Introduction
This document explains who we are, why information is collected about you, the ways in which this information may be used, who it is shared with and how we keep it safe. It also explains how the practice uses the information we hold about you, how you go about accessing this information if you wish to see it and to have any inaccuracies corrected or erased.
Who we are
Combe Down Surgery is a well-established GP surgery based in Bath. Our staff of General Practitioners and Nurses provides primary medical care services to our practice population of 9,200 patients and our administrative and managerial staff support the team in providing care for patients.
WHAT INFORMATION DO WE COLLECT FROM YOU?
GP Records are stored electronically and on paper and include personal details about you such as your address, carers, legal representatives, emergency contact details, as well as:
- Any contact the surgery has had with you, such as appointments, clinic visits, emergency appointments and telephone calls
- Notes and reports about your health
- Details about your treatment and care
- Details about any medication you are taking
- Results of investigations such as laboratory tests, x-rays
- Relevant information from other health professionals, relatives or those who care for you
WHY DO WE COLLECT THIS INFORMATION?
Your records are used to ensure you receive the best possible care from our nurses and doctors. It enables the staff to see previous treatments, medications and enables them to make informed decisions about future decisions about your care. It helps the doctors to see lists of previous treatments and any special considerations which need to be taken into account when care is provided.
Important information is also collected to help us to remind you about specific treatment which you might need, such as health checks, or reminders for screening appointments such as cytology reminders.
Information held about you may be used to help protect the health of the public and to help us to improve NHS services. Information may be used within the GP practice for clinical audit to monitor the quality of the service provided.
Staff at the practice use your information to help deliver more effective treatment to you and to help us to provide you with proactive advice and guidance.
Who MIGHT WE share your information with?
There are a number of ways information collected about you is shared, which includes:
- Patient referrals
With your agreement, your GP or Nurse may refer you to other services and healthcare providers not provided by the practice, or they may work with other services to provide your care in the practice. Once you have been seen for your referral, the other health care provider will normally tell us about the treatment they have provided for you and any follow up which the GPs need to provide. This information is then included in your GP record.
- Local Hospital, Community or Social Care Services
Sometimes the clinicians caring for you need to share some of your information with others who are also supporting you. This could include hospital or community based specialists, nurses, health visitors, therapists or social care services.
- Summary Care Record (SCR)
Summary Care Record is an electronic record of important patient information, created from the GP medical records. It contains information about medication you are taking, any allergies you suffer from and any bad reactions to medications you have previously had. It can be seen and used by authorised staff in other areas of the health and care system involved in your direct care. Giving healthcare staff access to this information can prevent mistakes being made when caring for you in an emergency or when your GP practice is closed. Your Summary Care Record also includes your name, address, date of birth and your unique NHS Number to help identify you correctly. If you and your GP decide to include more information it can be added to the Summary Care Record, but only with your express permission. For more information visit https://digital.nhs.uk/summary-care-records/patients
- National Services
There are some national services like the National Cancer Screening Programme that collect and keep information from across the NHS. This is how the NHS knows when to contact you about services like cervical, breast or bowel cancer screening. Often you have the right to not allow these organisations to have your information.
You can find out more about how the NHS holds and shares your information for national programmes on the NHS Choices website.
- Other NHS organisations
Sometimes the practice shares information with other organisations that do not directly treat you, for example, Clinical Commissioning Groups. Normally, it will not be possible to identify you from this information. This information is used to plan and improve services. The information collected includes data such as the area patients live, age, gender, ethnicity, language preference, country of birth and religion. The CCG also collects information about whether patients have long term conditions such as diabetes; blood pressure, cholesterol levels and medication. However, this information is anonymous and does not include anything written as notes by the GP and cannot be linked to you.
- Regulatory inspection by the Care Quality Commission (CQC)
The Care Quality Commission (CQC) is an organisation established in English law by the Health and Social Care Act. The CQC is the regulator for English health and social care services to ensure that safe care is provided. They inspect and produce reports on all English general practices in a rolling 5 year program. The law allows CQC to access identifiable patient data as well as requiring this practice to share certain types of data with them in certain circumstances, for instance following a significant safety incident.
For more information about the CQC see: http://www.cqc.org.uk/
- Emergencies
There are occasions when intervention is necessary in order to save or protect a patient’s life or to prevent them from serious immediate harm, for instance during a collapse or diabetic coma or serious injury or accident. In many of these circumstances the patient may be unconscious or too ill to communicate. In these circumstances we have an overriding duty to try to protect and treat the patient. If necessary we will share your information and possibly sensitive confidential information with other emergency healthcare services, the police or fire brigade, so that you can receive the best treatment. The law acknowledges this and provides supporting legal justifications.
Individuals have the right to make pre-determined decisions about the type and extent of care they will receive should they fall ill in the future, these are known as “Advance Directives”. If lodged in your records these will normally be honoured despite the observations in the first paragraph.
- In the interest of Public Health
Public health encompasses everything from national smoking and alcohol policies, the management of epidemics such as flu, the control of large scale infections such as TB and Hepatitis B to local outbreaks of food poisoning or Measles. Certain illnesses are also notifiable, i.e. the doctors treating the patient are required by law to inform the Public Health Authorities, for instance Scarlet Fever.
This will necessarily mean the subjects personal and health information being shared with the Public Health organisations.
- Safeguarding
Some members of society are recognised as needing protection, for example children and vulnerable adults. If a person is identified as being at risk from harm we are expected as professionals to do what we can to protect them. In addition we are bound by certain specific laws that exist to protect individuals. This is called “Safeguarding”.
To ensure that adult and children’s safeguarding matters are managed appropriately, access to identifiable information will be shared in circumstances where it’s legally required for the safety of the individuals concerned.
- NHS Payment Processes
Contract holding GPs in the UK receive payments from their respective governments on a tiered basis. Most of the income is derived from baseline capitation payments made according to the number of patients registered with the practice on quarterly payment days. These amounts, paid per patient, per quarter vary according to the age, sex and other demographic details for each patient. There are also graduated payments made according to the practice’s achievement of certain agreed national quality targets known as the Quality and Outcomes Framework (QOF), for instance the proportion of diabetic patients who have had an annual review.
Practices can also receive payments for participating in agreed national or local enhanced services, for instance opening early in the morning or late at night or at the weekends. Practices can also receive payments for certain national initiatives such as immunisation programs and practices may also receive incomes relating to a variety of non-patient related elements such as premises. Finally there are short term initiatives and projects that practices can take part in. Practices or GPs may also receive income for participating in the education of medical students, junior doctors and GPs themselves as well as research.
In order to make patient based payments basic and relevant necessary data about you needs to be sent to the various payment services. The release of this data is required by English laws.
What do we do with your information?
The healthcare professionals who provide your care maintain records about your health. This is a record of your care history and allows health care professionals to review your care to help inform future decisions about your treatment. Sharing this information helps to improve the treatment you receive, such as a hospital consultant writing to your GP. We follow strict data sharing guidelines to keep your information safe and secure.
HOW LONG DO WE KEEP YOUR INFORMATION?
Health and social care records are subject to a nationally agreed code of practice which regulates the minimum period for which records must be kept. This specifies that GP record should be retained until 10 years after the patient’s death or after the patient has permanently left the country, unless they remain in the European Union. Electronic patient records must not be destroyed or deleted for the foreseeable future. For more information, see the records management code of practice: https://digital.nhs.uk/article/1202/Records-Management-Code-of-Practice-for-Health-and-Social-Care-2016
How do we keep your information safe?
Every member of staff who works for an NHS organisation has a legal obligation to keep information about you confidential. We are committed to protecting your privacy and will only use information collected lawfully in accordance with:
- General Data Protection Regulation 2017
- Data Protection Act 1998
- Human Rights Act 1998
- Common Law Duty of Confidentiality
- Health and Social Care Act 2012
- NHS Codes of Confidentiality, Information Security and Records Management
- Information: To Share or Not to Share Review
We will only ever use or pass on information about you if others involved in your care have a genuine need for it. We will not disclose your information to any third party without your permission unless there are exceptional circumstances such as a life or death situation, or where the law requires information to be passed, or where it is in the best interest of the patient to share the information.
In May 2018, a new national regulation called the General Data Protection Regulation will come into force and the practice has a legal responsibility to ensure that we will also comply with these regulations.
YOUR INDIVIDUAL RIGHTS
Data Protection laws give you rights with regard to your information, below are details of how we will manage requests you might make. If you have any concerns about the use of your data and your rights, please contact us.
- HOW CAN I ACCESS THE INFORMATION YOU HOLD ABOUT ME?
You have a right under the Data Protection laws to have access/copies to the information the surgery holds about you and to have it amended should it be inaccurate.
In order to access your medical record, you need to let the practice know by making a Subject Access Request (SAR).
The practice will respond to your request within one month of receipt of your request. You will need to give adequate information (for example full name, address, date of birth, NHS number and details of your request) so that your identity can be verified and your records located.
Usually there is no charge to see the information that the practice holds about you unless the request is excessive or complicated.
For information about your hospital medical records, you should write direct to them.
- HAVE INACCURACIES CORRECTED OR ERASED
If you feel that the personal data that the practice holds about you is inaccurate or incomplete then please let us know and we will update your records within one month of notification. If this incorrect information has been sent onwards, we will also inform any other organisations of this. If it is not possible to correct the information then we will write to you to let you know the reason behind the decision and inform you how you can complain about this.
- RIGHT TO OBJECT – RESTRICT PROCESSING
As a patient, you have the right to object to personal data about you being used or shared. We will always listen to your concerns and endeavour to manage them to your satisfaction, however we have to balance your concerns with our ability to provide you with safe and effective care.
If you are a carer and have a Lasting Power of Attorney for health and welfare then you can also object to personal data being used or shared on behalf of the patient who lacks capacity.
If you do not hold a Lasting Power of Attorney then you can raise your specific concerns with the patient’s GP. If you have parental responsibility and your child is not able to make an informed decision for themselves, then you can make a decision about information sharing on behalf of your child. If your child is competent then this must be their decision.
Objections / Complaints
Should you have any concerns about how your information is managed at the practice, please contact the Practice Manager. If you are still unhappy following a review by the GP practice, you can then complain to the Information Commissioners Office (ICO) via their website: www.ico.gov.uk or you can contact:
The Information Commissioner
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Phone: 0303 123 1113
Further Information
Useful links on how NHS uses personal information and your rights:
The NHS Care Record Guarantee
The NHS Care Record Guarantee for England sets out the rules that govern how patient information is used in the NHS, what control the patient can have over this, the rights individuals have to request copies of their data and how data is protected under Data Protection Legislation. http://systems.digital.nhs.uk/infogov/links/nhscrg.pdf
The NHS Constitution
The NHS Constitution establishes the principles and values of the NHS in England. It sets out the rights patients, the public and staff are entitled to. These rights cover how patients access health services, the quality of care you’ll receive, the treatments and programmes available to you, confidentiality, information and your right to complain if things go wrong. https://www.gov.uk/government/publications/the-nhs-constitution-for-england
NHS Digital
NHS Digital collects health information from the records health and social care providers keep about the care and treatment they give, to promote health or support improvements in the delivery of care services in England. http://content.digital.nhs.uk/article/4963/What-we-collect
Review of Privacy Notice
We will keep this Privacy Notice under regular review.
