How we use your information

This privacy notice explains why we collect information about you and how that information may be used.  As controllers of data (Data Controllers), GPs have fair processing responsibilities  under the Data Protection Act 1998.  This means ensuring your personal confidential data (PCD) is handled in ways that are transparent and that you would reasonably expect.  The Health and Social Care Act 2012 changed the way that PCD are processed, therefore it is important that patients are made aware of and understand these changes and that you have an opportunity to object and know how to do so.

The health care professionals who provide you with care maintain records about your health and any treatment or care you have   received within the NHS eg. Hospitals, walk-in centres.  These records help to provide you with the best possible healthcare.   NHS health records may be processed electronically, on paper or a mixture of both, and a combination of working practices and technology are used to ensure that your information is kept confidential and secure.  Records held by the surgery may include the following information:

• Details about you, eg. address and next of kin etc.
• Any contacts with the surgery eg. appointments etc.
• Notes and reports about your health
• Details about your treatment and care
• Results of investigations eg. blood tests, x-rays etc.
• Relevant information from other health professionals, relatives or carers

The Practice collects and holds data for the sole purpose of providing healthcare services to our patients and we will ensure that the information is kept confidential.   However, we may disclose personal information if:

1. it is required by law
2. you consent— either implicitly or for the sake of their own care or explicitly for other purposes
3. it is justified in the public interest

Some of this information will be held centrally and used for statistical purposes.  Where we hold data centrally, we take strict measures to ensure that individual patients cannot be identified.  Sometimes your information may be requested to be used for research purposes— the practice will always endeavour to gain your consent before releasing the information.

Under the powers of the Health and Social Care Act 2013 (HSCA) the Health and Social Care Information Centre (HSCIC) can request PCD from GP practices without seeking patient consent.  The Care.Data Programme allows PCD to be collected by the HSCIC to ensure that the quality and safety of services is consistent across the county.  Improvements in information technology are also making it possible for us to share data with other healthcare providers with the objective of providing you with better care.  Any patient can choose to withdraw their consent to their data being used in this way.

Patient Confidentiality

We are committed to protecting your privacy and will only use information collected lawfully in accordance with the Data Protection Act 1998 (overseen by the Information Commissioner’s Office), Human Rights Act, the Common Law Duty of Confidentiality and the NHS Codes of Confidentiality and Security.

All our staff and contractors receive appropriate and on-going training to ensure they are aware of their personal responsibilities and have contractual obligations to uphold confidentiality, enforceable through disciplinary procedure.  Only a limited number of authorised staff have access to personal information where it is appropriate to their role and is strictly on a need-to-know basis.

We maintain our duty of confidentiality to you at all times.  We will only ever use or pass on information about you if others involved in your care have a genuine need for it.  We will not disclose your information to any third party without your permission unless where are exceptional circumstances or where the law requires information to be passed on.

Who are our partner organisations?

We may also have to share your information, subject to strict agreement on how it will be used, with the following organisations:

• NHS Trusts
• Specialist Trusts
• Independent Contractors eg.  dentists, opticians, pharmacists
• Private Sector Providers
• Voluntary Sector Providers
• Ambulance Trusts
• Clinical Commissioning Groups
• Social Care Services
• Local Authorities
• Education Services
• Police, Fire and Rescue Services
• Other “data processors”

Risk Stratification

Risk stratification is a process for identifying and managing patients who are at high risk of requiring emergency or urgent care.  Typically this is because patients have a long term condition such as COPD, cancer or other medical condition at risk of sudden worsening.  NHS England (the national Commissioning Board) encourages GPs to use risk stratification tools as part of their local strategies for supporting patient with long-term conditions and to provide acre plans and planned care with the aim to prevent avoidable admissions to hospital or other emergency care.

Information about you is collected from a number of sources including NHS Trusts and from this Practice.  A risk score is then arrived at through an analysis of your de-identified information using software and is only provided back in an identifiable form to your GP or member of your care team.  Risk stratification enables your GP to focus on preventing ill health and not just the treatment of sickness,  If necessary your GP may be able to offer your additional services.

You can opt out of Risk Stratification, just let us know (you can change your mind at any time by informing us).

Invoice Validation

If you have received treatment within the NHS your personal information may be shared within a strictly monitored, secure and confidential environment in order to determine which Clinical Commissioning Group should pay for the treatment or procedure you have received.

Information such as your name, address and date of treatment my be passed onto enable the billing process.  These details are held in a secure environment and kept confidential.  This information will only be used to validate invoices, and will not be shared for any other commissioning purposes.

Access to personal information

You have a right under the Data Protection Act 1998 to access/view what information the surgery holds about you, and to have it amended or removed should it be inaccurate. This is known as ‘the right of subject access’. If we do hold information about you we will:

• give you a description of it;
• tell you why we are holding it;
• tell you who it could be disclosed to; and
• let you have a copy of the information in an intelligible form.

If you would like to make a ‘subject access request’ please contact the practice manager in writing.  If you would like further information about how we use your information, or if you do not want us to use your information in this way, please contact the Practice Manager.