Privacy policy – Treeton Medical Centre

Covid-19 Privacy Addendum

Data Protection Privacy Notice

INTRODUCTION

This privacy notice lets you know what happens to any personal data that you give to us, or any that we may collect from or about you.

This privacy notice applies to personal information processed by or on behalf of the practice.

This Notice explains

Who we are, how we use your information and our Data Protection Officer
What kinds of personal information about you do we process?
What are the legal grounds for our processing of your personal information (including when we share it with others)?
What should you do if your personal information changes?
For how long your personal information is retained by us?
What are your rights under data protection laws?

In accordance with the applicable data protection legislation in the UK (The Data Protection Act 2018 and the UK General Data Protection Regulation (UKGDPR)) the practice responsible for your personal data is Treeton Medical Centre.

This Notice describes how we collect, use and process your personal data, and how, in doing so, we comply with our legal obligations to you. Your privacy is important to us, and we are committed to protecting and safeguarding your data privacy rights

HOW WE USE YOUR INFORMATION AND THE LAW

Treeton Medical Centre is known as the ‘Controller’ of the personal data you provide to us.

We will collect basic personal data about you which includes name, address, date of birth and contact details such as email and mobile number etc.

We will also collect sensitive confidential data known as “special category personal data”, in the form of health information, religious belief (if required in a healthcare setting) ethnicity, and sexual orientation through the delivery of services we provide to you and/or linked to your healthcare through other health providers or third parties.

WHY DO WE NEED YOUR INFORMATION?

The health care professionals who provide you with care maintain records about your health and any treatment or care you have received previously (e.g. NHS Trust, GP Surgery, Walk-in clinic, etc.). These records help to provide you with the best possible healthcare.

NHS health records may be electronic, on paper or a mixture of both, and we use a combination of working practices and technology to ensure that your information is kept confidential and secure. Records which the Practice hold about you may include the following information:

Details about you, such as your address, carer, legal representative, emergency contact details
Any contact the surgery has had with you, such as appointments, clinic visits, emergency appointments, etc.
Notes and reports about your health
Details about your treatment and care
Results of investigations such as laboratory tests, x-rays etc
Relevant information from other health professionals, relatives or those who care for you

To ensure you receive the best possible care, your records are used to facilitate the care you receive. Information held about you may be used to help protect the health of the public and to help us manage the NHS. Information may be used within the GP practice for clinical audit to monitor the quality of the service provided.

HOW DO WE LAWFULLY USE YOUR DATA?

We need to know your personal, sensitive and confidential data in order to provide you with Healthcare services as a General Practice, under the UK General Data Protection Regulation we will be lawfully using your information in accordance with:

Article 6, e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;”

Article 9, (h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems

This Privacy Notice applies to the personal data of our patients and the data you have given us about your carers/family members.

Risk Stratification

Risk stratification data tools are increasingly being used in the NHS to help determine a person’s risk of suffering a condition, preventing an unplanned or (re)admission and identifying a need for preventive intervention. Information about you is collected from several sources including NHS Trusts and from this GP Practice.

A risk score is then arrived at through an analysis of your de-identified information is only provided back to your GP as data controller in an identifiable form. Risk stratification enables your GP to focus on preventing ill health and not just the treatment of sickness. If necessary, your GP may be able to offer you additional services. Please note that you have the right to opt out of your data being used in this way – please see the section on Your Rights below.

Medicines Management

The Practice may conduct Medicines Management reviews of medications prescribed to its patients under a processing arrangement with the Medicines Management Team at South Yorkshire Integrated Care Board (SYICB). This service performs a review of prescribed medications to ensure patients receive the most appropriate, up to date and cost-effective treatments.

The Rotherham Health Record

Treeton Medical Centre has access to and shares information with the Rotherham Health Record.

The Rotherham Health Record is an electronic system for sharing your health and care information in a secure way with health and care staff who provide care directly to you. When you receive care in a number of places in Rotherham, such as the hospital or your GP Practice, your information is stored on different computer systems. The Rotherham Health Record enables health and care professionals to access, in one place, information held in these different systems in order to deliver better care and decisions to plan and deliver your care effectively. It is a read-only system which allows health and care professionals a view of information contained in other computer systems, it does not hold any clinical patient information within it.

The Rotherham Health Record is a partnership supported by South Yorkshire Integrated Care Board (SYICB), The Rotherham NHS Foundation Trust, Rotherham Doncaster and South Humber NHS Foundation Trust, Rotherham Metropolitan Borough Council, Rotherham Hospice and GP Practices within the Rotherham area. All partners are signatories to the Rotherham Health Record Information Sharing Agreement which provides partner agencies with a robust foundation for the lawful, secure and confidential sharing of personal information.

Each partner has a legal duty to protect your personal information and will remain sole data controller of its own data. We all take confidentiality very seriously and are committed to ensuring all personal information within the Rotherham Health Record is managed in accordance with the relevant legislation to ensure your information is safe, secure and confidential.

Information available to view within The Rotherham Health Record includes information such as name, address, date of birth, medications, allergies, dates and reasons for hospital admissions, appointments, test results, correspondence and referrals and emergency contact details. It does not include sensitive information, such as your sexual health history

You can opt out of having your information shared through the Rotherham Health Record at any time. If you would like to optout, please use one of the following options:

Email: rotherhamhealthrecord@nhs.net
Ring 01709 427299
Write to:

Rotherham Health Record Consent
Subject Access Request Team
Rotherham Hospital
Moorgate Road
Rotherham
S60 2UD

GP Connect

We use a facility called GP Connect to support your direct care. GP Connect makes patient information available to all appropriate clinicians when and where they need it, to support direct patients care, leading to improvements in both care and outcomes. GP Connect is not used for any purpose other than direct care.

Authorised Clinicians such as GPs, NHS 111 Clinicians, Care Home Nurses (if you are in a Care Home), Secondary Care Trusts, Social Care Clinicians are able to access the GP records of the patients they are treating via a secure NHS Digital service called GP connect.

The NHS 111 service (and other services determined locally e.g. other GP practices in a Primary Care Network) will be able to book appointments for patients at GP practices and other local services.

Find out more about GP Connect here

Summary Care Records

All patients registered with a GP have a Summary Care Record unless they have chosen not to have one. The information held in your Summary Care Record gives registered and regulated healthcare professionals, away from your usual GP practice, access to information to provide you with safer care, reduce the risk of prescribing errors and improve your patient experience.

Your Summary Care Record contains basic (Core) information about allergies and medications and any reactions that you have had to medication in the past.

Some patients, including many with long term health conditions, previously have agreed to have Additional Information shared as part of their Summary Care Record. This Additional Information includes information about significant medical history (past and present), reasons for medications, care plan information and immunisations.

During the height of the Covid 19 pandemic changes were made to the Summary Care Record (SCR) to make additional patient information available to all appropriate clinicians when and where they needed it, to support direct patients care, leading to improvements in both care and outcomes.

These changes to the SCR will remain in place, unless you decide otherwise.

Regardless of your past decisions about your Summary Care Record preferences, you will still have the same options that you currently have in place to opt out of having a Summary Care Record, including the opportunity to opt-back in to having a Summary Care Record or opt back in to allow sharing of Additional Information.

You can exercise these choices by doing the following:

Choose to have a Summary Care Record with all information shared. This means that any authorised, registered and regulated health and care professionals will be able to see a detailed Summary Care Record, including Core and Additional Information, if they need to provide you with direct care.
Choose to have a Summary Care Record with Core information only. This means that any authorised, registered and regulated health and care professionals will be able to see limited information about allergies and medications in your Summary Care Record if they need to provide you with direct care.
Choose to opt-out of having a Summary Care Record altogether. This means that you do not want any information shared with other authorised, registered and regulated health and care professionals involved in your direct care. You will not be able to change this preference at the time if you require direct care away from your GP practice. This means that no authorised, registered and regulated health and care professionals will be able to see information held in your GP records if they need to provide you with direct care, including in an emergency.

To make these changes, please let us know or complete this form and return it to the Practice.

Patient Communications

If you have provided us with a mobile phone number, we will record your consent to allow us to use it for sending SMS (text) messages to you on that number in addition to calls.

If you have provided us with an email address, we will record your consent to allow us to use it for sending email messages to you at that address.

Patients have the right to provide us with their mobile number in order to enable an alternative number by which to contact them, without allowing SMS messages to be sent (i.e. “mobile phone calls only”). Please let us know if you do not wish to receive SMS messages or you would like us to remove your email address from your GP record.

The majority of SMS messages are automatically generated to remind patients of forthcoming surgery appointments that they have booked. SMS can also be used to convey test results or to ask you to get in contact with us. Other uses include inviting eligible patients to attend for flu clinics or annual reviews (e.g. asthma, COPD) or in emergencies when surgeries have to be cancelled at short notice. Email messages can be used for the same range of situations.

We do not use SMS messages or email messages for any form of direct marketing. All text or email messages are for direct medical care purposes only.

Telephone system

Our telephone system records all telephone calls. Recordings are retained for [1yr], and are used periodically for the purposes of seeking clarification where there may be a dispute and for staff training. Access to these recordings is restricted to named senior staff.

CCTV

CCTV is installed on our practice premises covering both the external area of the building and internal areas excluding consulting rooms. Images are held to improve the personal security of patients and staff whilst on the premises, and for the prevention and detection of crime.

The images are recorded and are overwritten on a rolling basis, every [6m]. Viewing of these digital images is controlled by the Practice Manager.

HOW YOUR INFORMATION IS SHARED SO THAT THIS PRACTICE CAN MEET LEGAL REQUIREMENTS

The law requires Treeton Medical Centre to share information from your medical records in certain circumstances. Under the UKGDPR we will be lawfully using your information in accordance with

Article 6(1)(c) – ‘processing is necessary for compliance with a legal obligation to which the controller is subject…’

Article 9(2)(h) – ‘processing is necessary for the purpose of preventative…medicine…the provision of health or social care or treatment or the management of health or social care systems and services…’

Information is shared so that the NHS or Public Health England can, for example:

plan and manage services
check that the care being provided is safe
prevent infectious diseases from spreading

We will share information with NHS Digital, the Care Quality Commission and local health protection team (or Public Health England) when the law requires us to do so. Please see below for more information.

We must also share your information if a court of law orders us to do so.

NHS Digital

NHS Digital is a national body which has legal responsibilities to collect information about health and social care services.

It collects information from across the NHS in England and provides reports on how the NHS is performing. These reports help to plan and improve services to patients.

This practice must comply with the law and will send data to NHS Digital, for example, when it is told to do so by the Secretary of State for Health or NHS England under the Health and Social Care Act 2012.

More information about NHS Digital and how it uses information can be found at:

https://digital.nhs.uk/home

For more information in relation to the proposed data sharing in support of vital health and care planning and research with NHS Digital see the GP Practice Privacy Notice for General Practice Data for Planning and Research.

Care Quality Commission (CQC)

The CQC regulates health and social care services to ensure that safe care is provided.

The law says that we must report certain serious events to the CQC, for example, when patient safety has been put at risk.

For more information about the CQC see: https://www.cqc.org.uk/

Public Health

The law requires us to share data for public health reasons, for example to prevent the spread of infectious diseases or other diseases which threaten the health of the population.
We will report the relevant information to local health protection team or Public Health England.

For more information about Public Health England and disease reporting see: https://www.gov.uk/guidance/notifiable-diseases-and-causative-organisms-how-to-report

National screening programmes

The NHS provides national screening programmes so that certain diseases can be detected at an early stage.

These screening programmes include bowel cancer, breast cancer, cervical cancer, aortic aneurysms and a diabetic eye screening service.

The law allows us to share your contact information with Public Health England so that you can be invited to the relevant screening programme. The following sections of the UK GDPR allow us to contact patients for screening.

Article 6(1)(e) – ‘processing is necessary…in the exercise of official authority vested in the controller…’’

For national screening programmes you can opt so that you no longer receive an invitation to a screening programme.

See: https://www.gov.uk/government/publications/opting-out-of-the-nhs-population-screening-programmes

More information can be found at: https://www.gov.uk/topic/population-screening-programmes or speak to the practice.

Medical Examiner Service

Following the death of any patient of Treeton Medical CEntre we are obliged to inform the Medical Examiner Service at The Rotherham NHS Foundation Trust.

Medical examiner offices at acute trusts now provide independent scrutiny of non-coronial deaths occurring in acute hospitals. The role of these offices is now being extended to also cover deaths occurring in the community.

Medical examiner offices are led by medical examiners, senior doctors from a range of specialties including general practice, who provide independent scrutiny of deaths not taken at the outset for coroner investigation. They put the bereaved at the centre of processes after the death of a patient, by giving families and next of kin an opportunity to ask questions and raise concerns. Medical examiners carry out a proportionate review of medical records, and liaise with doctors completing the Medical Certificate of Cause of Death (MCCD).

The Practice will share information with the service upon request.

OUR COMMITMENT TO DATA PRIVACY AND CONFIDENTIALITY

We are committed to protecting your privacy and will only use information collected lawfully in accordance with:

Data Protection Act 2018
The UK General Data Protection Regulation
Human Rights Act 1998
Common Law Duty of Confidentiality
Health and Social Care Act 2012
NHS Codes of Confidentiality, Information Security and Records Management

In the circumstances where we are required to use personal identifiable information, we will only do this if:

The information is necessary for your direct healthcare, or
We have received explicit consent from you to use your information for a specific purpose, or
There is an overriding public interest in using the information:
- In order to safeguard an individual,
- To prevent a serious crime or in the case of Public Health or other emergencies, to protect the health and safety of others, or
There is a legal requirement that allows or compels us to use or provide information (e.g. a formal court order or legislation), or
We have permission from the Secretary of State for Health and Social Care to use certain confidential patient identifiable information when it is necessary for our work

Everyone working for the NHS has a legal and contractual duty to keep information about you confidential.

Our practice policy is to respect the privacy of our patients, their families and our staff and to maintain compliance with the UK General Data Protection Regulation (UKGDPR) and all UK specific Data Protection requirements. Our policy is to ensure all personal data related to our patients will be protected.

All employees and sub-contractors engaged by our practice are asked to sign a confidentiality agreement. The practice will, if required, sign a separate confidentiality agreement if the client deems it necessary. If a sub-contractor acts as a data processor for Treeton Medical Centre an appropriate contract (art 24-28) will be established for the processing of your information.

Where information is held centrally and used for statistical purposes, we take strict measures to ensure that individual patients cannot be identified. Sometimes your information may be requested to be used for research purposes – the surgery will always gain your consent before releasing the information for this purpose in an identifiable format. In some circumstances you can Opt-out of the surgery sharing any of your information for research purposes – please see Your Rights section below.

WHERE YOUR CONSENT IS REQUIRED

We would like to use your name, contact details and email address to inform you of services that may benefit you, with your consent only. There may be occasions where authorised research facilities would like you to take part in innovations, research, improving services or identifying trends.

At any stage where we would like to use your data for anything other than the specified purposes and where there is no lawful requirement for us to share or process your data, we will ensure that you have the ability to consent and opt out prior to any data processing taking place.

This information is not shared with third parties or used for any marketing and you can withdraw your consent at any time via phone, email or by informing the practice DPO as below.

WHERE DO WE STORE YOUR INFORMATION?

The practice stores the main patient record via a contracted data processor in the cloud. The contracted processor for the practice is TPP SystmOne.

All the personal data we hold is processed and stored in the UK. Your information will not be sent outside of the UK where the laws do not protect your privacy to the same extent as the law in the UK. We will never sell any information about you.

No third parties have access to your personal data unless the law allows them to do so and appropriate safeguards have been put in place.

WHO ARE OUR PARTNER ORGANISATIONS?

We may also have to share your information, subject to strict agreements on how it will be used, with the following organisations:

NHS Trusts / Foundation Trusts
GPs
NHS Commissioning Support Units
Independent Contractors such as dentists, opticians, pharmacists
Private Sector Providers
Voluntary Sector Providers
Ambulance Trusts
Clinical Commissioning Groups
Social Care Services
NHS England (NHSE) and NHS Digital (NHSD)
Local Authorities
Education Services
Fire and Rescue Services
Police & Judicial Services
Voluntary Sector Providers
Private Sector Providers
Other ‘data processors’ which you will be informed of

We may also use external companies to process personal information, such as for archiving purposes. These companies are bound by contractual agreements to ensure information is kept confidential and secure. All employees and sub-contractors engaged by our practice are asked to sign a confidentiality agreement. If a sub-contractor acts as a data processor for Treeton Medical Centre an appropriate contract (UKGDPR Article 24-28) will be established for the processing of your information.

Primary Care Networks

The Practice is part of Raven. The objective of Primary Care Networks (PCNs) is for group practices working together to create more collaborative workforces which ease the pressure of GP’s, leaving them better able to focus on patient care.

Primary Care Networks form a key building block of the NHS long-term plan. Bringing general practices together to work at scale has been a policy priority for some years for a range of reasons, including improving the ability of practices to recruit and retain staff; to manage financial and estates pressures; to provide a wider range of services to patients and to more easily integrate with the wider health and care system.

This means the practice may share your information with other practices within the PCN to provide you with your care and treatment.

HOW LONG WILL WE STORE YOUR INFORMATION?

We are required under UK law to keep your information and data for the full retention periods as specified by the NHS Records management code of practice for health and social care and national archives requirements.

More information on records retention can be found online at (https://www.nhsx.nhs.uk/information-governance/guidance/records-management-code/)

YOUR RIGHTS

Under the UK General Data Protection Regulation all individuals have certain rights in relation to the information which the Practice holds about them. Not all rights apply equally to all our processing activity as certain rights are not available depending on the lawful basis for the processing. To get in touch about these, please contact us. We will seek to deal with your request without undue delay, and in any event in accordance with the requirements of any applicable laws. Please note that we may keep a record of your communications to help us resolve any issues which you raise.

Examples of where rights may not apply – where our lawful basis is:

Processing is necessary for the performance of a task carried out in the exercise of official authority vested in the controller – then rights of erasure, portability do not apply.
Legal Obligation – then rights of erasure, portability, objection, automated decision making and profiling do not apply.

If you require further detail each link below will take you to the Information Commissioner’s Office’s website where further detail is provided in section ‘When does the right apply’.

These rights are:

Under the NHS Constitution you have the right to privacy and to expect the NHS to keep your information confidential and secure.

You have the right to be informed about how your information is used.

Supporting these rights patients in England also have the right under the NHS Constitution to request that their personal confidential data is not used for reasons other than their individual care and treatment. The process for applying this right is called the ‘National Patient Data Opt-out’ this gives patients and the public the opportunity to make an informed choice about whether they wish their personally identifiable data to be used just for their individual care and treatment or also used for research and planning purposes.

However, there are exemptions to this, the national patient data opt-out applies unless:

There is a mandatory legal requirement or an overriding public interest for the data to be shared e.g. Adults and Children safeguarding.
The opt-out does not apply when the individual has consented to the sharing of their data; or
Where the data is anonymised in line with the Information Commissioner’s Office (ICO) Code of Practice on Anonymisation.

To be compliant with the national data opt-out policy the Practice has put procedures in place to review uses or disclosures of confidential patient information against the national data opt-out operational policy guidance.

If you believe the Practice is using your personal information in a way you would object to or contrary to your National Patient Data Opt-Out request, you have the right to object and have your objections considered and where your wishes cannot be followed, to be told the reasons including the legal basis.

For further details of the national patient data opt out can be found here: https://www.nhs.uk/your-nhs-data-matters/

Access to your personal information

Data Subject Access Requests (DSAR): You have a right under the Data Protection legislation to request access to view or to obtain copies of what information the surgery holds about you and to have it amended should it be inaccurate. To request this, you need to do the following:

Your request should be made to the Practice – for information from the hospital you should write direct to them
There is no charge to have a copy of the information held about you
We are required to respond to you within one month
You will need to give adequate information (for example full name, address, date of birth, NHS number and details of your request) so that your identity can be verified, and your records located information we hold about you at any time.

WHAT SHOULD YOU DO IF YOUR PERSONAL INFORMATION CHANGES?

You should tell us so that we can update our records please contact the Practice Manager as soon as any of your details change, this is especially important for changes of address or contact details (such as your mobile phone number), the practice will from time to time ask you to confirm that the information we currently hold is accurate and up-to-date.

QUERIES/COMPLAINTS

Should you have any concerns about how your information is managed at the GP, please contact the GP Practice Manager or the Data Protection Officer as above. If you are still unhappy following a review by the GP practice, you have a right to lodge a complaint with a supervisory authority: You have a right to complain to the UK supervisory Authority as below.

Information Commissioner:

Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Tel: 0303 1231113 or 01625 545745

https://ico.org.uk/

If you are happy for your data to be extracted and used for the purposes described in this privacy notice, then you do not need to do anything. If you have any concerns about how your data is shared, then please contact the Practice Data Protection Officer.

If you would like to know more about your rights in respect of the personal data we hold about you, please contact the Data Protection Officer as below.

DATA PROTECTION OFFICER

The Practice Data Protection Officer is Claire McInnes, Head of Information Governance at South Yorkshire Integrated Care Board. Any queries regarding Data Protection issues should be addressed to her at:

Email: syicb-rotherham.dpo@nhs.net

Postal:

Claire McInnes, Data Protection Officer
South Yorkshire ICB
Oak House
Bramley
Rotherham
S66 1YY

CHANGES

It is important to point out that we may amend this Privacy Notice from time to time. If you are dissatisfied with any aspect of our Privacy Notice, please contact the Practice Data Protection Officer.