive should they fall ill in the future, these are known as “Advance Directives”. If lodged in your records these will normally be honoured despite the observations in the first paragraph.

1) Data Controller contact details

Central Surgery

Surbiton Health Centre

Ewell Rd

Surbiton

KT6 6EZ

2) Data Protection Officer contact details

Umar Sabat

Dpo.swl@nhs.net

3) Purpose of the processing

Doctors have a professional responsibility to share data in emergencies to protect their patients or other persons. Often in emergency situations the patient is unable to provide consent.

4) Lawful basis for processing

This is a Direct Care purpose. There is a specific legal justification;

Article 6(1)(d) “processing is necessary to protect the vital interests of the data subject or of another natural person”

And

Article 9(2)(c) “processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent”

Or alternatively

We will also recognise your rights established under UK case law collectively known as the “Common Law Duty of Confidentiality”.

5) Recipient or categories of recipients of the shared data

The data will be shared with Healthcare professionals and other workers in emergency and out of hours services and at local hospitals, diagnostic and treatment centres. (if preferred list actual named services)

6) Rights to object

You have the right to object to some or all of the information being shared with the recipients.

You also have the right to have an “Advance Directive” placed in your records and brought to the attention of relevant healthcare workers or staff.

7) Right to access and correct

You have the right to access the data that is being shared and have any inaccuracies corrected. There is no right to have accurate medical records deleted except when ordered by a court of Law. If we share or process your data in an emergency when you have not been able to consent, we will notify you at the earliest opportunity.

8) Retention period

The data will be retained in line with the law and national guidance

9) Right to Complain.

You have the right to complain to the Information Commissioner’s Office, you can use this link https://ico.org.uk/global/contact-us/

or calling their helpline Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate)

There are National Offices for Scotland, Northern Ireland and Wales, (see ICO website)

Three circumstances making disclosure of confidential information lawful are:

where the individual to whom the information relates has consented;
where disclosure is in the public interest; and
where there is a legal duty to do so, for example a court order.

Please note the National Data Opt Out does not apply to this sharing of information. For further information please see: https://www.nhs.uk/your-nhs-data-matters/

Date created: 24.09.2024

Privacy Notice – GP Connect

Plain English explanation GP Connect is a platform which allows different systems to communicate so that clinicians in different care setting can view a patients GP record. This practice keeps data on you relating to who you are, where you live, what you do, your family, possibly your friends, your employers, your habits, your problems and diagnoses, the reasons you seek help, your appointments, where you are seen and when you are seen, who by, referrals to specialists and other healthcare providers, tests carried out here and in other places, investigations and scans, treatments and outcomes of treatments, your treatment history, the observations and opinions of other healthcare workers, within and outside the NHS as well as comments and aide memoires reasonably made by healthcare professionals in this practice who are appropriately involved in your health care. If your health needs require care from others elsewhere outside this practice we will exchange with them whatever information about you that is necessary for them to provide that care. People who have access to your information will only normally have access to that which they need to fulfil their roles. Yours consent to this sharing of data for the purpose of direct care with those outside the practice is assumed and allowed by the Law. Users accessing the information must have the right level of security clearance and have a special account set up or a special access card. Each time anyone accesses your medical record, this information is logged. When you contact healthcare providers outside the practice but within the NHS it is usual for them to send us information relating to that encounter. We will retain part or all of those reports. Normally we will receive equivalent reports of contacts you have with non-NHS services, but this is not always the case. You have the right to object to our sharing your data in these circumstances, but we have an overriding responsibility to do what is in your best interests. Individuals have the right to make pre-determined decisions about the type and extent of care they will receive should they fall ill in the future; these are known as “Advance Directives”. If lodged in your records these will normally be honoured despite the observations in the paragraph above. GP Connect also provides the ability of your medical records being transferred to your new registered practice electronically without the delay. This enables continuity of your care by different providers. We are required by Articles in the UK GDPR to provide you with the information in the following 9 subsections:
1) Data Controller contact details	Central Surgery Surbiton Health Centre Ewell Rd Surbiton KT6 6EZ
2) Data Protection Officer contact details	Mr Umar Sabat dpo.swl@nhs.net
3) Purpose of the processing	The information that is shared is to enable the other healthcare workers to provide the most appropriate advice, investigations, treatments, therapies and/or care.
4) Lawful basis for processing	The processing of personal data in support of direct care elsewhere is supported under the following Article 6 and 9 conditions of the UK GDPR: Article 6(1)(d) ‘processing is necessary to protect the vital interests of the data subject or of another natural person’. Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’. Article 9(2)(c) ‘processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent’. Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services…’. We will also recognise your rights established under UK case law collectively known as the “Common Law Duty of Confidentiality”*.
5) Recipient or categories of recipients of the shared data	The data will be shared with the Care Quality Commission, its officers and staff and members of the inspection teams that visit us from time to time.
6) Rights to object	You have the right to object to some or all of the information being shared. Please contact our Data Protection Officer.
7) Right to access and correct	You have the right to access the data that is being shared and have any inaccuracies corrected. There is no right to have accurate medical records deleted except when ordered by a court of Law.
8) Retention period	The data will be retained for active use during the processing and thereafter according to NHS Policies and the law.
9) Right to Complain.	You have the right to complain to the Information Commissioner’s Office, you can use this link https://ico.org.uk/global/contact-us/ or calling their helpline Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate)

Please note the National Data Opt Out does not apply to this sharing of information. For further information please see: https://www.nhs.uk/your-nhs-data-matters/

Date created: 24.09.2024

Privacy Notice – Payment Processing Services

As employers we need to keep certain information so that we can remain your employer and manage payments. This is a combination of personal and financial information. We are required by law to hold certain types of data on those we employ under the Health and Social Care Act and this data is examined during CQC inspection visits. For more information about the CQC see: http://www.cqc.org.uk/ We are also required to share information about you with NHS Digital under a submission known as the “Workforce Minimum Dataset”. To find out more visit https://digital.nhs.uk/data-and-information/areas-of-interest/workforce/workforce-minimum-data-set-wmds We are also required by HMRC and various taxation laws, such as “The Income Tax (Pay As You Earn) Regulations 2003” to keep financial records.
1) Data Controller contact details	Central Surgery Surbiton Health Centre Ewell Rd Surbiton KT6 6EZ
2) Data Protection Officer contact details	Umar Sabat Dpo.swl@nhs.net
3) Purpose of the processing	To comply with the Health and Social Care Act and taxation law.
4) Lawful basis for processing	The legal basis will be Article 6(1)(c) “processing is necessary for compliance with a legal obligation to which the controller is subject.” And Article 9(2)(h) “processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;”
5) Recipient or categories of recipients of the shared data	The data will be shared with the Care Quality Commission, its officers and staff and members of the inspection teams that visit us from time to time. Financial data will also be shared with HMRC.
6) Rights to object	You have the right to object to some or all of the information being shared with CQC, please contact our Data Protection Officer. There is no right to have UK taxation related data deleted except after certain statutory periods.
7) Right to access and correct	You have the right to access the data that is being shared and have any inaccuracies corrected. There is no right to have records deleted except when ordered by a court of Law.
8) Retention period	The data will be retained for active use during the processing and thereafter according to NHS Policies, taxation and employment law.
9) Right to Complain.	You have the right to complain to the Information Commissioner’s Office, you can use this link https://ico.org.uk/global/contact-us/ or calling their helpline Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate) There are National Offices for Scotland, Northern Ireland and Wales, (see ICO website)/

Please note the National Data Opt Out does not apply to this sharing of information. For further information please see: https://www.nhs.uk/your-nhs-data-matters/

Date created: 24.09.2024

Privacy Notice – Sharing Information with NHS England

Plain English Explanation

NHS England is the secure haven* for NHS patient data, a single secure repository where data collected from all branches of the NHS is processed. NHS England provides reports on the performance of the NHS, statistical information, audits and patient outcomes (https://digital.nhs.uk/data-and-information). Examples include; A/E and outpatient waiting times, the numbers of staff in the NHS, percentage target achievements, payments to GPs etc and more specific targeted data collections and reports such as the Female Genital Mutilation, general practice appointments data and English National Diabetes Audits. GPs are required by the Health and Social Care Act to provide NHS England with information when instructed. This is a legal obligation which overrides any patient wishes. These instructions are called “Directions”. More information on the directions placed on GPs can be found at https://digital.nhs.uk/article/8059/NHS-England-Directions- and www.nhsdatasharing.info

1) Data Controller contact details

Central Surgery

Surbiton Health Centre

Ewell Rd

Surbiton

KT6 6EZ

2) Data Protection Officer contact details

Umar Sabat

Dpo.swl@nhs.net

3) Purpose of the processing

To provide the Secretary of State and others with information and reports on the status, activity and performance of the NHS. The provide specific reporting functions on indentified

4) Lawful basis for processing

The legal basis will be

Article 6(1)(c) “processing is necessary for compliance with a legal obligation to which the controller is subject.”

And

Article 9(2)(h) “processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;”

5) Recipient or categories of recipients of the shared data

The data will be shared with NHS England according to directions which can be found at https://digital.nhs.uk/article/8059/NHS-England-Directions-

6) Rights to object

You have the right to object to some or all of the information being shared with NHS England. Contact the Data Controller.

7) Right to access and correct

You have the right to access the data that is being shared and have any inaccuracies corrected. There is no right to have accurate medical records deleted except when ordered by a court of Law.

8) Retention period

The data will be retained for active use during the processing and thereafter according to NHS Policies and the law.

9) Right to Complain.

You have the right to complain to the Information Commissioner’s Office, you can use this link https://ico.org.uk/global/contact-us/

or calling their helpline Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate)

There are National Offices for Scotland, Northern Ireland and Wales, (see ICO website)

Please note the National Data Opt Out does not apply to this sharing of information. For further information please see: https://www.nhs.uk/your-nhs-data-matters/

Date created: 24.09.2024

This privacy notice lets you know what happens to any personal data that you give to us, or any that we may collect from or about you.

This privacy notice applies to personal information processed by or on behalf of the practice.

This Notice explains

Who we are, how we use your information and our Data Protection Officer
What kinds of personal information about you do we process?
What are the legal grounds for our processing of your personal information (including when we share it with others)?
What should you do if your personal information changes?
For how long your personal information is retained by us?
What are your rights under data protection laws?

The General Data Protection Regulation (GDPR) became law on 24th May 2016. This is a single EU-wide regulation on the protection of confidential and sensitive information. It came into force in the UK on the 25th May 2018, repealing the Data Protection Act (1998).

For the purpose of applicable data protection legislation (including but not limited to the General Data Protection Regulation (Regulation (EU) 2016/679) (the “GDPR”), and the Data Protection Act 2018 (currently in Bill format before Parliament) the practice responsible for your personal data.

This Notice describes how we collect, use and process your personal data, and how, in doing so, we comply with our legal obligations to you. Your privacy is important to us, and we are committed to protecting and safeguarding your data privacy rights

How we use your information and the law.

The practice will be what’s known as the ‘Controller’ of the personal data you provide to us.

We collect basic personal data about you which does not include any special types of information or location-based information. This does however include name, address, contact details such as email and mobile number etc.

We will also collect sensitive confidential data known as “special category personal data”, in the form of health information, religious belief (if required in a healthcare setting) ethnicity, and sex during the services we provide to you and or linked to your healthcare through other health providers or third parties.

Why do we need your information?

The health care professionals who provide you with care maintain records about your health and any treatment or care you have received previously (e.g. NHS Trust, GP Surgery, Walk-in clinic, etc.). These records help to provide you with the best possible healthcare.

NHS health records may be electronic, on paper or a mixture of both, and we use a combination of working practices and technology to ensure that your information is kept confidential and secure. Records which the Practice hold about you may include the following information;

Details about you, such as your address, carer, legal representative, emergency contact details
Any contact the surgery has had with you, such as appointments, clinic visits, emergency appointments, etc.
Notes and reports about your health
Details about your treatment and care
Results of investigations such as laboratory tests, x-rays etc
Relevant information from other health professionals, relatives or those who care for you

To ensure you receive the best possible care, your records are used to facilitate the care you receive. Information held about you may be used to help protect the health of the public and to help us manage the NHS. Information may be used within the GP practice for clinical audit to monitor the quality of the service provided.

How do we lawfully use your data?

We need to know your personal, sensitive and confidential data in order to provide you with Healthcare services as a General Practice, under the General Data Protection Regulation we will be lawfully using your information in accordance with: –

Article 6, e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;”

Article 9, (h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems

This Privacy Notice applies to the personal data of our patients and the data you have given us about your carers/family members.

Risk Stratification

Risk stratification data tools are increasingly being used in the NHS to help determine a person’s risk of suffering a condition, preventing an unplanned or (re)admission and identifying a need for preventive intervention. Information about you is collected from a number of sources including NHS Trusts and from this GP Practice. A risk score is then arrived at through an analysis of your de-identified information is only provided back to your GP as data controller in an identifiable form. Risk stratification enables your GP to focus on preventing ill health and not just the treatment of sickness. If necessary, your GP may be able to offer you additional services. Please note that you have the right to opt out of your data being used in this way.

Medicines Management

The Practice may conduct Medicines Management Reviews of medications prescribed to its patients. This service performs a review of prescribed medications to ensure patients receive the most appropriate, up to date and cost-effective treatments.

How do we maintain the confidentiality of your records?

We are committed to protecting your privacy and will only use information collected lawfully in accordance with:

Data Protection Act 2018
The General Data Protection Regulations 2016
Human Rights Act 1998
Common Law Duty of Confidentiality
Health and Social Care Act 2012
NHS Codes of Confidentiality, Information Security and Records Management
Information: To Share or Not to Share Review

Every member of staff who works for an NHS organisation has a legal obligation to keep information about you confidential.

We will only ever use or pass on information about you if others involved in your care have a genuine need for it. We will not disclose your information to any third party without your permission unless there are exceptional circumstances (i.e. life or death situations), where the law requires information to be passed on and / or in accordance with the information sharing principle following Dame Fiona Caldicott’s information sharing review (Information to share or not to share) where “The duty to share information can be as important as the duty to protect patient confidentiality.” This means that health and social care professionals should have the confidence to share information in the best interests of their patients within the framework set out by the Caldicott principles.

Our practice policy is to respect the privacy of our patients, their families and our staff and to maintain compliance with the General Data Protection Regulations (GDPR) and all UK specific Data Protection Requirements. Our policy is to ensure all personal data related to our patients will be protected.

All employees and sub-contractors engaged by our practice are asked to sign a confidentiality agreement. The practice will, if required, sign a separate confidentiality agreement if the client deems it necessary. If a sub-contractor acts as a data processor for the practice an appropriate contract (art 24-28) will be established for the processing of your information.

In Certain circumstances you may have the right to withdraw your consent to the processing of data. Please contact the Data Protection Officer in writing if you wish to withdraw your consent. If some circumstances we may need to store your data after your consent has been withdrawn to comply with a legislative requirement.

Some of this information will be held centrally and used for statistical purposes. Where we do this, we take strict measures to ensure that individual patients cannot be identified. Sometimes your information may be requested to be used for research purposes – the surgery will always gain your consent before releasing the information for this purpose in an identifiable format. In some circumstances you can Opt-out of the surgery sharing any of your information for research purposes.

With your consent we would also like to use your information to

We would however like to use your name, contact details and email address to inform you of services that may benefit you, with your consent only. There may be occasions were authorised research facilities would like you to take part on innovations, research, improving services or identifying trends.

At any stage where we would like to use your data for anything other than the specified purposes and where there is no lawful requirement for us to share or process your data, we will ensure that you have the ability to consent and opt out prior to any data processing taking place. This information is not shared with third parties or used for any marketing and you can unsubscribe at any time via phone, email or by informing the practice DPO as below.

Where do we store your information Electronically?

All the personal data we process is processed by our staff in the UK however for the purposes of IT hosting and maintenance this information may be located on servers within the European Union.

No 3rd parties have access to your personal data unless the law allows them to do so and appropriate safeguards have been put in place. We have a Data Protection regime in place to oversee the effective and secure processing of your personal and or special category (sensitive, confidential) data.

Who are our partner organisations?

We may also have to share your information, subject to strict agreements on how it will be used, with the following organisations;

NHS Trusts / Foundation Trusts
GP’s
eMBED Health
Independent Contractors such as dentists, opticians, pharmacists
Private Sector Providers
Voluntary Sector Providers
Ambulance Trusts
Clinical Commissioning Groups
Social Care Services
NHS England (NHSE) and NHS Digital (NHSD)
Local Authorities
Education Services
Fire and Rescue Services
Police & Judicial Services
Voluntary Sector Providers
Private Sector Providers
Other ‘data processors’ which you will be informed of

You will be informed who your data will be shared with and in some cases asked for consent for this to happen when this is required.

We may also use external companies to process personal information, such as for archiving purposes. These companies are bound by contractual agreements to ensure information is kept confidential and secure. All employees and sub-contractors engaged by our practice are asked to sign a confidentiality agreement. If a sub-contractor acts as a data processor for the practice an appropriate contract (art 24-28) will be established for the processing of your information.

How long will we store your information?

We are required under UK law to keep your information and data for the full retention periods as specified by the NHS Records management code of practice for health and social care and national archives requirements. More information on records retention can be found online at (https://digital.nhs.uk/article/1202/Records-Management-Code-of-Practice-for-Health-and-Social-Care-2016)

How can you access, amend move the personal data that you have given to us?

Even if we already hold your personal data, you still have various rights in relation to it. To get in touch about these, please contact us. We will seek to deal with your request without undue delay, and in any event in accordance with the requirements of any applicable laws. Please note that we may keep a record of your communications to help us resolve any issues which you raise.

Right to object: If we are using your data because we deem it necessary for our legitimate interests to do so, and you do not agree, you have the right to object. We will respond to your request within 30 days (although we may be allowed to extend this period in certain cases). Generally, we will only disagree with you if certain limited conditions apply.

Right to withdraw consent: Where we have obtained your consent to process your personal data for certain activities (for example for a research project), or consent to market to you, you may withdraw your consent at any time.

Right to erasure: In certain situations (for example, where we have processed your data unlawfully), you have the right to request us to “erase” your personal data. We will respond to your request within 30 days (although we may be allowed to extend this period in certain cases) and will only disagree with you if certain limited conditions apply. If we do agree to your request, we will Delete your data but will generally assume that you would prefer us to keep a note of your name on our register of individuals who would prefer not to be contacted. That way, we will minimise the chances of you being contacted in the future where your data are collected in unconnected circumstances. If you would prefer us not to do this, you are free to say so.

Right of data portability: If you wish, you have the right to transfer your data from us to another data controller. We will help with this with a GP to GP data transfer and transfer of your hard copy notes

Access to your personal information

Data Subject Access Requests (DSAR): You have a right under the Data Protection legislation to request access to view or to obtain copies of what information the surgery holds about you and to have it amended should it be inaccurate. To request this, you need to do the following:

Your request should be made to the Practice – for information from the hospital you should write direct to them
There is no charge to have a copy of the information held about you
We are required to respond to you within one month
You will need to give adequate information (for example full name, address, date of birth, NHS number and details of your request) so that your identity can be verified, and your records located information we hold about you at any time.

What should you do if your personal information changes?

You should tell us so that we can update our records please contact the Practice Manager as soon as any of your details change, this is especially important for changes of address or contact details (such as your mobile phone number), the practice will from time to time ask you to confirm that the information we currently hold is accurate and up-to-date.

This Policy is about what happens to the information that the Practice collects about you whenever you come to see us. It also tells you how we make sure it is kept safe.

What do we collect?

We collect information about you such as:

Your name
Why you are coming to see us
Your birthday and the year you were born
Your address
The name of the person who will generally bring you to your appointments
The reason that you are coming to see us
Detailed clinical information/experiences about you
What we do to care for you

Why do we collect it?

The Practices main purpose is to deliver healthcare to the community. We collect the data we need to care for you in the best way. We ask for your address so that we know where we can contact you. We ask for your date of birth as your age may be important to your care.

Each time you come to see us we will record things electronically that you tell us, things that we tell you and any medicines or exercises we give you. That way, we can look back at what we have done for you to make sure we are treating you in the best way.

What do we do with it?

We keep the information we collect electronically and on paper. All of this information together is called your Health Record and will be held on our secure system.

Anyone involved in caring for you at the Practice can see what has been collected. This way we can all make the right decisions about your care with all the information you have given us.

Who we share it with

We will share the information we record about you where it is clinically appropriate and will benefit your care and treatment. That way key people involved in your care are kept up to date on what we are doing for you.

If you tell us something that makes us worried about your safety or the safety of someone else you know, we might have to share this with other people outside of the Practice – even if you don’t want us to. This is part of our job to keep you and others safe.

Keeping your records safe

Everyone working in the Practice understands that they need to keep your information safe. This is called keeping your information confidential or protecting your privacy. They have training every year to remind them of this. We tell them that they are only allowed to look at your information if they are involved in your care or required to support your care, for example by booking an appointment for you. They understand that they must keep any information safe, especially the information that identifies you; this might be your name or address and anything you come to see us about. We are not allowed to give any of this type of information to anyone who shouldn’t see it. This includes talking to them about it.

We teach future Doctors and Nurses

Students sometimes spend time with us at the Practice. This is so that we can teach them how to look after patients and their families. They are also told how to keep the information we collect safe.

Checking we are doing our best

All Practices are checked by organizations to make sure they are treating and caring for patients and families in the best way they can. They also ensure that we are keeping records safe and secure.

Am I able to see the information you collect about me?

Yes! You can request this directly from the Practice. We will check you are who you say are so that we are not sharing your information with anyone who shouldn’t see it.

If I think some of my information is wrong, can I do anything about it?

Yes! You can contact any member of the Practice who will speak to our Data Protection Officer. We may need to contact you further to discuss this.

If I’m unhappy with the way you’ve used some of my information, can I do anything?

Let us know if your still unhappy you can contact the Information Commissioners Office at the below address

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Tel: 01625 545745

Email: https://ico.org.uk/

We hope this leaflet tells you what you need to know about the information we collect about you.

Caldicott Guardian and Data Protection Officer

The Caldicott Guardian and the Data Protection Officer for the Practice are responsible for ensuring that information about you is processed in a confidential, legal and appropriate manner.

If you have any concerns about the use of your information you can contact these individuals at the address below:

Data Protection Officer

Umar Sabat – dpo.swl@nhs.net

Privacy Policy – Easy Read Version		Reviewed on	24/09/2024
Privacy Policy – Easy Read Version		Revised by	Umar – Protection Officer
Adopted	24/09/2024	Next review due	24/09/2026

Data Protection Privacy Notice for Patients

Introduction

For the purpose of applicable data protection legislation including the General Data Protection Regulation (EU 2016/679) and the Data Protection Act 2018, the GP practice responsible for your personal data is Central Surgery.

We, Central Surgery, will be known as the ‘Controller’ of the personal data you provide to us.

Your privacy is important to us, and we are committed to protecting and safeguarding your data privacy rights.

This Privacy Notice applies to personal information processed by or on behalf of the Practice. It applies to the personal data of our patients and to the data you have given us about your carers/family members. It covers the following topics:

Why do we need your data?
What data do we collect about you?
What is the legal basis for using your data?
How do we store your data?
How do we maintain the confidentiality of your data?
How long do we keep your data?
What are your data protection rights?
Who do we share your data with?
Are there other projects where your data may be shared?
When is your consent not required?
How can you access or change your data?
What should you do if your personal information changes?
Changes to our privacy policy
Our Data Protection Officer
How to contact the appropriate authorities

Why do we need your data?

As your General Practice, we need to know your personal, sensitive and confidential data in order to provide you with appropriate healthcare services. Your records are used to facilitate the care you receive, and to ensure you receive the best possible healthcare.

Information may be used within the GP practice for clinical audit, to monitor the quality of the service provided.

What data do we collect about you?

Personal data: We collect basic personal data about you which does not include any special types of information or location-based information. This includes your name, postal address and contact details such as email address and telephone number.

By providing the Practice with your contact details, you are agreeing to the Practice using those channels to communicate with you about your healthcare, i.e. by letter (postal address), by voice-mail or voice-message (telephone or mobile number), by text message (mobile number) or by email (email address). If you are unhappy or have a concern about our using any of the above channels, please let us know.

Special Category personal data: We also collect confidential data linked to your healthcare which is known as “special category personal data”, in the form of health information, religious belief (if required in a healthcare context) ethnicity and gender. This is obtained during the services we provide to you and through other health providers or third parties who have provided you with treatment or care, e.g. NHS Trusts, other GP surgeries, Walk-in clinics etc.

Records which the Practice holds about you may include the following information:

Details about you, such as your address, carer, legal representative, emergency contact details
Any contact the Practice has had with you, such as appointments, clinic visits, emergency appointments etc.
Notes and reports about your health
Details about your treatment and care
Results of investigations such as laboratory tests, x-rays etc
Relevant information from other health professionals, relatives or those who care for you

NHS records may be electronic, on paper, or a mixture of both.

Use of CCTV: Closed circuit television is utilised to protect the safety of our patients, staff and members of the public. To maintain privacy and dignity, CCTV is not in place where examinations or procedures are being undertaken. The Practice remains the data controller of this data and any disclosures or requests should be made to the Practice Manager.

What is the legal basis for using your data?

We are committed to protecting your privacy and will only use information collected lawfully in accordance with:

Data Protection Act 2018
The General Data Protection Regulations 2016
Human Rights Act 1998
Common Law Duty of Confidentiality
Health and Social Care Act 2012
NHS Codes of Confidentiality, Information Security and Records Management

Under the General Data Protection Regulation, we will lawfully be using your information in accordance with:

Article 6 (e) – “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”

Article 9 (h) – “processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems”

For the processing of special categories data, the basis is:

Article 9 (2) (b) – “processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law”

These articles apply to the processing of information and the sharing of it with others for specific purposes.

How do we store your data?

We have a Data Protection regime in place to oversee the effective and secure processing of your personal and special category (sensitive, confidential) data. No third parties have access to your personal data unless the law allows them to do so, and appropriate safeguards have been put in place.

In certain circumstances you may have the right to withdraw your consent to the processing of data. These circumstances will be explained in subsequent sections of this document.

In some circumstances we may need to store your data after your consent has been withdrawn, in order to comply with a legislative requirement.

How do we maintain the confidentiality of your data?

Our Practice policy is to respect the privacy of our patients, their families and our staff and to maintain compliance with the General Data Protection Regulations (GDPR) and all UK specific Data Protection requirements. Our policy is to ensure all personal data related to our patients will be protected.

We use a combination of working practices and technology to ensure that your information is kept confidential and secure.

Every member of staff who works for an NHS organisation has a legal obligation to keep information about you confidential.

All employees and sub-contractors engaged by our Practice are asked to sign a confidentiality agreement. The Practice will, if required, sign a separate confidentiality agreement if the client deems it necessary. If a sub-contractor acts as a data processor for Sherwood House Medical Practice an appropriate contract will be established for the processing of your information.

Some of this information will be held centrally and used for statistical purposes. Where this happens, we take strict measures to ensure that individual patients cannot be identified.

Sometimes your information may be requested to be used for research purposes. The Practice will always gain your consent before releasing the information for this purpose in an identifiable format. In some circumstances you can Opt-out of the Practice sharing any of your information for research purposes.

How long do we keep your data?

We are required under UK law to keep your information and data for the full retention periods as specified by the NHS Records Management Code of Practice for Health and Social Care and in accordance with National Archives requirements.

More information on records retention can be found online at: Records Management Code of Practice – NHS Transformation Directorate (england.nhs.uk)

What are your data protection rights?

If we already hold your personal data, you have certain rights in relation to it.

Right to object: If we are using your data because we deem it necessary for our legitimate interests to do so, and you do not agree, you have the right to object. We will respond to your request within 30 days (although we may be allowed to extend this period in certain cases). Generally, we will only disagree with you if certain limited conditions apply.

Right to withdraw consent: Where we have obtained your consent to process your personal data for certain activities (for example a research project), or consent to market to you, you may withdraw your consent at any time.

Right to erasure: In certain situations (for example, where we have processed your data unlawfully), you have the right to request us to erase your personal data. We will respond to your request within 30 days (although we may be allowed to extend this period in certain cases) and will only disagree with you if certain limited conditions apply.

Right of data portability: If you wish, you have the right to transfer your data from us to another data controller. We will help with this with a GP-to-GP data transfer and transfer of your hard copy notes.

National Data Opt-Out: The National Data Opt-Out is a service introduced on 25 May 2018 that allows people to opt out of their confidential patient information being used for research and planning purposes. The National Data Opt-Out replaces the previous Type 2 Opt-Out, which required NHS England not to share a patient’s confidential patient information for purposes beyond their individual care. Any patient who had a Type 2 Opt-Out has had it automatically converted to a National Data Opt-Out from 25 May 2018 and has received a letter giving them more information and a leaflet explaining the new service. If a patient wants to change their choice, they can use the new service to do this. You can find out more from the Practice or by visiting:

https://www.nhs.uk/your-nhs-data-matters/

If you wish to raise a query or request relating to any of the above, please contact us. We will seek to deal with it without undue delay, and in any event in accordance with the requirements of any applicable laws. Please note that we may keep a record of your communications to help us resolve any issues which you raise.

Who do we share your data with?

We consider patient consent as being the key factor in dealing with your health information.

To provide around-the-clock safe care, we will make information available to trusted organisations for specific purposes unless you have asked us not to. We refer to these organisations to Data Processors.

To support your care and improve the sharing of relevant information to our partner organisations when they are involved in looking after you, we will share information to other systems. The general principle is that information is passed to these systems unless you request that this does not happen, but that system users should ask for your consent before viewing your record.

Our partner organisations are:

NHS Trusts / Foundation Trusts
GPs
NHS Commissioning Support Units
Independent Contractors such as dentists, opticians, pharmacists
Private Sector Providers
Voluntary Sector Providers
Ambulance Trusts
Clinical Commissioning Groups
Social Care Services
NHS England (NHSE) and NHS Digital (NHSD)
Multi Agency Safeguarding Hub (MASH)
Local Authorities
Education Services
Fire and Rescue Services
Police and Judicial Services
Voluntary Sector Providers
Private Sector Providers
Other ‘data processors’ which you will be informed of

You will be informed who your data will be shared with, and in cases where your consent is required you will be asked for it.

Below are some examples of when we would wish to share your information with trusted partners.

Primary Care Networks: We have formed a Primary Care Network. This means we work closely with a number of local practices and care organisations for the purpose of direct patient care. They will only be allowed to access your information if it is to support your healthcare needs. If you have any concerns about how your information may be accessed within our primary care network, we would encourage you to speak or write to us.

Extended Access: We provide extended access services to our patients which means you can access medical services outside of our normal working hours. In order to provide you with this service, we have formal arrangements in place with the Clinical Commissioning Group and with other practices whereby certain key “hub” practices offer this service on our behalf for you as a patient to access outside our opening hours. Those key “hub” practices will need to have access to your medical record to be able to offer you the service. We have robust data sharing agreements and other clear arrangements in place to ensure your data is always protected and used for those purposes only.

Medicines Management: The Practice may conduct Medicines Management Reviews of medications prescribed to its patients. This service performs a review of prescribed medications to ensure patients receive the most appropriate, up-to-date and cost-effective treatments. Our local NHS Clinical Commissioning Group employs specialist pharmacists, and they may at times need to access your records to support and assist us with prescribing. This reason for this is to help us manage your care and treatment.

Individual Funding Requests: An Individual Funding Request is a request made on your behalf, with your consent, by a clinician, for the funding of specialised healthcare which falls outside the range of services and treatments that CCG has agreed to commission for the local population. An Individual Funding Request is considered when a case can be set out by a patient’s clinician that there are exceptional clinical circumstances which make the patient’s case different from other patients with the same condition who are at the same stage of their disease, or when the request is for a treatment that is regarded as new or experimental and where there are no other similar patients who would benefit from this treatment. A detailed response, including the criteria considered in arriving at the decision, will be provided to the patient’s clinician.

Are there other projects where your data may be shared?

Local Research: We regularly work with local health and academic organisations to conduct research studies with the aim of improving care for the general population. We will always ask for your permission to take part, except in situations where we can demonstrate that your information has been anonymised (where you cannot be identified) and your privacy is protected. In these situations we are not required to seek consent from individuals.

Risk Stratification: Risk stratification data tools are increasingly being used in the NHS to help determine a person’s risk of suffering a condition, preventing an unplanned admission or re-admission and identifying a need for preventive intervention. Information about you is collected from a number of sources including NHS Trusts and from this GP practice. A risk score arrived at through an analysis of your de-identified information is provided back to your GP practice as data controller in an identifiable form. Risk stratification enables your GP to focus on preventing ill health and not just the treatment of sickness. If necessary, your GP may be able to offer you additional services. Please note that you have the right to opt out of your data being used in this way.

Other research projects: With your consent we would also like to use your name, contact details and email address to inform you of services that may benefit you. There may be occasions when authorised research facilities would like to invite you to participate in research, innovations, identifying trends or improving services. At any stage where we would like to use your data for anything other than the specified purposes and where there is no lawful requirement for us to share or process your data, we will ensure that you have the ability to consent or to opt out prior to any data processing taking place. This information is not shared with third parties or used for any marketing and you can unsubscribe at any time via phone, email or by informing the Practice.

When is your consent not required?

We will only ever use or pass on information about you to others involved in your care if they have a genuine need for it. We will not disclose your information to any third party without your permission unless there are exceptional circumstances.

There are certain circumstances where we are required by law to disclose information, for example:

where there is a serious risk of harm or abuse to you or other people
where a serious crime, such as assault, is being investigated or where it could be prevented
notification of new births
where we encounter infectious diseases that may endanger the safety of others, such as meningitis or measles (but not HIV/AIDS)
where a formal court order has been issued
where there is a legal requirement, for example if you had committed a Road Traffic Offence

We are also required to act in accordance with Principle 7 of the Caldicott Review (Revised version 2013) which states: “The duty to share information can be as important as the duty to protect patient confidentiality.” This means that health and social care professionals should have the confidence to share information in the best interests of their patients within the framework set out by the Caldicott Principles.

How can you access or change your data?

You have a right under the Data Protection legislation to request access to view or to obtain copies of the information the Practice holds about you and to have it amended should it be inaccurate.

Your request should be made to the Practice and we have a form (SAR – Subject Access Request) which you will need to complete. We are required to respond to you within one calendar month.

For information from the hospital you should write direct to them. You will need to give adequate information (full name, address, date of birth, NHS number and details of your request) so that your identity can be verified and your records located.

There is no charge to receive a copy of the information held about you.

What should you do if your personal information changes?

Please contact the Practice Manager as soon as any of your details change. This is especially important for changes of address or contact details (such as your mobile phone number).

The Practice will from time to time ask you to confirm that the information we currently hold is accurate and up-to-date.

Changes to our privacy policy

It is important to point out that we may amend this Privacy Notice from time to time.

Our Data Protection Officer

The Practice has appointed Umar Sabat as its Data Protection Officer.

He can be contacted on the following e-mail address: dpo.swl@nhs.net

If you have any concerns about how your data is shared, or if you would like to know more about your rights in respect of the personal data we hold about you, then please contact the Practice Data Protection Officer.

How to contact the appropriate authorities

If you have any concerns about how your information is managed at your GP Practice, please contact the GP Practice Manager or the Data Protection Officer in the first instance.

If you are still unhappy following a review by the GP Practice, you have a right to lodge a complaint with the UK supervisory authority, the Information Commissioner’s Office (ICO), at the following address:

Information Commissioner

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Tel: 01625 545745

Email: https://ico.org.uk/

Public Health (UKHSA) Privacy Notice

Public health encompasses everything from national smoking and alcohol policies, the management of epidemics such as flu, the control of large scale infections such as TB and Hepatitis B to local outbreaks of food poisoning or Measles. Certain illnesses are also notifiable; the doctors treating the patient are required by law to inform the Public Health Authorities, for instance Scarlet Fever. This will necessarily mean the subjects personal and health information being shared with the Public Health organisations. In the UK this is shared with UK Health Security Agency Some of the relevant legislation includes: the Health Protection (Notification) Regulations 2010 (SI 2010/659), the Health Protection (Local Authority Powers) Regulations 2010 (SI 2010/657), the Health Protection (Part 2A Orders) Regulations 2010 (SI 2010/658), Public Health (Control of Disease) Act 1984, Public Health (Infectious Diseases) Regulations 1988 and The Health Service (Control of Patient Information) Regulations 2002
1) Data Controller contact details	Central Surgery Surbiton Health Centre Ewell Rd Surbiton KT6 6EZ
2) Data Protection Officer contact details	Umar Sabat Dpo.swl@nhs.net
3) Purpose of the processing	There are occasions when medical data needs to be shared with UK Health Security Agency, the Local Authority Director of Public Health, or the Health Protection Agency, either under a legal obligation or for reasons of public interest or their equivalents in the devolved nations.
4) Lawful basis for processing	The legal basis will be Article 6(1)(c) “processing is necessary for compliance with a legal obligation to which the controller is subject.” And Article 9(2)(i) “processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices,..”
5) Recipient or categories of recipients of the shared data	The data will be shared with UK Health Security Agency UK Health Security Agency – GOV.UK (www.gov.uk) and equivalents in the devolved nations.
6) Rights to object	You have the right to object to some or all the information being shared with the recipients. Please contact the Data Controller.
7) Right to access and correct	You have the right to access the data that is being shared and have any inaccuracies corrected. There is no right to have accurate medical records deleted except when ordered by a court of Law.
8) Retention period	The data will be retained for active use during the period of the public interest and according to legal requirement.
9) Right to Complain.	You have the right to complain to the Information Commissioner’s Office, you can use this link https://ico.org.uk/global/contact-us/ or calling their helpline Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate) There are National Offices for Scotland, Northern Ireland and Wales, (see ICO website)

Please note the National Data Opt Out does not apply to this sharing of information. For further information please see: https://www.nhs.uk/your-nhs-data-matters/

Date created: 24.09.2024

Sharing Your Medical Records

Increasingly, patient medical data is shared e.g. between GP surgeries and District Nursing, in order to give clinicians access to the most up to date information when attending patients.

The systems we operate require that any sharing of medical information is consented to by patients beforehand. Patients must consent to sharing of the data held by a health provider out to other health providers and must also consent to which of the other providers can access their data.

e.g. it may be necessary to share data held in GP practices with district nurses but the local podiatry department would not need to see it to undertake their work. In this case, patients would allow the surgery to share their data, they would allow the district nurses to access it but they would not allow access by the podiatry department. In this way access to patient data is under patients’ control and can be shared on a ‘need to know’ basis.

Violence Policy

The NHS operate a zero tolerance policy with regard to violence and abuse and the Practice has the right to remove violent patients from the list with immediate effect in order to safeguard practice staff, patients and other stakeholders. Violence in this context includes actual or threatened physical violence or verbal abuse which leads to fear for a person’s safety. In this situation we will notify the patient in writing of their removal from the list and record in the patient’s medical records the fact of the removal and the circumstances leading to it.

About Our Surgery

Practice Policies & Patient Information

Data Protection Privacy Notice for Patients

Help us improve our website content. How helpful did you find this page?

Thank you for your feedback.